OldGremlin Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (220)

Idioma

en	188
zh	18
ru	4
es	4
fr	4

País

us	94
cn	68
ru	8
at	6
ce	4

Actores

NetSupportManager RAT	13
Cobalt Strike	13
Raccoon	11
SideWinder	8
RecordBreaker	8

Interesar

Escribe

Not Defined	72
Content Management System	14
Firewall Software	12
WordPress Plugin	10
Hosting Control Software	8

Proveedor

Not Defined	70
Microsoft	14
Linksys	6
Siemens	6
Kayako	4

Producto

cPanel	8
Microsoft Windows	6
Microsoft Exchange Server	4
WordPress	4
OpenSSH	4

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	CTI	EPSS	CVE
1	Atmail Remote Code Execution	9.8	9.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00251	CVE-2013-5033
2	Arduino LED escalada de privilegios	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00109	CVE-2019-13991
3	Palo Alto PAN-OS GlobalProtect Clientless VPN desbordamiento de búfer	8.8	8.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00112	CVE-2021-3056
4	Microsoft IIS IP/Domain Restriction escalada de privilegios	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.07	0.00817	CVE-2014-4078
5	WordPress sql injection	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.05	0.00467	CVE-2022-21664
6	VeronaLabs wp-statistics Plugin API Endpoint Blind sql injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00250	CVE-2019-13275
7	Mikrotik RouterOS SNMP divulgación de información	8.0	7.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.08	0.00307	CVE-2022-45315
8	Linksys WRT54GL Web Management Interface SysInfo1.htm divulgación de información	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.10	0.00046	CVE-2024-1406
9	RoundCube Webmail Email Message rcube_string_replacer.php linkref_addindex cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00612	CVE-2020-35730
10	Teclib GLPI unlock_tasks.php sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.12149	CVE-2019-10232
11	Sophos Firewall User Portal/Webadmin autenticación débil	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.97434	CVE-2022-1040
12	nginx escalada de privilegios	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.26	0.00241	CVE-2020-12440
13	CutePHP CuteNews escalada de privilegios	7.5	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02	0.02086	CVE-2019-11447
14	WordPress Object escalada de privilegios	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.00432	CVE-2022-21663
15	Microsoft Windows Active Directory Domain Services Privilege Escalation	8.8	8.1	$100k y más	$0-$5k	Proof-of-Concept	Official Fix	0.03	0.07920	CVE-2022-26923
16	QNAP QTS Media Library escalada de privilegios	8.5	8.2	$0-$5k	$0-$5k	High	Official Fix	0.03	0.01394	CVE-2017-13067
17	Peplink Balance Cookie admin.cgi sql injection	8.5	7.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.01457	CVE-2017-8835
18	Cisco Internet of Things Field Network Director Web-based User Interface XML External Entity	5.4	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00150	CVE-2019-1698
19	Mycroft AI WebSocket Server escalada de privilegios	7.7	7.7	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00	0.00269	CVE-2018-1000621
20	RealNetworks RealServer Port 7070 Service denegación de servicio	7.5	7.3	$0-$5k	$0-$5k	Not Defined	Workaround	0.03	0.02116	CVE-2000-0272

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Identified	Escribe	Confianza
1	5.181.156.84	no-rdns.mivocloud.com	OldGremlin	2022-06-02	verified	Alto
2	45.61.138.170		OldGremlin	2022-06-02	verified	Alto
3	XX.XXX.XXX.XXX		Xxxxxxxxxx	2022-04-18	verified	Alto
4	XX.XXX.XXX.XXX	xx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	2022-06-02	verified	Alto
5	XXX.XXX.XX.XX	xxx.xxx.xx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	2022-06-02	verified	Alto
6	XXX.XX.XX.X		Xxxxxxxxxx	2022-04-18	verified	Alto
7	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	2022-04-18	verified	Alto

TTP - Tactics, Techniques, Procedures (18)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1006	CWE-21, CWE-22, CWE-23	Path Traversal	predictive	Alto
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	T1059	CWE-94	Argument Injection	predictive	Alto
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Alto
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
8	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
9	TXXXX	CWE-XXX	Xxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx Xxxxx	predictive	Alto
10	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Alto
12	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
13	TXXXX	CWE-XXX	Xxxxxxx Xxxxxxxxxx Xx Xxx-xxxxxxxx	predictive	Alto
14	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	Alto
15	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	Alto
16	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
17	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
18	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (100)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	/api/RecordingList/DownloadRecord?file=	predictive	Alto
2	File	/apply.cgi	predictive	Medio
3	File	/php/ping.php	predictive	Alto
4	File	/rapi/read_url	predictive	Alto
5	File	/scripts/unlock_tasks.php	predictive	Alto
6	File	/SysInfo1.htm	predictive	Alto
7	File	/sysinfo_json.cgi	predictive	Alto
8	File	/system/user/modules/mod_users/controller.php	predictive	Alto
9	File	/uncpath/	predictive	Medio
10	File	/wp-admin/admin-post.php?es_skip=1&option_name	predictive	Alto
11	File	AppCompatCache.exe	predictive	Alto
12	File	xxxxxxx/xxxx.xxx	predictive	Alto
13	File	xxxxxxxx.xxx	predictive	Medio
14	File	xxx-xxx/xxxxxxx.xx	predictive	Alto
15	File	xxx-xxx/xxxxx/xxxxx.xxx	predictive	Alto
16	File	xxxxxx/xxx.x	predictive	Medio
17	File	xxxxxxxx_xxxxxxxxxxxxxxxxx.xxx	predictive	Alto
18	File	xxxxxxxxx.xxx.xxx	predictive	Alto
19	File	xxxxx/xxxxx.xxx	predictive	Alto
20	File	xxxx_xxxxx.xxx	predictive	Alto
21	File	xxxxx.xxx	predictive	Medio
22	File	xxxxxx.xxx	predictive	Medio
23	File	xxxxxxx/xxxx-xxxxx-xxxxxx.xxx	predictive	Alto
24	File	xxxxxxx/xxxx-xxxxx-xxxxxx.xxx?xxxxxx=x	predictive	Alto
25	File	xx/xx-xx.x	predictive	Medio
26	File	xxx/xxxx_xxxx.x	predictive	Alto
27	File	xxxxxx/xxxxxxxxxxx	predictive	Alto
28	File	xxxx_xxxxxx.x	predictive	Alto
29	File	xxxx/xxxxxxx.x	predictive	Alto
30	File	xxxxxxxx/xxxxx-xxxxxx-xxxx-xxxxxxx.xxx	predictive	Alto
31	File	xxxxxxxx/xxxxxxxx/xxxxx-xxxxxxxx-xxxxx.xxx	predictive	Alto
32	File	xxxxx.xxx?xxx=xxxx&xxx=xxxxxxxx	predictive	Alto
33	File	xxxxxxxxxx.xxx	predictive	Alto
34	File	xxxxxxx_xxxxxxx/xxxx.xxx	predictive	Alto
35	File	xxxxx.xxx	predictive	Medio
36	File	xxxx/xxxxxxxxx/xxxxxx/xxxxxxxxxxxxxxxxxxxxx.xxx	predictive	Alto
37	File	xxx/xxx.xxx	predictive	Medio
38	File	xxxxxx.x	predictive	Medio
39	File	xxxx.xxx	predictive	Medio
40	File	xxxxx.xxx	predictive	Medio
41	File	xxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]	predictive	Alto
42	File	xxxxx_xxxxxx_xxxxxxxx.xxx	predictive	Alto
43	File	xxxxxxxx.xxx	predictive	Medio
44	File	xxxxxxx/xxxxxxxxxx	predictive	Alto
45	File	xxxxxxx-xxxxxxxxxx/xxx/xxxxx.xxx	predictive	Alto
46	File	xxxx.xxx	predictive	Medio
47	File	xxxxx/xxxxx.xxx	predictive	Alto
48	File	xxxxxxxx.xxx	predictive	Medio
49	File	xxxxxxxxx.xxx	predictive	Alto
50	File	xxxx.xxx	predictive	Medio
51	File	xxxxxxxxxx	predictive	Medio
52	File	xxxxxxx/xxxxx.xxx	predictive	Alto
53	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	Alto
54	Argument	xxxxxx	predictive	Bajo
55	Argument	xxxxxxx_xxxx	predictive	Medio
56	Argument	xxxxxx_xxxx	predictive	Medio
57	Argument	xxxxx	predictive	Bajo
58	Argument	xxx	predictive	Bajo
59	Argument	xxxxxxxx	predictive	Medio
60	Argument	xxxxxx	predictive	Bajo
61	Argument	xxxxxxxxxxxxxxxxx	predictive	Alto
62	Argument	xxxxx	predictive	Bajo
63	Argument	xxxxxxxxxxx/xxxxxxxx/xxx/xxxxx	predictive	Alto
64	Argument	xxxxxx_xx	predictive	Medio
65	Argument	xxxxx	predictive	Bajo
66	Argument	xxxxxx	predictive	Bajo
67	Argument	xxxxxxxxxxxx	predictive	Medio
68	Argument	xxxxxx	predictive	Bajo
69	Argument	xx_xxxx [xx][x]/xx_xxxx [xx][x]/xx_xxxx [xx][x]/xx_xxxx [xx][x]/xxxxx	predictive	Alto
70	Argument	xxxx	predictive	Bajo
71	Argument	xxxx	predictive	Bajo
72	Argument	xx	predictive	Bajo
73	Argument	xxxxxxxxx	predictive	Medio
74	Argument	xxxxxxxx[xx]	predictive	Medio
75	Argument	xxxxxxx	predictive	Bajo
76	Argument	xxx_xxxx	predictive	Medio
77	Argument	xxxxx_xx	predictive	Medio
78	Argument	xxxxxxxx	predictive	Medio
79	Argument	x_x_x	predictive	Bajo
80	Argument	xxxxxxx/xxxxx	predictive	Alto
81	Argument	xxxxxx_xxx	predictive	Medio
82	Argument	xxxxxx	predictive	Bajo
83	Argument	xxxx_xx	predictive	Bajo
84	Argument	xxxxxxxx_xxxxxxxx	predictive	Alto
85	Argument	xxxxxxxxxxxxxxxxxxxxx	predictive	Alto
86	Argument	xxxx_xx	predictive	Bajo
87	Argument	xxx	predictive	Bajo
88	Argument	xxxx	predictive	Bajo
89	Argument	xxxxxxxx	predictive	Medio
90	Argument	xxxx/xx/xxxx/xxx	predictive	Alto
91	Argument	xxxxxxxx	predictive	Medio
92	Input Value	.%xx.../.%xx.../	predictive	Alto
93	Input Value	../../../../../xxx/xxx/xxxxx/xxxx/xxxxxxxx/xxxxx/xxx.xxx	predictive	Alto
94	Input Value	xxxxxxx -xxx	predictive	Medio
95	Input Value	xxxxxxxxxx	predictive	Medio
96	Network Port	xxxx	predictive	Bajo
97	Network Port	xxxx	predictive	Bajo
98	Network Port	xxxx xxxx	predictive	Medio
99	Network Port	xxx/xxx	predictive	Bajo
100	Network Port	xxx/xxxx	predictive	Medio

Referencias (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!