PoshC2 Análisis

IOB - Indicator of Behavior (728)

Cronología

Idioma

en544
de90
ru38
zh34
pl8

País

us486
ru80
cn58
gb18
es6

Actores

Ocupaciones

Interesar

Cronología

Escribe

Proveedor

Producto

Microsoft Windows12
Apple QuickTime10
PHP8
Oracle WebLogic Server6
FreeBSD4

Vulnerabilidad

#VulnerabilidadBaseTemp0dayHoyExpConEPSSCTICVE
1Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgación de información5.35.2$5k-$25kCalculadorHighWorkaround0.020160.02CVE-2007-1192
2DZCP deV!L`z Clanportal config.php escalada de privilegios7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.009431.43CVE-2010-0966
3TikiWiki tiki-register.php escalada de privilegios7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.0107510.00CVE-2006-6168
4Russcom Network Loginphp register.php cross site scripting4.34.1$0-$5k$0-$5kProof-of-ConceptUnavailable0.006770.02CVE-2006-2160
5FreeBSD FPU x87 Register divulgación de información4.03.8$0-$5k$0-$5kNot DefinedOfficial Fix0.000000.00
6Jelsoft vBulletin register.php denegación de servicio7.37.3$0-$5k$0-$5kNot DefinedNot Defined0.015620.00CVE-2006-4272
7CONTROLzx HMS register_domain.php cross site scripting3.53.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.00
8MGB OpenSource Guestbook email.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.013021.37CVE-2007-0354
9nginx escalada de privilegios6.96.9$0-$5k$0-$5kNot DefinedNot Defined0.002412.70CVE-2020-12440
10Vmware Workspace ONE Access/Identity Manager Template escalada de privilegios9.89.4$5k-$25k$0-$5kHighOfficial Fix0.974490.00CVE-2022-22954
11Ultimate PHP Board register.php vulnerabilidad desconocida5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.003170.00CVE-2006-3206
12SloughFlash SF-Users register.php cross site scripting4.34.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.005870.04CVE-2006-2167
13Linux Kernel FXSAVE x87 Register cifrado débil4.33.9$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.001010.04CVE-2006-1056
14jQuery html cross site scripting5.85.1$0-$5k$0-$5kNot DefinedOfficial Fix0.019000.05CVE-2020-11023
15Cisco AnyConnect Secure Mobility Client Profile Editor XML External Entity4.94.9$0-$5k$0-$5kNot DefinedNot Defined0.000740.00CVE-2018-0100
16Bitrix Site Manager Vote Module Remote Code Execution7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.006680.04CVE-2022-27228
17Citrix Workspace App Automatic Updater Service escalada de privilegios7.57.5$5k-$25k$5k-$25kNot DefinedOfficial Fix0.000880.03CVE-2020-8207
18X7 Group X7 Chat register.php cross site scripting4.33.9$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.006150.00CVE-2006-2282
19Kailash Nadh boastMachine Admin Interface register.php cross site scripting4.33.8$0-$5k$0-$5kProof-of-ConceptUnavailable0.008070.00CVE-2006-3826
20GeoClassifieds Enterprise register.php cross site scripting3.53.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.00

Campañas (1)

These are the campaigns that can be associated with the actor:

  • PoshC2

IOC - Indicator of Compromise (40)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDdirección IPHostnameActorCampañasIdentifiedEscribeConfianza
13.120.209.174ec2-3-120-209-174.eu-central-1.compute.amazonaws.comPoshC22024-01-16verifiedMedio
23.253.77.60ec2-3-253-77-60.eu-west-1.compute.amazonaws.comPoshC22023-10-27verifiedMedio
313.48.77.144ec2-13-48-77-144.eu-north-1.compute.amazonaws.comPoshC22023-11-01verifiedMedio
413.78.10.244PoshC22024-02-13verifiedAlto
518.134.14.164ec2-18-134-14-164.eu-west-2.compute.amazonaws.comPoshC22023-10-11verifiedMedio
635.80.38.180ec2-35-80-38-180.us-west-2.compute.amazonaws.comPoshC22024-01-02verifiedMedio
735.202.253.4545.253.202.35.bc.googleusercontent.comPoshC22022-03-27verifiedMedio
845.79.196.20345-79-196-203.ip.linodeusercontent.comPoshC22023-10-19verifiedAlto
9XX.XXX.XXX.XXXXxxxxx2024-01-27verifiedAlto
10XX.XXX.XXX.XXXXxxxxx2021-06-22verifiedAlto
11XX.XXX.XX.XXXxxxxx2023-11-22verifiedAlto
12XX.XX.XX.XXXxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxxXxxxxx2024-01-04verifiedAlto
13XX.XXX.XXX.XXXXxxxxx2023-11-15verifiedAlto
14XX.XX.XXX.XXxxxxxxxxxxxxxxxxx.xx.xxxxxxxxx.xxxXxxxxx2023-12-10verifiedAlto
15XX.XXX.XXX.XXxxxxxxxxx.xxxxxxxxxxxxx.xxxXxxxxx2023-11-11verifiedAlto
16XX.XXX.X.XXXxxxxxxxx.xxxxxx-xx-xxxxxx.xxXxxxxx2023-10-16verifiedAlto
17XX.XX.XXX.XXxxxxxxxx.xx-xx-xx-xxx.xxXxxxxx2023-10-26verifiedAlto
18XX.XXX.XX.XXXxxxxxxx.xxxxxx.xxxXxxxxx2023-10-09verifiedAlto
19XX.XXX.XXX.XXXXxxxxx2022-10-17verifiedAlto
20XXX.XX.XXX.XXXXxxxxx2021-06-22verifiedAlto
21XXX.XXX.XX.XXXxxxxxx.xxx.xx.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxxx2023-11-22verifiedAlto
22XXX.XXX.XXX.XXXxxxxx2023-11-07verifiedAlto
23XXX.XX.XXX.XXXxxx.xx.xxx.xxx.xxxxxxxxxxxxxxxx.xxxXxxxxx2024-04-24verifiedAlto
24XXX.XX.XXX.XXxxx.xx.xxx.xx.xxxxxxxxxxxxxxxx.xxxXxxxxx2024-01-02verifiedAlto
25XXX.XXX.XXX.XXXxxxx-xxx.xxx.xxx.xxx-xxxxxx.xxxxxx.xxxXxxxxx2024-04-03verifiedAlto
26XXX.XXX.XXX.XXXxxxx-xxx.xxx.xxx.xxx-xxxxxx.xxxxxx.xxxXxxxxx2024-04-22verifiedAlto
27XXX.XXX.XXX.XXXxxxxx2023-12-10verifiedAlto
28XXX.XXX.XX.XXXXxxxxx2023-10-19verifiedAlto
29XXX.XX.XX.XXXXxxxxx2024-01-09verifiedAlto
30XXX.XX.XXX.XXXxxxxx2024-02-20verifiedAlto
31XXX.XXX.XXX.XXXXxxxxx2024-01-25verifiedAlto
32XXX.XXX.XX.XXxxxxxxxxxx.xxxxxxxxxxxxx.xxxXxxxxx2023-12-15verifiedAlto
33XXX.XXX.XXX.XXXxxx.xxxxx.xxxXxxxxx2024-04-24verifiedAlto
34XXX.XX.XXX.XXxxx-xxx-xx-xxx-xx.xxxxxxx-x.xxxxxxxxx.xxxXxxxxx2023-11-09verifiedMedio
35XXX.XXX.XX.XXXxxxxx2024-01-26verifiedAlto
36XXX.XXX.XXX.XXXxxxxx2023-10-17verifiedAlto
37XXX.XXX.XX.XXXxxxxx2021-06-22verifiedAlto
38XXX.XXX.XXX.XXXXxxxxx2023-10-09verifiedAlto
39XXX.XXX.XX.XXXxxx-xxx-xx-xxx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxx2023-10-20verifiedAlto
40XXX.XXX.XXX.XXXxxxxXxxxxx2021-05-31verifiedAlto

TTP - Tactics, Techniques, Procedures (20)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (208)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClaseIndicatorEscribeConfianza
1File/admin/config/uploadicon.phppredictiveAlto
2File/admin/del_feedback.phppredictiveAlto
3File/admin/login.phppredictiveAlto
4File/app/Http/Controllers/Admin/NEditorController.phppredictiveAlto
5File/cms/category/listpredictiveAlto
6File/inquiries/view_inquiry.phppredictiveAlto
7File/LoginpredictiveBajo
8File/mgmt/tm/util/bashpredictiveAlto
9File/mifs/c/i/reg/reg.htmlpredictiveAlto
10File/product/savenewproduct.php?flag=1predictiveAlto
11File/searchpredictiveBajo
12File/secure/ViewCollectorspredictiveAlto
13File/SessionpredictiveMedio
14File/start_apply.htmpredictiveAlto
15File/sysmanage/updatelib.phppredictiveAlto
16File/thruk/#cgi-bin/extinfo.cgi?type=2predictiveAlto
17File/usr/bin/pkexecpredictiveAlto
18File/var/log/nginxpredictiveAlto
19File/xAdmin/html/cm_doclist_view_uc.jsppredictiveAlto
20Fileadclick.phppredictiveMedio
21Fileadd_comment.phppredictiveAlto
22Fileadmin/content.phppredictiveAlto
23Filebooking.phppredictiveMedio
24Filebrowse-category.phppredictiveAlto
25FileBSW_cxttongr.htmpredictiveAlto
26Filecat.asppredictiveBajo
27Filexxxxxxxx.xxxpredictiveMedio
28Filexxx-xxx/xxxxxxx.xxpredictiveAlto
29Filexxxxxxxx.xxxpredictiveMedio
30Filexxxxxxxxxx/xxxxxxx.xxxxpredictiveAlto
31Filexxxxxx.xxxpredictiveMedio
32Filexxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxpredictiveAlto
33Filex_xxxxxxpredictiveMedio
34Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveAlto
35Filexxxxxxx_xxxxx.xxxpredictiveAlto
36Filexxxxxxxx.xxxpredictiveMedio
37Filexxxxxxxxxxx.xxxpredictiveAlto
38Filexxxxxxxx.xxxpredictiveMedio
39Filexxxxx.xxxpredictiveMedio
40Filexxxxxxxxxxxx.xxxpredictiveAlto
41Filexxxx_xxxxxxxx.xxxpredictiveAlto
42Filexxxxxxxxxxxxxxxxx.xxxpredictiveAlto
43Filexxxx.xxxpredictiveMedio
44Filexxxxxxxxx/xxxxx/xxxxxxxxxxxx/xxxxxxxxx.xxxpredictiveAlto
45Filexxxxxxxxxxx.xpredictiveAlto
46Filexxx_xxxxxxxxxxx.xxxpredictiveAlto
47Filexxxx.xxxpredictiveMedio
48Filexxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveAlto
49Filexxxxxxxxx.xxxpredictiveAlto
50Filexxx/xxxxxx.xxxpredictiveAlto
51Filexxx/xxxxxxxxxxx/xxxxxxx.xxxpredictiveAlto
52Filexxxxx.xxxpredictiveMedio
53Filexxxxx.xxxpredictiveMedio
54Filexxxxx.xxx/xxxxxxx/xxxxxpredictiveAlto
55Filexxxxx.xxx?xx=xxxxxxxxxx&xxxxpredictiveAlto
56Filexxxxx.xxpredictiveMedio
57Filexxxxxxx.xpredictiveMedio
58Filexxxxxxx.xxxpredictiveMedio
59Filexxxxxxxxxxx-xxxxxxx-xxxx.xxxx.xxxpredictiveAlto
60Filexxxxxxxx/xxxxxxxx_xxxxxxx_xxxxxx/xxxxx.xxxpredictiveAlto
61Filexxxx.xxxpredictiveMedio
62Filexxxxxxxxx/xxxxxx.xxx.xxxpredictiveAlto
63Filexxxx.xxxpredictiveMedio
64Filexxx.xxxpredictiveBajo
65Filexxxxx-xxxx-xxxx.xxxpredictiveAlto
66Filexxxxx.xxxpredictiveMedio
67Filexxxxxxx.xxxpredictiveMedio
68Filexxx_xxxxx_xxxx.xpredictiveAlto
69Filexxx_xxxx_xxx_xxxxxxxxxx.xpredictiveAlto
70Filexxx_xxxx.xxxpredictiveMedio
71Filexxxx_xxxxxxx.xxxpredictiveAlto
72Filexxxxxxx.xxxpredictiveMedio
73Filexxxxx_xxx.xxxpredictiveAlto
74Filexxxxx.xxxpredictiveMedio
75Filexxxxxxx_xxxxxxx_xxxx.xxxpredictiveAlto
76Filexxx_xxxxxx.xxxxpredictiveAlto
77Filexxxxx.xxxpredictiveMedio
78Filexxxxxxxx.xxxpredictiveMedio
79Filexxxxxxxxxx.xxxpredictiveAlto
80Filexxxxxxxx.xxxxpredictiveAlto
81Filexxxxxxxx.xxxpredictiveMedio
82Filexxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxxpredictiveAlto
83Filexxxxxxxx_xxxxxx.xxxpredictiveAlto
84Filexxxxxxx.xxxpredictiveMedio
85Filexxxxxxx/xxxxxxxxxx.xxxpredictiveAlto
86Filexxxxxxx/xxxxxxxxxxxxx.xxxxpredictiveAlto
87Filexxxxxxxxxxxxxxx.xxxpredictiveAlto
88Filexxxxxx.xxpredictiveMedio
89Filexxxxxx.xxpredictiveMedio
90Filexxxxxx_xxxxxxx.xxxpredictiveAlto
91Filexxxxxxxx/xxxx/xxxx.xxx?xxxxxx=xxxxxxxxxxxxxxxxpredictiveAlto
92Filexxxx.xxxpredictiveMedio
93Filexxxx.xxpredictiveBajo
94Filexxxxxxxx_xxxx.xxxpredictiveAlto
95Filexxxx_xxxxxxx_xxxxxxxx.xxxpredictiveAlto
96Filexxxxxxx/xxxxxxxx.xxxpredictiveAlto
97Filexxxxx.xxxpredictiveMedio
98Filexxxxx.xxxpredictiveMedio
99Filexxxxxx.xxxpredictiveMedio
100Filexxxxxxxx.xxxxx.xxxpredictiveAlto
101Filexxxxxx-xxxxxx.xxxpredictiveAlto
102Filexxxx-xxxxxxxx.xxxpredictiveAlto
103Filexxxxx_xxxxxx.xxxpredictiveAlto
104Filexxxxx.xpredictiveBajo
105Filexxx-xxx/predictiveMedio
106Filexxxxxxx/xxx/xxxxxxxpredictiveAlto
107Filexxxxxx.xxxpredictiveMedio
108Filexx-xxxxx/xxxxx-xxx.xxx?xxxxxxx-xxxxxxxxpredictiveAlto
109Filexx-xxxx.xxxpredictiveMedio
110Filexx-xxxxxxxxx.xxxpredictiveAlto
111Filexxxx.xxpredictiveBajo
112File~/xxx/xxxx-xxxxxxxxx.xxxpredictiveAlto
113File~/xxx-xxx-xxxx.xxxpredictiveAlto
114Libraryxxxxxxxx.xxxpredictiveMedio
115Libraryxxxxxx.xxxxx.xxxxxxxpredictiveAlto
116Argument*xxxxpredictiveBajo
117Argumentxx_xxxx_xxxxpredictiveMedio
118ArgumentxxxxxxxpredictiveBajo
119ArgumentxxpredictiveBajo
120ArgumentxxxxxxxxxpredictiveMedio
121ArgumentxxxxxxxxxxxxpredictiveMedio
122ArgumentxxxxxxpredictiveBajo
123ArgumentxxxxxxpredictiveBajo
124ArgumentxxxxxxxxpredictiveMedio
125ArgumentxxxxxxxxpredictiveMedio
126ArgumentxxxxxxxxpredictiveMedio
127ArgumentxxxpredictiveBajo
128Argumentxxx_xxpredictiveBajo
129ArgumentxxxpredictiveBajo
130Argumentxxx/xxxxx_xxxx/xxxxxx_xxxx/xxxxxxx_x/xxxxxxxpredictiveAlto
131Argumentxxxxxx_xxpredictiveMedio
132ArgumentxxxxxxpredictiveBajo
133Argumentxxxxxxx_xxxxxpredictiveAlto
134Argumentxxxxxxx/xxxx/xxxxx_xxxxx_xxpredictiveAlto
135Argumentx[xxxxx]predictiveMedio
136Argumentxxxxxxxx_xxxxxx/xxxxxxxx_xxxx/xxxxxxxx_xxxxxxxx/xxxxxxxx_xxxxpredictiveAlto
137ArgumentxxxxpredictiveBajo
138ArgumentxxxpredictiveBajo
139ArgumentxxxxxxxpredictiveBajo
140ArgumentxxxxxxxxxxpredictiveMedio
141ArgumentxxxxxxxpredictiveBajo
142Argumentxx_xxxx/xxxxx/xxxpredictiveAlto
143Argumentxxxxxxxxx->xxxxxxxxxpredictiveAlto
144ArgumentxxxxxxxxpredictiveMedio
145Argumentxxxxxxx=xxxxxxxxpredictiveAlto
146Argumentxx_xxxxxpredictiveMedio
147ArgumentxxxxpredictiveBajo
148ArgumentxxxxxxxxpredictiveMedio
149ArgumentxxxxxxxxpredictiveMedio
150Argumentxxxx_xxxxxxpredictiveMedio
151Argumentxxxxxx_xxxxx_xxxpredictiveAlto
152ArgumentxxxxxxxxxxpredictiveMedio
153ArgumentxxxxpredictiveBajo
154Argumentxxxx/xxxxxxx/xxxxxxxpredictiveAlto
155Argumentxxxx_xxpredictiveBajo
156Argumentxxxx_xxxxxpredictiveMedio
157ArgumentxxxxpredictiveBajo
158ArgumentxxpredictiveBajo
159Argumentxx_xxxxxpredictiveMedio
160ArgumentxxxxxxpredictiveBajo
161ArgumentxxxxxxxpredictiveBajo
162ArgumentxxxxxpredictiveBajo
163ArgumentxxxxxxxxpredictiveMedio
164ArgumentxxxxxpredictiveBajo
165ArgumentxxxxxxxxxxxpredictiveMedio
166Argumentxxxx-xxx-xxxxxxxxxpredictiveAlto
167Argumentxxxxxxx/xxxxxxxxxpredictiveAlto
168Argumentxxxxx_xxpredictiveMedio
169ArgumentxxxxpredictiveBajo
170Argumentxxxx_xxxxxpredictiveMedio
171Argumentxxxxxxx_xxxpredictiveMedio
172ArgumentxxxxxxxxpredictiveMedio
173Argumentxx_xxxxpredictiveBajo
174ArgumentxxxxxxxxxxxxxxxxxxxpredictiveAlto
175ArgumentxxxxxxxxxpredictiveMedio
176Argumentxxxxxxxx_xxpredictiveMedio
177Argumentxxxxxxx_xxxxpredictiveMedio
178Argumentxxxxxxx xxxxxpredictiveAlto
179ArgumentxxxxxxxxxxxxxxxxpredictiveAlto
180ArgumentxxxxxxpredictiveBajo
181ArgumentxxxxxxpredictiveBajo
182ArgumentxxxxxxpredictiveBajo
183Argumentxxxxxx_xxxpredictiveMedio
184ArgumentxxxpredictiveBajo
185ArgumentxxxxxxpredictiveBajo
186ArgumentxxxpredictiveBajo
187ArgumentxxxxxxxxpredictiveMedio
188Argumentxxxxx/xxxpredictiveMedio
189ArgumentxxxxxxpredictiveBajo
190ArgumentxxxxxxxpredictiveBajo
191Argumentxx_xxpredictiveBajo
192ArgumentxxxxxpredictiveBajo
193Argumentxxxxxxxxxxx/xxxxxxxxxxxpredictiveAlto
194ArgumentxxxxxpredictiveBajo
195ArgumentxxxxxxpredictiveBajo
196ArgumentxxxpredictiveBajo
197ArgumentxxxpredictiveBajo
198ArgumentxxxxxxxxpredictiveMedio
199ArgumentxxpredictiveBajo
200ArgumentxxxpredictiveBajo
201ArgumentxxxxxxpredictiveBajo
202Argument_xxxxxx[xxxxxxxx_xxxx]predictiveAlto
203Input Value/xxxxxx/..%xxpredictiveAlto
204Input Valuexxxxx"][xxxxxx]xxxxx('xxx')[/xxxxxx]predictiveAlto
205Pattern__xxxxxxxxx=predictiveMedio
206Pattern|xx|predictiveBajo
207Network PortxxxxpredictiveBajo
208Network Portxxx xxxxxx xxxxpredictiveAlto

Referencias (32)

The following list contains external sources which discuss the actor and the associated activities:

Might our Artificial Intelligence support you?

Check our Alexa App!