Rancor Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (906)

Idioma

pl	164
sv	162
it	154
fr	154
en	142

País

us	874
cn	14
vn	8
me	4

Actores

Rancor	6
LokiBot	1
Dridex	1
FTP Info Stealer	1
NjRAT	1

Interesar

Escribe

Not Defined	356
Content Management System	62
Web Browser	58
Operating System	48
Programming Language Software	24

Proveedor

Not Defined	258
IBM	48
Microsoft	36
Oracle	32
Cisco	30

Producto

Mozilla Firefox	18
Microsoft Internet Explorer	16
Apple Mac OS X	14
Google Chrome	14
ownCloud	12

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	TikiWiki tiki-register.php escalada de privilegios	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01009	1.71	CVE-2006-6168
2	Boa Webserver GET wapopen directory traversal	6.4	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.73540	0.09	CVE-2017-9833
3	Anti-Web write.cgi directory traversal	7.2	7.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00702	0.02	CVE-2017-9097
4	mpg123 MP3 File id3.c next_text desbordamiento de búfer	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00177	0.00	CVE-2017-9545
5	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	3.03
6	Clash Configuration File cfw-setting.yaml escalada de privilegios	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00389	0.03	CVE-2023-24205
7	Lenovo X Server FFDC Service Log escalada de privilegios	5.4	5.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00060	0.00	CVE-2017-3744
8	DZCP deV!L`z Clanportal config.php escalada de privilegios	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.96	CVE-2010-0966
9	Synacor Zimbra Collaboration XML External Entity	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00441	0.02	CVE-2016-9924
10	e-Quick Cart shopprojectlogin.asp sql injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.04
11	Tiki Admin Password tiki-login.php autenticación débil	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	3.25	CVE-2020-15906
12	Pligg cloud.php sql injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.39
13	vBulletin redirector.php Redirect	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00122	0.26	CVE-2018-6200
14	phpPgAds adclick.php vulnerabilidad desconocida	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00317	0.92	CVE-2005-3791
15	Google Android SDK Platform Tools Signedness adb_client.c adb_connect desbordamiento de búfer	8.8	8.3	$100k y más	$0-$5k	Proof-of-Concept	Official Fix	0.00000	0.00
16	Netgear D6300B Credential Storage nvram cifrado débil	5.4	4.6	$5k-$25k	$0-$5k	Proof-of-Concept	Workaround	0.00000	0.00
17	OpenStack Keystone escalada de privilegios	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01166	0.00	CVE-2013-2014
18	Sensysnetworks TrafficDOT escalada de privilegios	8.3	7.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00828	0.00	CVE-2014-2378
19	Cws sahab-alkher.com X.509 Certificate cifrado débil	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00049	0.00	CVE-2014-7052
20	Appbasedtechnologies Belaire Family Orthodontics X.509 Certificate cifrado débil	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00049	0.00	CVE-2014-7405

Campañas (1)

These are the campaigns that can be associated with the actor:

PLAINTEE/DDKONG

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Campañas	Identified	Escribe	Confianza
1	45.76.176.236	45.76.176.236.vultr.com	Rancor	PLAINTEE/DDKONG	2020-12-20	verified	Medio
2	45.121.146.26	businesso.top	Rancor	PLAINTEE/DDKONG	2020-12-20	verified	Alto
3	XX.XX.XXX.XX	xx.xxx.xx.xx.xx-xxxx.xxxx	Xxxxxx	Xxxxxxxx/xxxxxx	2020-12-20	verified	Alto
4	XXX.XX.XXX.XX	xxxxxx.xxxxxxxx.xxx	Xxxxxx	Xxxxxxxx/xxxxxx	2020-12-20	verified	Alto
5	XXX.XX.XXX.XX	xxxxxxxxxxxxxxx.xxxx	Xxxxxx	Xxxxxxxx/xxxxxx	2020-12-20	verified	Alto
6	XXX.XX.XXX.XXX		Xxxxxx	Xxxxxxxx/xxxxxx	2020-12-20	verified	Alto
7	XXX.XXX.XX.XXX		Xxxxxx	Xxxxxxxx/xxxxxx	2020-12-20	verified	Alto
8	XXX.XXX.X.XXX	xxx.xxx.x.xxx.xxxxx.xxx	Xxxxxx	Xxxxxxxx/xxxxxx	2020-12-20	verified	Medio

TTP - Tactics, Techniques, Procedures (17)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1006	CWE-22	Path Traversal	predictive	Alto
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	T1059	CWE-94	Argument Injection	predictive	Alto
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Alto
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
6	TXXXX.XXX	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	Alto
7	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
8	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
9	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
10	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Alto
11	TXXXX	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
12	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
13	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
14	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	Alto
15	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
16	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto
17	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (230)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	/bin/login.php	predictive	Alto
2	File	/cgi-bin/wapopen	predictive	Alto
3	File	/cgi/cpaddons_feature.pl	predictive	Alto
4	File	/data/nvram	predictive	Medio
5	File	/forum/away.php	predictive	Alto
6	File	/frontend/x3/cpanelpro/filelist-thumbs.html	predictive	Alto
7	File	/fs/cifs/file.c	predictive	Alto
8	File	/goform/login	predictive	Alto
9	File	/horde/util/go.php	predictive	Alto
10	File	/mib.db	predictive	Bajo
11	File	/modules/profile/index.php	predictive	Alto
12	File	/OA_HTML/cabo/jsps/a.jsp	predictive	Alto
13	File	/out.php	predictive	Medio
14	File	/system/site.php	predictive	Alto
15	File	adb/adb_client.c	predictive	Alto
16	File	adclick.php	predictive	Medio
17	File	add_comment.php	predictive	Alto
18	File	adelogs.adobe.com	predictive	Alto
19	File	admin.php	predictive	Medio
20	File	admin/google_search_console/class-gsc-table.php	predictive	Alto
21	File	administrator/components/com_media/helpers/media.php	predictive	Alto
22	File	android/webkit/SearchBoxImpl.java	predictive	Alto
23	File	app-layer-ssh.c	predictive	Alto
24	File	arch_init.c	predictive	Medio
25	File	authenticate.c	predictive	Alto
26	File	awstats.pl	predictive	Medio
27	File	BKCLogSvr.exe	predictive	Alto
28	File	xx.xxx	predictive	Bajo
29	File	xxxxxx	predictive	Bajo
30	File	xxx_xxxxxxxxx.xxx	predictive	Alto
31	File	xxxxxxxx.xxx	predictive	Medio
32	File	xxxxxxxxxxxx.xxx	predictive	Alto
33	File	xxx-xxxx.xxx	predictive	Medio
34	File	xxx-xxxxxxx.xxxx	predictive	Alto
35	File	xxx-xxx/xxxxx.xxx	predictive	Alto
36	File	xxxxxxxx	predictive	Medio
37	File	xxxxx.xxx	predictive	Medio
38	File	xxxxxx/xxx.x	predictive	Medio
39	File	xxxxxx/xxxxx/xxxxxxx.x	predictive	Alto
40	File	xxxxxxxxxxxxx.xxx	predictive	Alto
41	File	xxxxxxx.xxx	predictive	Medio
42	File	xxxxxxx-xxxxx-xxxxxxxx.xxx	predictive	Alto
43	File	xxxxxxx/xxxxxx/xxxxxxxxxxxxxxx_xxxx.xx	predictive	Alto
44	File	xxxxxxxxx.xxx	predictive	Alto
45	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Alto
46	File	xxxx_xxxxxxx.xxx	predictive	Alto
47	File	xxxxxx.xxx	predictive	Medio
48	File	xxxxxx-xxxxx.x	predictive	Alto
49	File	xxxx_xxxxx.xxx	predictive	Alto
50	File	xxxx/xxxxxxxxxx/xxxxxx-xxxxx.x	predictive	Alto
51	File	xxxxxxxxxxxxx/	predictive	Alto
52	File	xxxxxxx/xxxxxxxxxxx/xxxxxxxxx	predictive	Alto
53	File	xxxxxxxx_xxxxxxxx.xxx	predictive	Alto
54	File	xx/xxx/xxxxx.x	predictive	Alto
55	File	xxxxxxx.xxx	predictive	Medio
56	File	xxxx_xxxx.xxx	predictive	Alto
57	File	xxxxxxxxxxxxxxx.xxx	predictive	Alto
58	File	xxxx.xxx	predictive	Medio
59	File	xxxxxxxx.xxx	predictive	Medio
60	File	xxxxx.xx	predictive	Medio
61	File	xxxxxxxx-xxxx-xxxxxx-xx-xxxxxxx.xxx	predictive	Alto
62	File	xxx/xxxxxx.xxx	predictive	Alto
63	File	xxx/xxxxx/xxxx-xxxxxxxx.xxx	predictive	Alto
64	File	xxxxx.xxx	predictive	Medio
65	File	xxxxxxx-xx.x	predictive	Medio
66	File	xxx.x	predictive	Bajo
67	File	xxxxxxxxxx/xxxx.x	predictive	Alto
68	File	xxxxxxxxxx/xxxx.x	predictive	Alto
69	File	xxxxxxxxxx/xxxx_xx	predictive	Alto
70	File	xxxxxxxxxxx/xxxxx.x	predictive	Alto
71	File	xxxxxxxxxxx/xxxxxxxxxxx.x	predictive	Alto
72	File	xxxxx.xxx	predictive	Medio
73	File	xxxxx.xxx	predictive	Medio
74	File	xxxx.xxx	predictive	Medio
75	File	xxxxxxxxxx.x	predictive	Medio
76	File	xxxxx/xxxxxxx/xxxxxx_xxxxx_xxxxxxx.xx	predictive	Alto
77	File	xxxx_xxxxx.xxxxxxxx-xxx.xxx	predictive	Alto
78	File	xxxxxxxx.x	predictive	Medio
79	File	xxxx.xxx	predictive	Medio
80	File	xxx-xxxxxxxx.x	predictive	Alto
81	File	xxxxxxx.xxx	predictive	Medio
82	File	xxxxxxx.xxx	predictive	Medio
83	File	xxxxxxx/xxxxxxxxxxxx.x	predictive	Alto
84	File	xxx_xxx_xxx/xxxxx.x	predictive	Alto
85	File	xxxxxxxxx.x	predictive	Medio
86	File	xxx/xxxx/xxx_xxxxxx.x	predictive	Alto
87	File	xxx/xxxxxx/xxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxx.xxxx	predictive	Alto
88	File	xxx/xxxxxx/xxxxxxxx/xxxxx/xxxxxxxxx.xxxx	predictive	Alto
89	File	xxxx/xxxxxxxxx.xxx	predictive	Alto
90	File	xxxxxxxxxx_xxxx.xxx	predictive	Alto
91	File	xx_xxxx.xxx	predictive	Medio
92	File	xxx.xxxx	predictive	Medio
93	File	xxxxxxx.xxx	predictive	Medio
94	File	xxxxx.xxx	predictive	Medio
95	File	xxxxxxxx.xxx	predictive	Medio
96	File	xxxxxxxxxx.xxx	predictive	Alto
97	File	xxxxxxxxx/xxx/xxxxxxxxxxxxx.xxx	predictive	Alto
98	File	xxxxxxx_xxx_xxxxx_xxxxxx.xxxx	predictive	Alto
99	File	xxxxxx.xxx	predictive	Medio
100	File	xxxxxxxxxx.xxx	predictive	Alto
101	File	xxxxxxxx.xxx	predictive	Medio
102	File	xxxxx/xxxxxxxxxxxx/xxxxxxx/xxx.xxxx	predictive	Alto
103	File	xxxxxxxxxxxxxxxx.xxx	predictive	Alto
104	File	xxxxx_xxxxxx_xxxxxxx.xxx	predictive	Alto
105	File	xxxxxxxxx.x	predictive	Medio
106	File	xxxxx/xxxx/xxxxx.x	predictive	Alto
107	File	xxxxxxxxx.xxx	predictive	Alto
108	File	xx_xxxxxxx.xxx	predictive	Alto
109	File	xxxxxxxxxxx.xxx	predictive	Alto
110	File	xxxxxxxx.xxx	predictive	Medio
111	File	xxxx-xxxxx.xxx	predictive	Alto
112	File	xxxx-xxxxxxxx.xxx	predictive	Alto
113	File	xxx.xxx	predictive	Bajo
114	File	xxxxxxxxxxx_xxxxx.xxx	predictive	Alto
115	File	xxxx/xxxx_xxxx.x	predictive	Alto
116	File	xxxxxxxxx_xxxx.x	predictive	Alto
117	File	xxxxxxx.x	predictive	Medio
118	File	xxxxxxx.xxx	predictive	Medio
119	File	xxx.xxx	predictive	Bajo
120	File	xx-xxxxx/xx/xxxx-xxx.xx	predictive	Alto
121	File	xx-xxxxxxxx/xxxxx-xxxxxx.xxx	predictive	Alto
122	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	Alto
123	File	xx-xxxxxxxx/xxxxx-xx-xxxxxx-xxxxxx.xxx	predictive	Alto
124	File	xx-xxxxxxxxxxx.xxx	predictive	Alto
125	File	xx-xxxxxxxxx.xxx	predictive	Alto
126	Library	xxxxxxx\xxx\xxxxxxxx-xxx-x.xxx	predictive	Alto
127	Library	xxx/xxxxxx_xxxx.xx)	predictive	Alto
128	Library	xxx/xxxxxx/xxxxxx_.x	predictive	Alto
129	Library	xxx/xxxxxx/xxxxxxxx/xxx.xxx	predictive	Alto
130	Library	xxx/xxx.xx	predictive	Medio
131	Library	xxx/xxxxxxxx/xxxx.xx	predictive	Alto
132	Library	xxxxxx	predictive	Bajo
133	Library	xxxxxxx/xxxxx/xxx/xxxxxx.x	predictive	Alto
134	Library	xxx/xxxxxxxxx/xxx.x	predictive	Alto
135	Argument	$_xxxxxxx['xxxx']	predictive	Alto
136	Argument	-x	predictive	Bajo
137	Argument	/../	predictive	Bajo
138	Argument	xxxxxxxxxx	predictive	Medio
139	Argument	xxxxxxxxxxx	predictive	Medio
140	Argument	xxxxxxxx	predictive	Medio
141	Argument	xxx	predictive	Bajo
142	Argument	xxxxxxxxxx	predictive	Medio
143	Argument	xxx	predictive	Bajo
144	Argument	xxxxxxx	predictive	Bajo
145	Argument	xxxxxx	predictive	Bajo
146	Argument	xxxx	predictive	Bajo
147	Argument	xxx	predictive	Bajo
148	Argument	xxxxxxxx	predictive	Medio
149	Argument	xxxx	predictive	Bajo
150	Argument	xxxxxxxxxxxxx	predictive	Alto
151	Argument	xxx	predictive	Bajo
152	Argument	xxxxxxx	predictive	Bajo
153	Argument	xxxxx	predictive	Bajo
154	Argument	xxxxxxxxxx	predictive	Medio
155	Argument	xxxxxxxx	predictive	Medio
156	Argument	xxxxx	predictive	Bajo
157	Argument	xxxxxxx	predictive	Bajo
158	Argument	xxxxxxxxx	predictive	Medio
159	Argument	xxxxxxxx	predictive	Medio
160	Argument	xxxxxxxxxxxx	predictive	Medio
161	Argument	xx	predictive	Bajo
162	Argument	xxxxx_xxxx_xxxxxx	predictive	Alto
163	Argument	xxxx	predictive	Bajo
164	Argument	xxxx	predictive	Bajo
165	Argument	xxxxxx	predictive	Bajo
166	Argument	xxxxxx	predictive	Bajo
167	Argument	xxxx/xxx_xxxxxx/xxxx	predictive	Alto
168	Argument	xxxxxxxxxx	predictive	Medio
169	Argument	xxx	predictive	Bajo
170	Argument	xxxxx	predictive	Bajo
171	Argument	xxxx_xxxxx	predictive	Medio
172	Argument	xxx_xxxxxx	predictive	Medio
173	Argument	xxxx	predictive	Bajo
174	Argument	xxxxxxxx	predictive	Medio
175	Argument	xxx-xxx xxxx xxxxxxxx	predictive	Alto
176	Argument	xxxxxxxxx	predictive	Medio
177	Argument	xxxxxxxx	predictive	Medio
178	Argument	xxxxxxxxxxx	predictive	Medio
179	Argument	xxxxxxxxx	predictive	Medio
180	Argument	xxx_xxxx	predictive	Medio
181	Argument	xxxxxxxx	predictive	Medio
182	Argument	xxx	predictive	Bajo
183	Argument	xxxxx	predictive	Bajo
184	Argument	xxxxxxxxxxxxx xx	predictive	Alto
185	Argument	xxxxxxxx	predictive	Medio
186	Argument	xxxxxxxx_xxx	predictive	Medio
187	Argument	xxxxxxxxx	predictive	Medio
188	Argument	xxxxxxx	predictive	Bajo
189	Argument	xxxxxx	predictive	Bajo
190	Argument	xxxxxx	predictive	Bajo
191	Argument	xxxxxxxxxx	predictive	Medio
192	Argument	xxxxxx_xx	predictive	Medio
193	Argument	xxxx_xxx	predictive	Medio
194	Argument	xxxx	predictive	Bajo
195	Argument	xx	predictive	Bajo
196	Argument	xxx	predictive	Bajo
197	Argument	xx_xx	predictive	Bajo
198	Argument	xxxxx	predictive	Bajo
199	Argument	xxxxxx	predictive	Bajo
200	Argument	xxxxxxxxx	predictive	Medio
201	Argument	xxxxxx	predictive	Bajo
202	Argument	xx_xx	predictive	Bajo
203	Argument	xxxxxxxx	predictive	Medio
204	Argument	xxxxxxxx	predictive	Medio
205	Argument	xxxxxx	predictive	Bajo
206	Argument	xxxxxx[]	predictive	Medio
207	Argument	xxxxxxxxxxxxxxx	predictive	Alto
208	Argument	xxxx=xxxxxxxx	predictive	Alto
209	Argument	xxxxxx_xxx	predictive	Medio
210	Argument	xxx	predictive	Bajo
211	Argument	xxx	predictive	Bajo
212	Argument	xxxxxxxx	predictive	Medio
213	Argument	xxxxx	predictive	Bajo
214	Argument	xxx[xxxx_xx]	predictive	Medio
215	Argument	xxxxxx	predictive	Bajo
216	Argument	xxxxxxxxxxx	predictive	Medio
217	Argument	_xxxxxxx	predictive	Medio
218	Input Value	'xx x=x	predictive	Bajo
219	Input Value	);<xxxxxx>xxxxx('xxx')</xxxxxx>	predictive	Alto
220	Input Value	..%xx	predictive	Bajo
221	Input Value	../..	predictive	Bajo
222	Input Value	/\xxxxxxx.xxx	predictive	Alto
223	Input Value	x" xxxxxxxxxxx=xxxxxx(xxxxxx) xxx="	predictive	Alto
224	Input Value	xxxxxxx.xxx_xxx.xxx	predictive	Alto
225	Input Value	xxxxxx	predictive	Bajo
226	Input Value	\xxx\xxx\xxx\xxx\xxx	predictive	Alto
227	Network Port	xxxxxxxxxxxxxx xxxxxx	predictive	Alto
228	Network Port	xxx/xxxx	predictive	Medio
229	Network Port	xxx/xxxx (xxxx) / xxx/xxxx (xxxxx)	predictive	Alto
230	Network Port	xxx xxxxxx xxxx	predictive	Alto

Referencias (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!