OrcaRAT Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (7)

Idioma

es	8

País

za	4
es	4

Actores

OrcaRAT	1

Interesar

Escribe

Web Server	2
WordPress Plugin	2
Router Operating System	2
Not Defined	2

Proveedor

Apache	2
ThemePunch	2
MikroTik	2
Juniper	2

Producto

Apache HTTP Server	2
ThemePunch Slider Revolution Plugin	2
MikroTik RouterOS	2
Juniper Web Device Manager	2

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	ProFTPD mod_copy escalada de privilegios	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.94462	0.04	CVE-2019-12815
2	nginx ngx_http_mp4_module divulgación de información	5.9	5.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00198	0.05	CVE-2018-16845
3	Apache HTTP Server mod_reqtimeout denegación de servicio	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01696	0.04	CVE-2007-6750
4	Juniper Web Device Manager Authentication autenticación débil	9.8	9.0	$5k-$25k	$0-$5k	Proof-of-Concept	Workaround	0.00000	0.04
5	ThemePunch Slider Revolution Plugin escalada de privilegios	7.3	7.3	$0-$5k	$0-$5k	High	Not Defined	0.95492	0.00	CVE-2014-9735
6	MikroTik RouterOS Winbox autenticación débil	8.2	7.4	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.97496	0.02	CVE-2018-14847
7	Linux Directory Penguin Traceroute Script traceroute.pl escalada de privilegios	9.8	9.8	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.01891	0.00	CVE-2002-0488

IOC - Indicator of Compromise (15)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Identified	Escribe	Confianza
1	11.38.64.251		OrcaRAT	2021-01-01	verified	Alto
2	23.19.39.19		OrcaRAT	2021-01-01	verified	Alto
3	58.71.158.21		OrcaRAT	2021-01-01	verified	Alto
4	XX.XX.XXX.XXX	xxxxxxxxxx-xxx.xxx.xxx.xx	Xxxxxxx	2021-01-01	verified	Alto
5	XX.XXX.XX.XXX	xxxxxx-xx-xxx-xx-xxx.xxxxxx.xxxx.xxxxxxx.xxx	Xxxxxxx	2021-01-01	verified	Alto
6	XX.XXX.XXX.XX		Xxxxxxx	2021-01-01	verified	Alto
7	XX.XXX.XX.XX		Xxxxxxx	2021-01-01	verified	Alto
8	XXX.XXX.XX.XXX		Xxxxxxx	2021-01-01	verified	Alto
9	XXX.XXX.XXX.XX		Xxxxxxx	2021-01-01	verified	Alto
10	XXX.X.XXX.XX	xxxxxxx.xxxxxxxxx.xxx	Xxxxxxx	2021-01-01	verified	Alto
11	XXX.XX.XX.XXX		Xxxxxxx	2021-01-01	verified	Alto
12	XXX.XX.XX.XXX	xxxxx.xx-xxx-xx-xx.xx	Xxxxxxx	2021-01-01	verified	Alto
13	XXX.XX.XX.XXX	xxxxx.xx-xxx-xx-xx.xx	Xxxxxxx	2021-01-01	verified	Alto
14	XXX.XXX.XXX.XXX	xxxx-xxx.xxxxxxxxx.xxx	Xxxxxxx	2021-01-01	verified	Alto
15	XXX.XXX.XX.XXX		Xxxxxxx	2021-01-01	verified	Alto

TTP - Tactics, Techniques, Procedures (3)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1068	CWE-264, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	Alto
2	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
3	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (2)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	traceroute.pl	predictive	Alto
2	Argument	xxxx	predictive	Bajo

Referencias (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Do you know our Splunk app?

Download it now for free!