MsAttacker Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (12)

Idioma

en	12

País

cn	8
us	4

Actores

MsAttacker	2
MyKings	1
APT41	1

Interesar

Escribe

Operating System	4
Application Server Software	2
Hospitality Software	2
Not Defined	2
Forum Software	2

Proveedor

Not Defined	6
Oracle	2
PHP Scripts Mall	2
Webwizguide	2

Producto

FreeBSD	4
Oracle WebLogic Server	2
PHP Scripts Mall hotel-booking-script	2
FineCMS	2
Webwizguide Web Wiz Forums	2

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	PHP Scripts Mall hotel-booking-script cross site scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00058	0.00	CVE-2018-15190
2	guzzlehttp psr7 Header Parser escalada de privilegios	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00095	0.01	CVE-2022-24775
3	DZCP deV!L`z Clanportal config.php escalada de privilegios	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.95	CVE-2010-0966
4	Webwizguide Web Wiz Forums Filters functions_filters.asp formatSQLInput sql injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00369	0.04	CVE-2007-1548
5	Orange Livebox Service Port 8080 get_getnetworkconf.cgi escalada de privilegios	8.5	8.3	$0-$5k	$0-$5k	Not Defined	Workaround	0.02105	0.02	CVE-2018-20377
6	FreeBSD sendmsg(2) escalada de privilegios	7.8	7.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00070	0.02	CVE-2016-1887
7	FreeBSD portsnap escalada de privilegios	7.3	7.0	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00000	0.00
8	FreeBSD setgroups Syscall escalada de privilegios	7.8	7.3	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00042	0.02	CVE-2016-1881
9	FineCMS Redirector Weixin.php	6.2	6.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00121	0.07	CVE-2017-11586
10	Oracle WebLogic Server vulnerabilidad desconocida	5.3	4.6	$25k-$100k	$0-$5k	Unproven	Official Fix	0.01156	0.02	CVE-2014-4241
11	CodeIgniter Sendmail Email.php escalada de privilegios	8.5	8.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04920	0.04	CVE-2016-10131

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Actor	Identified	Escribe	Confianza
1	23.27.127.200	MsAttacker	2020-12-24	verified	Alto
2	XXX.XX.XXX.X	Xxxxxxxxxx	2020-12-24	verified	Alto
3	XXX.XX.XXX.XX	Xxxxxxxxxx	2020-12-24	verified	Alto
4	XXX.XX.XXX.XXX	Xxxxxxxxxx	2020-12-24	verified	Alto

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
2	T1059	CWE-94	Argument Injection	predictive	Alto
3	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
4	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
5	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
6	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
7	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (11)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	/get_getnetworkconf.cgi	predictive	Alto
2	File	controllers/Weixin.php	predictive	Alto
3	File	xxxxxxxxx/xxxxxxxxx_xxxxxxx.xxx	predictive	Alto
4	File	xxx/xxxxxx.xxx	predictive	Alto
5	Library	xxxxxx/xxxxxxxxx/xxxxx.xxx	predictive	Alto
6	Argument	xxxxxxxx	predictive	Medio
7	Argument	xxxxx->xxxx	predictive	Medio
8	Argument	xxxxx xxxx/xxxx xxxx/xxxxxxx xxxxx	predictive	Alto
9	Argument	xxxx	predictive	Bajo
10	Argument	xxx	predictive	Bajo
11	Network Port	xxx/xxxx	predictive	Medio

Referencias (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!