TA428 Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (150)

Sprache

en	122
zh	18
ja	2
ar	2
fr	2

Land

us	44
cn	42
es	2
ir	2
gb	2

Akteure

TA428	8
TA505	1
Mirai	1
KingMiner	1
RedLine Stealer	1

Interesse

Typ

Not Defined	54
Content Management System	12
Web Server	8
Automation Software	6
WordPress Plugin	6

Hersteller

Not Defined	60
Microsoft	14
Google	6
Sun	4
Samsung	4

Produkt

Microsoft IIS	4
Samsung Tizen	4
Microsoft Windows	4
Redmine	4
openITCOCKPIT	4

Schwachstellen

#	Schwachstelle	Base	Temp	0day	Heute	Aus	Mas	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash Information Disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02	0.02016	CVE-2007-1192
2	Microsoft IIS Cross Site Scripting	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.03	0.00548	CVE-2017-0055
3	Sir GNUboard SQL Injection	6.3	6.3	$0-$5k	Wird berechnet	Not Defined	Not Defined	0.00	0.00112	CVE-2014-2339
4	Devilz Clanportal SQL Injection	7.3	7.0	$0-$5k	$0-$5k	High	Official Fix	0.00	0.00684	CVE-2006-6339
5	WordPress WP_Query class-wp-query.php SQL Injection	8.5	8.4	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.00318	CVE-2017-5611
6	Cisco ASA WebVPN Login Page logon.html Cross Site Scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.00192	CVE-2014-2120
7	Microsoft Windows Registry Password Information Disclosure	3.7	3.6	$25k-$100k	$0-$5k	Not Defined	Workaround	0.02	0.00000
8	Brocade Fabric OS CLI Local Privilege Escalation	7.8	7.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	0.00042	CVE-2022-33182
9	WordPress Password Reset wp-login.php mail erweiterte Rechte	6.1	5.8	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.02827	CVE-2017-8295
10	PHP Everywhere Plugin Shortcode Privilege Escalation	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00108	CVE-2022-24663
11	Microsoft Windows ICMP Remote Code Execution	9.8	8.9	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00	0.02758	CVE-2023-23415
12	Microsoft Windows Win32k Local Privilege Escalation	7.8	7.1	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.04	0.00264	CVE-2023-29336
13	Google WebP libwebp Pufferüberlauf	7.5	7.4	$5k-$25k	$0-$5k	High	Official Fix	0.03	0.49095	CVE-2023-4863
14	RARLabs WinRAR ZIP Archive Remote Code Execution	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.06	0.40418	CVE-2023-38831
15	SourceCodester Doctors Appointment System login.php SQL Injection	7.4	7.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.06	0.00064	CVE-2023-4219
16	Microsoft Excel Remote Code Execution	7.3	6.7	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00	0.00113	CVE-2023-33158
17	Microsoft Visual Studio unbekannte Schwachstelle	5.1	4.8	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00	0.00078	CVE-2023-28299
18	Microsoft Office Local Privilege Escalation	7.0	6.4	$0-$5k	$0-$5k	Unproven	Official Fix	0.02	0.00411	CVE-2023-33146
19	Th3-822 Rapidleech zip.php zip_go Cross Site Scripting	4.4	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00063	CVE-2021-4312
20	Google Chrome Blink erweiterte Rechte	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00	0.00133	CVE-2022-3315

IOC - Indicator of Compromise (10)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-Adresse	Hostname	Akteur	Identifiziert	Typ	Akzeptanz
1	5.180.174.10		TA428	16.08.2022	verifiziert	High
2	45.63.27.162	45.63.27.162.vultrusercontent.com	TA428	16.08.2022	verifiziert	High
3	XX.XX.XXX.XXX	xx.xx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxx	16.02.2024	verifiziert	High
4	XX.XXX.XXX.XXX		Xxxxx	16.08.2022	verifiziert	High
5	XX.XX.XXX.XXX	xxx-xxxxxxxx.xxx.xxx.xxx	Xxxxx	16.08.2022	verifiziert	High
6	XX.XXX.XXX.XX	xxxxxxxxxx.xx	Xxxxx	16.02.2024	verifiziert	High
7	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxx	16.02.2024	verifiziert	High
8	XXX.XXX.XXX.XXX	xxxxxxxxx.xxxxx.xxx	Xxxxx	16.08.2022	verifiziert	High
9	XXX.XXX.XX.XX	xxx-xxx-xx-xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxx	16.02.2024	verifiziert	High
10	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxx	16.08.2022	verifiziert	High

TTP - Tactics, Techniques, Procedures (19)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Schwachstellen	Zugriffsart	Typ	Akzeptanz
1	T1006	CWE-22	Path Traversal	prädiktiv	High
2	T1040	CWE-319	Authentication Bypass by Capture-replay	prädiktiv	High
3	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	prädiktiv	High
4	T1059	CWE-94	Argument Injection	prädiktiv	High
5	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	prädiktiv	High
6	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
7	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	prädiktiv	High
8	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	prädiktiv	High
9	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	prädiktiv	High
10	TXXXX	CWE-XX	Xxx Xxxxxxxxx	prädiktiv	High
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	prädiktiv	High
12	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
13	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	prädiktiv	High
14	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	prädiktiv	High
15	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
16	TXXXX.XXX	CWE-XXX	Xxxxxxxx	prädiktiv	High
17	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	prädiktiv	High
18	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	prädiktiv	High
19	TXXXX.XXX	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	prädiktiv	High

IOA - Indicator of Attack (61)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasse	Indicator	Typ	Akzeptanz
1	File	/+CSCOE+/logon.html	prädiktiv	High
2	File	/api/addusers	prädiktiv	High
3	File	/debug/pprof	prädiktiv	Medium
4	File	/forum/away.php	prädiktiv	High
5	File	/uncpath/	prädiktiv	Medium
6	File	adclick.php	prädiktiv	Medium
7	File	admin.cgi?action=%s	prädiktiv	High
8	File	xxxxxxxxxxx/xxxx/xxxxxxxxxx/xxxxxx.xxx	prädiktiv	High
9	File	xxxxx.xxx	prädiktiv	Medium
10	File	xxxxxxxx.xxx	prädiktiv	Medium
11	File	xxxxx/xxxxxxx.xxx	prädiktiv	High
12	File	xxxxxxx/xxxxxxx/xxx.xxx	prädiktiv	High
13	File	xxxxxx.xxx	prädiktiv	Medium
14	File	xxxxxxxxxxx/xxxxxx/xxx.xxx	prädiktiv	High
15	File	xxxx/xxxxxxxxxxxxxxx.xxx	prädiktiv	High
16	File	xxxxxx.xxx	prädiktiv	Medium
17	File	xxxx_xxx.xxx	prädiktiv	Medium
18	File	xxx/xxxxxx.xxx	prädiktiv	High
19	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	prädiktiv	High
20	File	xxxxxxxxxx/xxx/xxxxxx_xxxx.xxx	prädiktiv	High
21	File	xxxxxxxxxxx/xx_xxxx.x	prädiktiv	High
22	File	xxx\xxxxxxx\xxxxxxxx\xxxxx.xxxxxxxxxxxxxxx.xxx	prädiktiv	High
23	File	xxxxx.xxx	prädiktiv	Medium
24	File	xxx_xxxxxx_xxxxxx.xx	prädiktiv	High
25	File	xxxxxx/xxxxxxxxxxx.xxx?xxxx=xx&x=xxxxxxx	prädiktiv	High
26	File	xxx/xxxxx_xxxx.x	prädiktiv	High
27	File	xxxxxx/xxxxxxxxxx.xxx	prädiktiv	High
28	File	xxxxxxxxxxxxxx/xxxx/xxxxxxxxxxx/xxxxxxxxxxxxxxx.xxxx	prädiktiv	High
29	File	xxxxxxxx_xxxx.xxx	prädiktiv	High
30	File	xxxxxxx.xxx/xxxxx.xxx	prädiktiv	High
31	File	xxxxxxxxxxx.xxx	prädiktiv	High
32	File	xxxxx.xxx	prädiktiv	Medium
33	File	xxxxxxxxxxxxxxx.xxx	prädiktiv	High
34	File	xxx/xxx/xxx_xxxx/xxxx.x	prädiktiv	High
35	File	xxx/xxxxxxx.x	prädiktiv	High
36	File	xxxxxxxxxx.xxx	prädiktiv	High
37	File	xxxxxxxxxx.xxxx	prädiktiv	High
38	File	xx-xxxxx-xxxxxx.xxx	prädiktiv	High
39	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	prädiktiv	High
40	File	xx-xxxxx.xxx	prädiktiv	Medium
41	Library	xxx-xx-xxx-xxxx-xxxx-xx-x-x.xxx	prädiktiv	High
42	Library	xxx_xxxx.xxx	prädiktiv	Medium
43	Library	xxxxxxxxxxxxxxx.xxx	prädiktiv	High
44	Argument	xxxxxxx	prädiktiv	Low
45	Argument	xxxxxxxx	prädiktiv	Medium
46	Argument	xxxxx_xxxx	prädiktiv	Medium
47	Argument	xxxxx_xxxx/xx_xxxxx_xxxxx_xx/xx_xxxxx_xxxxx_xxxxx_xxxx_xxxx/xxxxx_xxxxxxxxx_xxxx/xxxxxx_xxxxxx_xxxxx	prädiktiv	High
48	Argument	xxxxxxx	prädiktiv	Low
49	Argument	xxxxxxxxxxxx	prädiktiv	Medium
50	Argument	xxxx_xxx	prädiktiv	Medium
51	Argument	xxxx	prädiktiv	Low
52	Argument	xxxx	prädiktiv	Low
53	Argument	xx	prädiktiv	Low
54	Argument	xxxxx	prädiktiv	Low
55	Argument	xxxxxxx_xxxx	prädiktiv	Medium
56	Argument	xxxxxx	prädiktiv	Low
57	Argument	xxxx	prädiktiv	Low
58	Argument	xxxxxxxxx	prädiktiv	Medium
59	Argument	xxxx->xxxxxxx	prädiktiv	High
60	Input Value	..	prädiktiv	Low
61	Input Value	/../	prädiktiv	Low

Referenzen (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ ZurückÜbersichtWeiter ▸

Interested in the pricing of exploits?

See the underground prices here!