Dragonfly Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (1000)

Idioma

en	936
de	20
fr	14
ru	14
pl	8

País

us	908
ru	24
gb	10
kr	4
fi	2

Actores

Dragonfly	12
Cobalt Strike	3
Meterpreter	2
Ryuk	1
TA406	1

Interesar

Escribe

Not Defined	80
Operating System	26
Content Management System	12
Web Server	6
Programming Language Software	6

Proveedor

Not Defined	76
Microsoft	16
Apple	12
Linux	6
YourFreeWorld	4

Producto

Apple Mac OS X Server	10
Microsoft Windows	8
Linux Kernel	6
Microsoft Office	4
PHP	4

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	DZCP deV!L`z Clanportal config.php escalada de privilegios	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.84	CVE-2010-0966
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgación de información	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
3	DZCP deV!L`z Clanportal browser.php divulgación de información	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02733	0.80	CVE-2007-1167
4	Apple Mac OS X Server escalada de privilegios	6.5	6.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2010-1821
5	OpenBB read.php sql injection	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00250	0.06	CVE-2005-1612
6	Apple Mac OS X Server Wiki Server sql injection	5.3	4.6	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00339	2.24	CVE-2015-5911
7	Microsoft Windows OLE olecnv32.dll escalada de privilegios	7.0	6.3	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.63864	0.00	CVE-2017-8487
8	Apple Mac OS X Server Profile Manager escalada de privilegios	7.5	6.5	$5k-$25k	$0-$5k	Unproven	Official Fix	0.01876	0.03	CVE-2013-0269
9	Lars Ellingsen Guestserver guestbook.cgi cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00169	0.24	CVE-2005-4222
10	Microsoft Windows SPNEGO Extended Negotiation Remote Code Execution	7.9	7.2	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00662	0.00	CVE-2022-37958
11	Devilz Clanportal index.php sql injection	7.3	6.4	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00784	0.00	CVE-2006-3347
12	Article Dashboard signup.php cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00240	0.03	CVE-2007-4333
13	PHP phpinfo cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02101	0.00	CVE-2007-1287
14	Devilz Clanportal File Upload vulnerabilidad desconocida	5.3	4.4	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.05362	0.06	CVE-2006-6338
15	Joomla CMS com_easyblog sql injection	6.3	6.1	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00000	0.16
16	Microsoft Windows Mark of the Web vulnerabilidad desconocida	5.4	4.9	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00313	0.00	CVE-2022-41091
17	Synacor Zimbra Collaboration Suite sudo Configuration zmslapd escalada de privilegios	8.3	8.3	$0-$5k	$0-$5k	High	Official Fix	0.00114	0.02	CVE-2022-37393
18	vsftpd Service Port 6200 escalada de privilegios	8.5	8.4	$25k-$100k	$5k-$25k	Not Defined	Workaround	0.84215	0.04	CVE-2011-2523
19	MGB OpenSource Guestbook email.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.01302	0.76	CVE-2007-0354
20	Tiki Admin Password tiki-login.php autenticación débil	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	2.80	CVE-2020-15906

Campañas (1)

These are the campaigns that can be associated with the actor:

Karagany

IOC - Indicator of Compromise (23)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Campañas	Identified	Escribe	Confianza
1	5.45.119.124		Dragonfly		2021-06-16	verified	Alto
2	5.135.104.77		Dragonfly	Karagany	2020-12-16	verified	Alto
3	5.196.167.184	ip184.ip-5-196-167.eu	Dragonfly		2021-06-16	verified	Alto
4	37.139.7.16		Dragonfly		2021-06-16	verified	Alto
5	51.159.28.101	51-159-28-101.rev.poneytelecom.eu	Dragonfly		2021-06-16	verified	Alto
6	XX.XX.XX.XXX		Xxxxxxxxx		2020-12-24	verified	Alto
7	XX.XXX.XXX.XXX	xxxxxx.xxxxxxx-xxxxx.xx	Xxxxxxxxx		2020-12-16	verified	Alto
8	XX.XXX.XX.XX	xxx.xxxxxxxx.xx	Xxxxxxxxx		2021-06-16	verified	Alto
9	XX.XXX.XXX.XXX	xxxxxx-xx.xxxxxxx.xxx	Xxxxxxxxx		2021-01-01	verified	Alto
10	XX.XXX.XXX.XXX		Xxxxxxxxx		2021-01-01	verified	Alto
11	XXX.XXX.XXX.XX		Xxxxxxxxx		2021-06-16	verified	Alto
12	XXX.XXX.XXX.XX	xxxxxx.xx.xxx.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxxxxx		2021-06-16	verified	Alto
13	XXX.X.XX.XX		Xxxxxxxxx		2021-06-16	verified	Alto
14	XXX.XX.XX.XX	xxxxxxxx.xx-xxx-xx-xx.xxx	Xxxxxxxxx		2021-06-16	verified	Alto
15	XXX.XXX.XXX.XXX	xxxxxx-xxx-xxx-xxx-xxx.xxxxxxxx.xxx	Xxxxxxxxx	Xxxxxxxx	2020-12-16	verified	Alto
16	XXX.XX.XXX.XX	xx.xxxxxxxxxxxxxx.xxxxx	Xxxxxxxxx	Xxxxxxxx	2020-12-16	verified	Alto
17	XXX.XX.XXX.XX		Xxxxxxxxx		2021-06-16	verified	Alto
18	XXX.XXX.XXX.XXX		Xxxxxxxxx		2020-12-24	verified	Alto
19	XXX.XXX.XXX.XXX		Xxxxxxxxx		2020-12-24	verified	Alto
20	XXX.XXX.XX.XXX	xxxxxx.xxxx.xxx.xxxxxxxxxxx.xxx	Xxxxxxxxx		2021-06-16	verified	Alto
21	XXX.XX.XXX.XX	xxxx-xxx-xx-xxx-xx.xxxxxxxxxxx.xxx	Xxxxxxxxx		2021-06-16	verified	Alto
22	XXX.XX.XXX.XXX	xxxx-xxx-xx-xxx-xxx.xxxxxxxxxxx.xxx	Xxxxxxxxx		2021-06-16	verified	Alto
23	XXX.XX.XXX.X		Xxxxxxxxx		2020-12-24	verified	Alto

TTP - Tactics, Techniques, Procedures (14)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1006	CWE-22	Path Traversal	predictive	Alto
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	T1059	CWE-94	Argument Injection	predictive	Alto
4	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
8	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
9	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
10	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	Alto
12	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
13	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto
14	TXXXX.XXX	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Alto

IOA - Indicator of Attack (102)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	%SYSTEMDRIVE%\totalcmd\TOTALCMD64.EXE	predictive	Alto
2	File	/cgi-bin/system_mgr.cgi	predictive	Alto
3	File	/s/	predictive	Bajo
4	File	/secure/admin/ImporterFinishedPage.jspa	predictive	Alto
5	File	/uncpath/	predictive	Medio
6	File	/wbg/core/_includes/authorization.inc.php	predictive	Alto
7	File	14all.cgi/14all-1.1.cgi/traffic.cgi/mrtg.cgi	predictive	Alto
8	File	adclick.php	predictive	Medio
9	File	admin/import/class-import-settings.php	predictive	Alto
10	File	ajax/comments.php	predictive	Alto
11	File	architext.conf	predictive	Alto
12	File	attachment_send.php	predictive	Alto
13	File	auth2-gss.c	predictive	Medio
14	File	xxxx/xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	Alto
15	File	xxxxxxxx.xxx	predictive	Medio
16	File	xxx-xxx/xxxxx/xxxxx.xxx	predictive	Alto
17	File	xxxxx.xxx	predictive	Medio
18	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Alto
19	File	xxxxxx.xxx	predictive	Medio
20	File	xxxxx.xxx	predictive	Medio
21	File	xxxxxxxx.xxx	predictive	Medio
22	File	xxxx.xxx	predictive	Medio
23	File	xxxx.x	predictive	Bajo
24	File	xxxxxxxxx.xxx	predictive	Alto
25	File	xxxxxxxxx.xxx	predictive	Alto
26	File	xxxx.xxx	predictive	Medio
27	File	xxxx.xxx	predictive	Medio
28	File	xxx/xxxxxx.xxx	predictive	Alto
29	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	Alto
30	File	xxxxx.xxx	predictive	Medio
31	File	xxxxx/xxxxx.xxx	predictive	Alto
32	File	xxxxxx/xxxxx.x	predictive	Alto
33	File	xxxxx.xxx	predictive	Medio
34	File	xxxx.xxx	predictive	Medio
35	File	xxx_xxxx.xxx	predictive	Medio
36	File	xxxxxx.xxx	predictive	Medio
37	File	xxxx.x	predictive	Bajo
38	File	xxxxxxxxxxxxxxx/	predictive	Alto
39	File	xxxx.xxx	predictive	Medio
40	File	xxxxx.xxx	predictive	Medio
41	File	xxxxxxxx.xxx	predictive	Medio
42	File	xxxxxxxx.x	predictive	Medio
43	File	xxxxxx_xxxxxx.xxx	predictive	Alto
44	File	xxxxxx.xxx	predictive	Medio
45	File	xxxxxx\xxxxxxxx\xx_xxxxx_xxxxxxx.xxx	predictive	Alto
46	File	xxxxxxx.xxx.xx.xxxxxxxxxxx.xxx	predictive	Alto
47	File	xxxxxxxxx/xxxxx/xxxx/xxx_xxxxxxx/xxxxxxx/xxxxxxx.xxx	predictive	Alto
48	File	xxxx-xxxxx.xxx	predictive	Alto
49	File	xxxx-xxxxxxxx.xxx	predictive	Alto
50	File	xx_xxxxx.xxx	predictive	Medio
51	File	xxxxxxxxxxx.xxxx.xxx	predictive	Alto
52	File	xxxxxxx.x	predictive	Medio
53	File	xxxx_xxxxxx.xxx	predictive	Alto
54	File	xxxx.xxx	predictive	Medio
55	File	xxx/xxxxx/xxxxx.xxx	predictive	Alto
56	File	xxxxx/xxxxxxxx	predictive	Alto
57	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	Alto
58	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	Alto
59	File	xxxxxxxxxx.xxx	predictive	Alto
60	File	xxxxxxx	predictive	Bajo
61	File	~/xxxxxxxx/xxxxx-xxx-xxxxxx-xxxxxxxxxxxx.xxx	predictive	Alto
62	Library	xxxx/xxx/xxxxxx.xxx	predictive	Alto
63	Library	xxx/xxxxxx/xxxxxxxxx.xx	predictive	Alto
64	Library	xxxxxxxx.xxx	predictive	Medio
65	Argument	xxxx	predictive	Bajo
66	Argument	xxxxxx_xx[]	predictive	Medio
67	Argument	xxxxxxxx	predictive	Medio
68	Argument	xxxxx	predictive	Bajo
69	Argument	xxxx	predictive	Bajo
70	Argument	xxxxxxxxxx	predictive	Medio
71	Argument	xxxxx	predictive	Bajo
72	Argument	xxx	predictive	Bajo
73	Argument	xxxxxxx	predictive	Bajo
74	Argument	xxxxx	predictive	Bajo
75	Argument	xxxx	predictive	Bajo
76	Argument	xxxx	predictive	Bajo
77	Argument	xx	predictive	Bajo
78	Argument	xxxxx.xxx?xxxxxx=xxx_xxxxxxx/xxxx=xxxxxxx/xx=x/xxxxxxxx=xxxxx	predictive	Alto
79	Argument	xxxxxx/xxxxxxxxx/xxxxxx_xxxx	predictive	Alto
80	Argument	xxxx	predictive	Bajo
81	Argument	xx_xxxxxx	predictive	Medio
82	Argument	xxxxxxx/xxxxxx/xxxxxxx/xxxxxxxxx	predictive	Alto
83	Argument	xxxx_xxxx	predictive	Medio
84	Argument	xxxxx	predictive	Bajo
85	Argument	xxxxxxxx	predictive	Medio
86	Argument	xxxx_xxxx	predictive	Medio
87	Argument	xxx	predictive	Bajo
88	Argument	xxxxxx	predictive	Bajo
89	Argument	xxxx	predictive	Bajo
90	Argument	xxxxxx	predictive	Bajo
91	Argument	xxx	predictive	Bajo
92	Argument	xxx	predictive	Bajo
93	Argument	xxxxxx	predictive	Bajo
94	Argument	xxxxxxxx	predictive	Medio
95	Argument	xxxx_xx	predictive	Bajo
96	Argument	xxx_xxxxx	predictive	Medio
97	Argument	_xxx_xxxxxxxxxxx_	predictive	Alto
98	Argument	__xxxxxxxxx	predictive	Medio
99	Input Value	xxxxxxxx	predictive	Medio
100	Input Value	xxxxxxxxxxxxxxxxxxxxxxxxxxxx+xxxxx+xxxxxx+x,x,xxxx,xxx,x,x+xxxx+xxx_xxxxx+xxxxx+xx=x--+	predictive	Alto
101	Network Port	xxx/xxxx	predictive	Medio
102	Network Port	xxx/xxxxx	predictive	Medio

Referencias (6)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!