WarZoneRAT Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (83)

Sprache

en	64
de	10
zh	8
it	2

Land

cn	16
us	14
es	8
de	6
it	6

Akteure

Remcos	2
Ave Maria	2
Nanocore RAT	2
BitRAT	2
AsyncRAT	2

Interesse

Typ

Not Defined	26
Log Management Software	8
Operating System	6
Network Management Software	4
Network Attached Storage Software	4

Hersteller

Not Defined	24
Microsoft	8
HPE	6
QNAP	4
Citrix	2

Produkt

Microsoft Windows	6
HPE Intelligent Management Center	6
cPanel	4
Citrix SD-WAN Center	2
Kaspersky Anti-Virus	2

Schwachstellen

#	Schwachstelle	Base	Temp	0day	Heute	Aus	Mas	EPSS	CTI	CVE
1	Apache HTTP Server mod_proxy erweiterte Rechte	7.3	7.3	$5k-$25k	$25k-$100k	High	Not Defined	0.97446	0.00	CVE-2021-40438
2	Microsoft Excel Pufferüberlauf	7.0	6.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01492	0.07	CVE-2020-0650
3	VMware Spring Boot HTTP Request Denial of Service	5.7	5.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00043	0.06	CVE-2023-34055
4	bouncycastle Self-Signed Certificate X509LDAPCertStoreSpi.java erweiterte Rechte	3.9	3.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00051	0.04	CVE-2023-33201
5	Nagios XI POST Request banner_message-ajaxhelper.php SQL Injection	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00085	0.07	CVE-2023-40931
6	Taokeyun HTTP POST Request Drs.php index SQL Injection	8.1	7.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00063	0.04	CVE-2024-0480
7	Apache ShardingSphere ElasticJob-UI Information Disclosure	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.19070	0.00	CVE-2022-22733
8	phpMyAdmin SQL File Cross Site Scripting	4.4	4.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00053	0.03	CVE-2023-25727
9	ZoneMinder HostController.php daemonControl erweiterte Rechte	7.4	7.3	$0-$5k	Wird berechnet	Not Defined	Official Fix	0.00119	0.05	CVE-2023-26039
10	Zoho ManageEngine Recovery Manager Plus Proxy Setting Privilege Escalation	5.7	5.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00507	0.00	CVE-2023-48646
11	jeecgboot JimuReport image Directory Traversal	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00062	0.04	CVE-2023-6307
12	WP Shortcodes Plugin erweiterte Rechte	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00050	0.04	CVE-2023-6226
13	QDocs Smart School HTTP POST Request SQL Injection	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00077	0.07	CVE-2023-5495
14	MongoDB erweiterte Rechte	6.6	6.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00109	0.00	CVE-2019-2386
15	MongoDB Message Decompressor Denial of Service	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00087	0.02	CVE-2019-20925
16	MongoDB SysV Init Script Kill erweiterte Rechte	4.2	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.04	CVE-2019-2389
17	Job Configuration History Plugin Directory Traversal	3.9	3.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00046	0.00	CVE-2023-41930
18	TEL-STER TelWin SCADA WebInterface Information Disclosure	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00076	0.00	CVE-2023-0956
19	Tongda OA delete_seal.php SQL Injection	6.9	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00066	0.07	CVE-2023-4165
20	Autodesk AutoCAD STP File Parser Denial of Service	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00045	0.00	CVE-2023-41139

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-Adresse	Hostname	Akteur	Kampagnen	Identifiziert	Typ	Akzeptanz
1	185.19.85.163		WarZoneRAT		12.07.2022	verifiziert	High
2	XXX.XXX.XX.XXX		Xxxxxxxxxx		12.07.2022	verifiziert	High

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klassifizierung	Schwachstellen	Zugriffsart	Typ	Akzeptanz
1	T1006	CAPEC-126	CWE-22, CWE-23	Path Traversal	prädiktiv	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	prädiktiv	High
3	T1059	CAPEC-242	CWE-94	Argument Injection	prädiktiv	High
4	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	prädiktiv	High
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
6	TXXXX	CAPEC-150	CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	prädiktiv	High
7	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	prädiktiv	High
8	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxxx Xxxxxx	prädiktiv	High
9	TXXXX	CAPEC-108	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	prädiktiv	High
10	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	prädiktiv	High
11	TXXXX	CAPEC-38	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	prädiktiv	High
12	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
13	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	prädiktiv	High

IOA - Indicator of Attack (37)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasse	Indicator	Typ	Akzeptanz
1	File	/admin/syslog	prädiktiv	High
2	File	/course/filterRecords/	prädiktiv	High
3	File	/download/image	prädiktiv	High
4	File	/nagiosxi/admin/banner_message-ajaxhelper.php	prädiktiv	High
5	File	/see_more_details.php	prädiktiv	High
6	File	/xxx/xxx/xxx/xxxxxxxxxx/xxxxxxxxxxxxxx.xxx	prädiktiv	High
7	File	xxxxx/xxxxx_xxxxx.xxx	prädiktiv	High
8	File	xxxxx/xxxxxxxxxxxxx.xxx	prädiktiv	High
9	File	xxxxxxxxxxx/xxxxx/xxxxxxxxxx/x/xxx.xxx	prädiktiv	High
10	File	xxxxx.xxx	prädiktiv	Medium
11	File	xxx.xxx	prädiktiv	Low
12	File	xxxxxx/xxx.x	prädiktiv	Medium
13	File	xxxxxxx.xxx	prädiktiv	Medium
14	File	xxxxxxx/xxxxxx/xxxx_xxxxxx/xxxxxxxxxx/xxxxxx_xxxx.xxx	prädiktiv	High
15	File	xxxxx.xxx/xxxx/xxxxx/xxxx/xxxx.xxx	prädiktiv	High
16	File	xxxx_xxxxxxx.xxx	prädiktiv	High
17	File	xxxxx_xxx.xxx	prädiktiv	High
18	File	xxxxxxxx.xxx	prädiktiv	Medium
19	File	xxxx.xxx	prädiktiv	Medium
20	File	xxxx-xxxxxx.x	prädiktiv	High
21	File	xxxxx.xxx	prädiktiv	Medium
22	File	xxxxxxxxxxxxxxxxxxxx.xxxx	prädiktiv	High
23	Library	xxxxxx.xxx	prädiktiv	Medium
24	Argument	xxxxxx	prädiktiv	Low
25	Argument	xxx	prädiktiv	Low
26	Argument	xxx	prädiktiv	Low
27	Argument	xxxxxx_xxx	prädiktiv	Medium
28	Argument	xxxxx	prädiktiv	Low
29	Argument	xx	prädiktiv	Low
30	Argument	xx	prädiktiv	Low
31	Argument	xxxxxxxx	prädiktiv	Medium
32	Argument	xxxx	prädiktiv	Low
33	Argument	xxxxxxxxxx[x][xxxxx]/xxxxxxxxxx[x][xxxxxxxxxxx]/xxxxxxxxxx[x][xxxxxxxxxxx]	prädiktiv	High
34	Argument	xxxxxxxx	prädiktiv	Medium
35	Argument	xxx	prädiktiv	Low
36	Argument	xxxx	prädiktiv	Low
37	Pattern	\|xx xx xx\|	prädiktiv	Medium

Referenzen (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ ZurückÜbersichtWeiter ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!