MATA Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (323)

Idioma

en	256
zh	46
de	6
fr	6
es	4

País

la	206
us	70
gb	12
cn	12
me	12

Actores

Cobalt Strike	15
Ave Maria	9
Lazarus	8
RedLine Stealer	8
MATA	6

Interesar

Escribe

Not Defined	100
Content Management System	32
WordPress Plugin	18
Operating System	18
Groupware Software	12

Proveedor

Not Defined	126
Microsoft	34
Apache	10
Revive	8
Alt-N	4

Producto

Microsoft Windows	16
WordPress	10
Revive Adserver	8
Microsoft Exchange Server	6
Apache Tomcat	6

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	TikiWiki tiki-register.php escalada de privilegios	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01009	1.63	CVE-2006-6168
2	Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 escalada de privilegios	5.3	5.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00047	0.07	CVE-2023-1453
3	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	2.67
4	Tiki Admin Password tiki-login.php autenticación débil	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	3.01	CVE-2020-15906
5	WordPress AdServe adclick.php sql injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00073	0.17	CVE-2008-0507
6	Primetek Primefaces cifrado débil	8.5	8.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.97013	0.04	CVE-2017-1000486
7	Drupal Sanitization API cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00056	0.02	CVE-2020-13672
8	Microsoft Windows HMAC Key Derivation Local Privilege Escalation	8.8	8.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00048	0.03	CVE-2023-36400
9	LiteSpeed Cache Plugin Shortcode cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00051	0.03	CVE-2023-4372
10	WebTitan Appliance Extensions Persistent cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
11	ipTIME NAS-I Bulletin Manage escalada de privilegios	7.1	7.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00988	0.03	CVE-2020-7847
12	RARLabs WinRAR ZIP Archive Remote Code Execution	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.44373	0.03	CVE-2023-38831
13	request-baskets API Request {name} escalada de privilegios	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.08109	0.00	CVE-2023-27163
14	DZCP deV!L`z Clanportal config.php escalada de privilegios	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.95	CVE-2010-0966
15	PHP phpinfo cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02101	0.00	CVE-2007-1287
16	nginx escalada de privilegios	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	4.26	CVE-2020-12440
17	Microsoft Windows Scripting Engine Remote Code Execution	5.9	5.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.37113	0.00	CVE-2021-34480
18	NotificationX Plugin SQL Statement sql injection	5.6	5.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02414	0.04	CVE-2022-0349
19	DevExpress ASP.NET Web Forms ASPxHttpHandlerModule DXR.axd escalada de privilegios	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00183	0.09	CVE-2022-41479
20	Basilix Webmail login.php3 escalada de privilegios	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.02

IOC - Indicator of Compromise (19)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Identified	Escribe	Confianza
1	2.4.17.15	lfbn-mon-1-592-15.w2-4.abo.wanadoo.fr	Mata	2020-07-25	verified	Alto
2	23.227.199.53	23-227-199-53.static.hvvc.us	MATA	2022-03-31	verified	Alto
3	23.227.199.69	23-227-199-69.static.hvvc.us	MATA	2022-03-31	verified	Alto
4	23.254.119.12		MATA	2022-03-31	verified	Alto
5	XX.XX.XXX.XXX		Xxxx	2022-03-31	verified	Alto
6	XX.XXX.XXX.XX		Xxxx	2022-03-31	verified	Alto
7	XXX.XXX.XX.X		Xxxx	2022-03-31	verified	Alto
8	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxx	2022-03-31	verified	Alto
9	XXX.XXX.XX.XX	xxxxxxx.xxx-xxxxxxxxxxx.xxxx	Xxxx	2022-03-31	verified	Alto
10	XXX.XX.XXX.XXX	xxxx.xxxxxxxxxxxxxxxxxxxxx.xxx	Xxxx	2022-03-31	verified	Alto
11	XXX.XX.XXX.XXX	xxxxxxx.xxxxx.xx	Xxxx	2022-03-31	verified	Alto
12	XXX.XX.XXX.XX	xx-xxx-xx-xxx-xx.xxxx.xxxxxxxxx.xxx	Xxxx	2022-03-31	verified	Alto
13	XXX.XX.XXX.XX		Xxxx	2022-03-31	verified	Alto
14	XXX.XX.XXX.XXX	xxx-xxx-xx-xxx.xxxxxxx-xxx	Xxxx	2022-03-31	verified	Alto
15	XXX.XX.XX.XXX		Xxxx	2022-03-31	verified	Alto
16	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx	Xxxx	2022-03-31	verified	Alto
17	XXX.XXX.XXX.X		Xxxx	2022-03-31	verified	Alto
18	XXX.XX.XXX.XX	xxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxx.xxx	Xxxx	2022-03-31	verified	Alto
19	XXX.XXX.XX.XXX	xxxxxxx.xx-xxxx-xxx-xxxx.xxx	Xxxx	2022-03-31	verified	Alto

TTP - Tactics, Techniques, Procedures (20)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1006	CWE-21, CWE-22, CWE-24	Path Traversal	predictive	Alto
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	T1059	CWE-88, CWE-94, CWE-1321	Argument Injection	predictive	Alto
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Alto
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
8	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
9	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Alto
10	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Alto
11	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
12	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Alto
13	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
14	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
15	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	Alto
16	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
17	TXXXX.XXX	CWE-XX	Xxxxxxxxxxxxx	predictive	Alto
18	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto
19	TXXXX.XXX	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Alto
20	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (172)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	/admin/dl_sendmail.php	predictive	Alto
2	File	/adminPage/conf/reload	predictive	Alto
3	File	/api/baskets/{name}	predictive	Alto
4	File	/api/v2/cli/commands	predictive	Alto
5	File	/Device/Device/GetDeviceInfoList?deviceCode=&searchField=&deviceState=	predictive	Alto
6	File	/DXR.axd	predictive	Medio
7	File	/forum/away.php	predictive	Alto
8	File	/mfsNotice/page	predictive	Alto
9	File	/novel/bookSetting/list	predictive	Alto
10	File	/novel/userFeedback/list	predictive	Alto
11	File	/out.php	predictive	Medio
12	File	/owa/auth/logon.aspx	predictive	Alto
13	File	/phppath/php	predictive	Medio
14	File	/spip.php	predictive	Medio
15	File	/systemrw/	predictive	Medio
16	File	/x_portal_assemble_surface/jaxrs/portal/list?v=8.2.3-4-43f4fe3	predictive	Alto
17	File	/zm/index.php	predictive	Alto
18	File	adclick.php	predictive	Medio
19	File	admin.jcomments.php	predictive	Alto
20	File	admin/gv_mail.php	predictive	Alto
21	File	application/modules/admin/views/ecommerce/products.php	predictive	Alto
22	File	xxxx/xxxxxxxxxxxx.xxx	predictive	Alto
23	File	xxxx.xxx	predictive	Medio
24	File	xx_xxxx_xx_xxxx_xxxx.xxx	predictive	Alto
25	File	xxxx_xxxxxxx.xxx	predictive	Alto
26	File	xxxxxxxx.xxx	predictive	Medio
27	File	xxxxxx.xxx	predictive	Medio
28	File	xxxxx.xxx	predictive	Medio
29	File	xxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxx/xxxx_xxxxx.xxxx	predictive	Alto
30	File	xxxxx-xxxxxxx.xxx	predictive	Alto
31	File	xxxxxxxxxx/xxx_xxxxxxxxxx/xxxxxxx/xxxxxxxxxx.xxx	predictive	Alto
32	File	xxxxxxxxxx\xxxx.xxx	predictive	Alto
33	File	xxxxxxxxxxx.xxx	predictive	Alto
34	File	xxxx-xxxxxx.xxx	predictive	Alto
35	File	xxxx.xxx	predictive	Medio
36	File	xxx/xxxx/xxxx_xxxxxx.x	predictive	Alto
37	File	xxxxxxxxxxx.xxxxx.xxx	predictive	Alto
38	File	xxxxxxx.xxx	predictive	Medio
39	File	xxxxx.xxx	predictive	Medio
40	File	xxxx.xxx	predictive	Medio
41	File	xxxxx_xxxx.xxx	predictive	Alto
42	File	xxxxxxxxxx\xxxxxx\xxxxxxxxxxxxx.xxx	predictive	Alto
43	File	xxx/xxxxxx.xxx	predictive	Alto
44	File	xxxxxxxx/xxxxxxx/xxxxxxx.xxxx.xxx	predictive	Alto
45	File	xxxxx.xxxx	predictive	Medio
46	File	xxxxx.xxx	predictive	Medio
47	File	xxxxx.xxx/xxxxxx.xxx/xxxxxxxxxxxxx.xxx/xxxxxxxx.xxx	predictive	Alto
48	File	xxxxx.xxx?x=xxxx&x=xxxx&x=xx_xxx_xxxxxx	predictive	Alto
49	File	xxxxx.xxx?x=xxxx&x=xxxxxxx&x=xxx	predictive	Alto
50	File	xxxxxxxx/xxxxxxxx_xxxxxxx_xxxxxx/xxxxx.xxx	predictive	Alto
51	File	xxxx_xxxx.xxx	predictive	Alto
52	File	xxxx_xxxxxxx.xxx	predictive	Alto
53	File	xxxxx.xxxx	predictive	Medio
54	File	xxxxx.xxx	predictive	Medio
55	File	xxxx.xxxx	predictive	Medio
56	File	xxxxxx/xxxxxxxxx.xxx	predictive	Alto
57	File	xx_xxxx.x	predictive	Medio
58	File	xxx/xxxx/xxxx_xxxxxxxxx.x	predictive	Alto
59	File	xxxxxxx_xxxx.xxx	predictive	Alto
60	File	xxxxxxxxxxxxxxxxx.xxx	predictive	Alto
61	File	xxxxx_xxxxxx_xxxxxxxx.xxx	predictive	Alto
62	File	xxxxxxx.xxx	predictive	Medio
63	File	xxxxxxxxxxxxx.xxx	predictive	Alto
64	File	xxxxxxxxxxxx.xxx	predictive	Alto
65	File	xxxxxxx/xxxxxxx/xxx/xxxxxxxxxx.xxx?xxxxxxxx=xxxx&xxxxxx=xxxxxxxxxx	predictive	Alto
66	File	xxxxx.xxx	predictive	Medio
67	File	xxxx.xxx	predictive	Medio
68	File	xxxxxxxx.xxx	predictive	Medio
69	File	xxxxxxxxxx.xxx	predictive	Alto
70	File	xxxxxxxx.xx	predictive	Medio
71	File	xxxx_xxxx_xxxxxx.xxx	predictive	Alto
72	File	xxxxxxxxxxxxxx.xxx	predictive	Alto
73	File	xxxx_xxxxxxx_xxxxxxxx.xxx	predictive	Alto
74	File	xxxx_xxxxx.xxxx	predictive	Alto
75	File	xxxxxxxxxx_xxxx.xxx	predictive	Alto
76	File	xxx/xxxx/xxxx	predictive	Alto
77	File	xxxxxx\xxxxxxxx\xx_xxxxx_xxxxxxx.xxx	predictive	Alto
78	File	xxxxxxx.xxx.xx.xxxxxxxxxxx.xxx	predictive	Alto
79	File	xxxxxxxxx/xxxxxxxx.xxx	predictive	Alto
80	File	xxxx_xxxxxx.xx	predictive	Alto
81	File	xxxx-xxxxx.xxx	predictive	Alto
82	File	xxxx-xxxxxxxx.xxx	predictive	Alto
83	File	xxxxxx_xxxxx.xxx	predictive	Alto
84	File	xxxxxx.xxx	predictive	Medio
85	File	xxx.xxx	predictive	Bajo
86	File	xxxxxxx-xxxxx.xxx	predictive	Alto
87	File	xxxx_xxxxx.xxx	predictive	Alto
88	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	Alto
89	File	xxxx.xxx	predictive	Medio
90	File	xxxxxxxx.xxx	predictive	Medio
91	File	xxxxxxxxx.xxx	predictive	Alto
92	File	xx-xxxxx-xxxxxx.xxx	predictive	Alto
93	File	xx-xxxxxxxx/xxxx.xxx	predictive	Alto
94	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	Alto
95	File	xx-xxxxxxxxx.xxx	predictive	Alto
96	File	xxx/xxxxxxxx/xxxxxxxx.xxx	predictive	Alto
97	File	xxxx.xxx	predictive	Medio
98	File	_xxxxxxxx/xxxx?xxxx	predictive	Alto
99	File	~/xxx/xxxx-xxxxxxxxx.xxx	predictive	Alto
100	File	~/xxxxxxxx/xxxxx-xx-xxxxxxxxxx-xxxxxxxxx.xxx	predictive	Alto
101	Library	xxxxxx.xxx	predictive	Medio
102	Library	xxxxxx.xxx	predictive	Medio
103	Library	xxxxxx.xxx	predictive	Medio
104	Library	xxxxxxx/xxx.xxx.xxx.xxx	predictive	Alto
105	Library	xxxx-xxxxxx.xxx	predictive	Alto
106	Argument	xxx_xxx	predictive	Bajo
107	Argument	xxxx	predictive	Bajo
108	Argument	xxxxxxxxx	predictive	Medio
109	Argument	xxxxxxxx	predictive	Medio
110	Argument	xxx_xxx_xx_xxx_xxxxxxxxxx_x	predictive	Alto
111	Argument	xxxxx_xxxx	predictive	Medio
112	Argument	xxxx_xxx_xxxx	predictive	Alto
113	Argument	xxx	predictive	Bajo
114	Argument	xxxxxxxxx	predictive	Medio
115	Argument	xxxxxxxxxx	predictive	Medio
116	Argument	xxx_xx	predictive	Bajo
117	Argument	xxx	predictive	Bajo
118	Argument	xxx	predictive	Bajo
119	Argument	xxxxxxxxxxxxxxx	predictive	Alto
120	Argument	xxxx_xx	predictive	Bajo
121	Argument	xxx	predictive	Bajo
122	Argument	xxxx	predictive	Bajo
123	Argument	xxxxxxxxx_xxxxxx	predictive	Alto
124	Argument	xxxxxxxxx	predictive	Medio
125	Argument	xx_xxxxxxx	predictive	Medio
126	Argument	xxxx	predictive	Bajo
127	Argument	xxxxxxxx	predictive	Medio
128	Argument	xxxxx	predictive	Bajo
129	Argument	xxxxxx_xxxxx	predictive	Medio
130	Argument	xxxxxxxxx	predictive	Medio
131	Argument	xx_xx	predictive	Bajo
132	Argument	xxxxxxx[xxxxxxx]	predictive	Alto
133	Argument	xxxxxxx	predictive	Bajo
134	Argument	xxxxxx	predictive	Bajo
135	Argument	xxxxx	predictive	Bajo
136	Argument	xx	predictive	Bajo
137	Argument	xxx	predictive	Bajo
138	Argument	xxxx	predictive	Bajo
139	Argument	xxxx	predictive	Bajo
140	Argument	xxxx/xxxxxxxx	predictive	Alto
141	Argument	xxx xxxxxxxx/xxxxxxx xxxxxxxx	predictive	Alto
142	Argument	xxxxxxxx	predictive	Medio
143	Argument	xx_xx	predictive	Bajo
144	Argument	xxxxxx/xxxxx/xxxx	predictive	Alto
145	Argument	xxxxxxx	predictive	Bajo
146	Argument	xxxxxxx	predictive	Bajo
147	Argument	xxxx	predictive	Bajo
148	Argument	xxxxxxxx	predictive	Medio
149	Argument	xxxxxx_xxxxxx	predictive	Alto
150	Argument	xxxxxxxx_xx	predictive	Medio
151	Argument	xxxxxxxx_xxx	predictive	Medio
152	Argument	xxxxxx_xxxxx	predictive	Medio
153	Argument	xxx	predictive	Bajo
154	Argument	xxxx_xxxx	predictive	Medio
155	Argument	xxxx	predictive	Bajo
156	Argument	xxxxxx	predictive	Bajo
157	Argument	xxxxxxx	predictive	Bajo
158	Argument	xxx_xxxx	predictive	Medio
159	Argument	xxx	predictive	Bajo
160	Argument	xx_xx	predictive	Bajo
161	Argument	xxxxx	predictive	Bajo
162	Argument	xxxxx_xx	predictive	Medio
163	Argument	xxx	predictive	Bajo
164	Argument	xxxxxx	predictive	Bajo
165	Argument	xxxxxxxx	predictive	Medio
166	Argument	_xxx_xxxxxxxxxxx_	predictive	Alto
167	Input Value	<xxxxxx >xxxxx(xxx)</xxxxxx>	predictive	Alto
168	Input Value	xxxxxxxxx' xxx 'x'='x	predictive	Alto
169	Input Value	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx	predictive	Alto
170	Pattern	\|xx xx xx xx\|	predictive	Alto
171	Network Port	xxxxx	predictive	Bajo
172	Network Port	xxx/xxxxx	predictive	Medio

Referencias (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Do you need the next level of professionalism?

Upgrade your account now!