QNAPCrypt Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (23)

Idioma

en	22
sv	2

País

us	18
gb	2
ru	2
it	2

Actores

QNAPCrypt	3
Nobelium	1
Mirai	1
BianLian	1
Raccoon	1

Interesar

Escribe

Not Defined	12
Database Software	2
Firewall Software	2
Customer Relationship Management System	2
Web Server	2

Proveedor

Not Defined	12
Microsoft	2
Fortinet	2
Hikvision	2
Odoo	2

Producto

Mlffat	2
Microsoft SQL Server	2
1C:Enterprise	2
Fortinet FortiOS	2
TightVNC	2

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	nginx escalada de privilegios	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	2.40	CVE-2020-12440
2	SourceCodester Block Inserter for Dynamic Content view_post.php sql injection	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.08	CVE-2024-2073
3	Fortinet FortiOS SSL-VPN Daemon denegación de servicio	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00043	0.04	CVE-2023-29180
4	QNAP Multimedia Console/QTS/Media Streaming Add-on escalada de privilegios	9.0	8.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00067	0.04	CVE-2023-23369
5	OpenSSH Authentication Username divulgación de información	5.3	4.8	$5k-$25k	$0-$5k	High	Official Fix	0.10737	0.34	CVE-2016-6210
6	Mikrotik RouterOS SNMP divulgación de información	8.0	7.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00324	0.04	CVE-2022-45315
7	Odoo Community/Enterprise Database Manager escalada de privilegios	8.5	8.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00680	0.04	CVE-2018-14885
8	1C:Enterprise URL Parameter divulgación de información	5.9	5.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00168	0.04	CVE-2021-3131
9	Hikvision Wwireless Bridge Web Server escalada de privilegios	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00142	0.04	CVE-2022-28173
10	Synology DiskStation Manager Web Interface info.cgi Reflected cross site scripting	5.5	5.1	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00000	0.03
11	Online Student Admission sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00172	0.04	CVE-2022-28467
12	Mini-Inventory-and-Sales-Management-System Inventory cross site request forgery	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00044	0.00	CVE-2021-44321
13	TightVNC InitialiseRFBConnection desbordamiento de búfer	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01927	0.00	CVE-2019-15679
14	Host Web Server phpinfo.php phpinfo divulgación de información	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Workaround	0.00000	0.03
15	Microsoft Outlook Web App redir.aspx autenticación débil	5.3	5.0	$5k-$25k	$0-$5k	Proof-of-Concept	Unavailable	0.00000	0.04
16	Teradata Virtual Machine Community Edition Temp File t2a.pl escalada de privilegios	9.8	9.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01796	0.00	CVE-2016-7489
17	Microsoft SQL Server Virtual Function escalada de privilegios	6.3	6.0	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.04352	0.04	CVE-2015-1763
18	Mlffat index.php sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00099	0.00	CVE-2009-2585
19	Microsoft IIS FTP Server desbordamiento de búfer	7.5	7.2	$25k-$100k	$0-$5k	High	Official Fix	0.96992	0.04	CVE-2010-3972
20	WordPress wp_crop_image directory traversal	5.9	5.8	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.95564	0.05	CVE-2019-8943

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Identified	Escribe	Confianza
1	167.99.218.114		QNAPCrypt	2022-09-08	verified	Alto
2	XXX.XXX.XX.XX		Xxxxxxxxx	2021-08-11	verified	Alto
3	XXX.XXX.XXX.XXX	xxxxxxxx.xxxx.xxxxxx.xxx	Xxxxxxxxx	2022-06-17	verified	Alto
4	XXX.XX.XXX.XX	xxxx.xx-xxx-xx-xxx.xxx	Xxxxxxxxx	2024-02-12	verified	Alto

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Clase	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Alto
2	T1059.007	CAPEC-18	CWE-80	Cross Site Scripting	predictive	Alto
3	TXXXX	CAPEC-19	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
4	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
5	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Alto
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
7	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (15)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	/opt/teradata/gsctools/bin/t2a.pl	predictive	Alto
2	File	/webman/info.cgi	predictive	Alto
3	File	account/gallery.php	predictive	Alto
4	File	xxxxx.xxx	predictive	Medio
5	File	xxx/xxxxx.xxxx	predictive	Alto
6	File	xxxxxxx.xxx	predictive	Medio
7	File	xxxx_xxxxxxx_xxxxxxxx.xxx	predictive	Alto
8	File	xxxx_xxxx.xxx	predictive	Alto
9	Argument	xxx_xx	predictive	Bajo
10	Argument	xxxx/xxxxxx/xxx	predictive	Alto
11	Argument	xx	predictive	Bajo
12	Argument	xxxxxxxx	predictive	Medio
13	Argument	xxxxxxxxxxxxxxxx	predictive	Alto
14	Argument	xxx	predictive	Bajo
15	Input Value	.xxx?/../../xxxx.xxx	predictive	Alto

Referencias (2)

The following list contains external sources which discuss the actor and the associated activities:

Samples (3)

The following list contains associated samples:

◂ AnteriorVisión De ConjuntoPróximo ▸

Do you know our Splunk app?

Download it now for free!