Eye on the Nile Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (46)

Idioma

en	44
es	2

País

us	24
ru	22

Actores

Stealth Soldier	1
Eye on the Nile	1
SystemBC	1

Interesar

Escribe

Not Defined	10
Router Operating System	4
Operating System	4
Forum Software	4
Smartphone Operating System	2

Proveedor

Not Defined	12
TP-LINK	2
DZCP	2
Apple	2
Google	2

Producto

TP-LINK TD-W9977v1	2
TP-LINK TL-WA801NDv5	2
TP-LINK TL-WA801Nv6	2
TP-LINK TL-WA802Nv5	2
TP-LINK Archer C3150v2	2

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgación de información	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	JForum Login escalada de privilegios	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00151	0.06	CVE-2012-5338
3	Linux Kernel UDP Packet udp.c escalada de privilegios	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.04837	0.03	CVE-2016-10229
4	Linux Kernel desbordamiento de búfer	10.0	9.0	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.07416	0.02	CVE-2008-1673
5	vBulletin redirector.php Redirect	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00122	0.28	CVE-2018-6200
6	Linux Kernel nf_conntrack_h323_asn1.c decode_choice denegación de servicio	7.5	6.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.08412	0.00	CVE-2007-3642
7	Netgear GC108P NSDP Packet sccd autenticación débil	6.7	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00073	0.00	CVE-2021-40866
8	Google Android xt_qtaguid.c qtaguid_untag desbordamiento de búfer	6.5	6.3	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00042	0.04	CVE-2021-0399
9	TP-LINK Archer C3150v2 dhcp.htm setDefaultHostname cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00536	0.03	CVE-2021-3275
10	Google Android ADSPRPC Heap Manager desbordamiento de búfer	8.5	8.2	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00119	0.05	CVE-2018-3586
11	Apple macOS WebKit escalada de privilegios	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00230	0.00	CVE-2021-1801
12	Linux Kernel ptrace.c escalada de privilegios	7.8	7.4	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00052	0.02	CVE-2019-13272
13	Samsung Mobile Devices SEAndroid Protection Mechanism escalada de privilegios	7.4	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00066	0.00	CVE-2020-13829
14	My Link Trader out.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.16
15	PHP phpinfo cross site scripting	6.3	5.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.08985	0.04	CVE-2006-0996
16	phpMyAdmin phpinfo.php divulgación de información	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00142	0.00	CVE-2016-9848
17	PHPWind goto.php Redirect	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00348	0.12	CVE-2015-4134
18	MGB OpenSource Guestbook email.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.01302	0.77	CVE-2007-0354
19	Google Chrome TransportDIB SkBitmap Pixel Data render_widget_snapshot_taker.cc WidgetDidReceivePaintAtSizeAck escalada de privilegios	6.5	6.2	$100k y más	$0-$5k	Not Defined	Official Fix	0.00622	0.00	CVE-2013-2836
20	Pixelpost cross site request forgery	7.0	6.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01098	0.02	CVE-2010-3305

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Campañas	Identified	Escribe	Confianza
1	185.125.230.116	revdns.dns.com	Eye on the Nile		2023-06-16	verified	Alto

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1059	CWE-94	Argument Injection	predictive	Alto
2	T1059.007	CWE-79	Cross Site Scripting	predictive	Alto
3	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
4	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
5	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Alto
6	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
7	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (25)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	/forum/away.php	predictive	Alto
2	File	/out.php	predictive	Medio
3	File	/sqfs/bin/sccd	predictive	Alto
4	File	admin/index.php	predictive	Alto
5	File	xxxxxxx/xxxxxxxxxx/xxxxxx_xxxxxx_xxxxxxxx_xxxxx.xx	predictive	Alto
6	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Alto
7	File	xxxx.xxx	predictive	Medio
8	File	xxxxx.xxx	predictive	Medio
9	File	xxxx.xxx	predictive	Medio
10	File	xxx/xxxxxx.xxx	predictive	Alto
11	File	xxxxxx/xxxxxx.x	predictive	Alto
12	File	xxx/xxxxxxxxx/xx_xxxxxxxxx_xxxx_xxxx.x	predictive	Alto
13	File	xxxxxxx.xxx	predictive	Medio
14	File	xxxx.xxx	predictive	Medio
15	File	xxxxxxxxxx.xxx	predictive	Alto
16	File	xxx.x	predictive	Bajo
17	File	xx_xxxxxxx.x	predictive	Medio
18	Argument	xxxxxxxx	predictive	Medio
19	Argument	xx	predictive	Bajo
20	Argument	xxxxxxxx	predictive	Medio
21	Argument	xxxxxxxxxx	predictive	Medio
22	Argument	xxxxxx_xx	predictive	Medio
23	Argument	xxx	predictive	Bajo
24	Argument	xxx	predictive	Bajo
25	Network Port	xxx	predictive	Bajo

Referencias (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Do you know our Splunk app?

Download it now for free!