SombRAT Analyse

IOB - Indicator of Behavior (15)

Zeitverlauf

Sprache

en10
zh2
es2
fr2

Land

Akteure

Aktivitäten

Interesse

Zeitverlauf

Typ

Hersteller

Produkt

Microsoft Windows4
Siemens SICAM PAS2
Siemens SICAM PQS2
Wireshark2
HP System Management Homepage2

Schwachstellen

#SchwachstelleBaseTemp0dayHeuteAusMasCTIEPSSCVE
1Oracle PeopleSoft Enterprise PeopleTools Integration Broker erweiterte Rechte6.55.9$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.050.00799CVE-2017-3548
2Microsoft Windows win32k.sys xxxMenuWindowProc Denial of Service5.55.0$5k-$25kWird berechnetProof-of-ConceptUnavailable0.040.00000
3WSO2 API Manager File Upload erweiterte Rechte9.89.8$0-$5k$0-$5kNot DefinedNot Defined0.020.97223CVE-2022-29464
4Wireshark DNP Dissector Denial of Service5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.000.00242CVE-2021-22235
5Siemens SICAM PAS/SICAM PQS erweiterte Rechte8.38.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.010.00047CVE-2022-43722
6Microsoft Windows TCP/IP Remote Code Execution9.88.9$25k-$100k$5k-$25kUnprovenOfficial Fix0.000.28837CVE-2022-34718
7Microsoft Windows Common Log File System Driver Privilege Escalation8.17.4$25k-$100k$5k-$25kUnprovenOfficial Fix0.020.00128CVE-2022-37969
8Yoast SEO Plugin REST Endpoint posts Information Disclosure3.53.4$0-$5k$0-$5kNot DefinedOfficial Fix0.030.00173CVE-2021-25118
9TrackR Bravo App Cloud API Authentication Password erweiterte Rechte6.05.8$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00169CVE-2016-6538
10HP Integrated Lights-Out IPMI Protocol erweiterte Rechte8.28.0$5k-$25k$0-$5kHighWorkaround0.030.27196CVE-2013-4786
11lighttpd Log File http_auth.c erweiterte Rechte7.57.1$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.030.01123CVE-2015-3200
12HP System Management Homepage Denial of Service5.04.8$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.00289CVE-2010-1034
13HPE System Management Homepage erweiterte Rechte9.89.6$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.01960CVE-2016-1995
14HPE System Management Homepage erweiterte Rechte7.77.5$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.00066CVE-2016-1996

IOC - Indicator of Compromise (23)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueSchwachstellenZugriffsartTypAkzeptanz
1T1055CWE-74Improper Neutralization of Data within XPath ExpressionsprädiktivHigh
2T1059.007CWE-79Cross Site ScriptingprädiktivHigh
3TXXXXCWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxprädiktivHigh
4TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxprädiktivHigh
5TXXXXCWE-XXXXxxxxxxxx Xxxxxx XxxxprädiktivHigh
6TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxprädiktivHigh
7TXXXX.XXXCWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxprädiktivHigh

IOA - Indicator of Attack (3)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlasseIndicatorTypAkzeptanz
1Filehttp_auth.cprädiktivMedium
2Filexx/xx/xxxxxprädiktivMedium
3Libraryxxxxxx.xxxprädiktivMedium

Referenzen (2)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!