ScanBox Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (97)

Idioma

en	70
zh	22
de	4
jp	2

País

cn	64
us	28
ca	2
th	2

Actores

ScanBox	8
UAC-0010	1
3CX Backdoor	1
Emotet	1
PhotoLoader	1

Interesar

Escribe

Not Defined	36
Content Management System	18
Operating System	10
Web Server	4
Network Attached Storage Software	4

Proveedor

Not Defined	38
Oracle	6
Linux	6
Microsoft	4
VMware	4

Producto

Linux Kernel	6
DeDeCMS	4
Joomla CMS	4
RadScripts RadLance	2
Microsoft IIS	2

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	October CMS fromData condición de carrera	6.8	6.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00405	0.00	CVE-2022-24800
2	DeDeCMS recommend.php sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02834	0.04	CVE-2017-17731
3	Fortinet FortiOS/FortiPAM/FortiProxy HTTP Request desbordamiento de búfer	9.8	9.6	$25k-$100k	$25k-$100k	Not Defined	Official Fix	0.00091	0.04	CVE-2023-42789
4	Oracle Identity Management Suite Apache Log4j escalada de privilegios	9.8	9.7	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.81948	0.02	CVE-2017-5645
5	VMware Cloud Director Privilege Escalation	7.2	6.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00252	0.03	CVE-2022-22966
6	Google Android Lockscreen KeyguardServiceWrapper.java condición de carrera	2.0	1.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00042	0.02	CVE-2022-20006
7	Boa Webserver GET wapopen directory traversal	6.4	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.73540	0.09	CVE-2017-9833
8	Microsoft ASP.NET Forms Authentication directory traversal	9.8	9.4	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.93976	0.02	CVE-2004-0847
9	Oracle MySQL Enterprise Monitor Monitoring directory traversal	9.1	8.9	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00127	0.00	CVE-2022-37865
10	SpringBlade sql injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00171	0.02	CVE-2022-27360
11	Cuppa CMS File Manager copy escalada de privilegios	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00205	0.02	CVE-2022-25401
12	JCK Editor links.php sql injection	8.5	8.3	$0-$5k	$0-$5k	High	Not Defined	0.81623	0.03	CVE-2018-17254
13	Yii Yii2 directory traversal	7.6	7.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00091	0.04	CVE-2015-5467
14	Umbraco FeedProxy.aspx.cs Page_Load escalada de privilegios	7.7	7.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00511	0.04	CVE-2015-8813
15	WPS Hide Login Plugin Secret Login Page options.php escalada de privilegios	6.9	6.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02933	0.04	CVE-2021-24917
16	jeecg-boot divulgación de información	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00703	0.04	CVE-2021-37304
17	SSH SSH-1 Protocol cifrado débil	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00258	0.08	CVE-2001-1473
18	Linux Kernel nftables nft_byteorder.c nft_byteorder desbordamiento de búfer	6.5	6.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00046	0.04	CVE-2023-35001
19	emlog index.php divulgación de información	5.5	5.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00300	0.02	CVE-2021-3293
20	Linux Kernel DECnet Socket denegación de servicio	5.4	5.2	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00504	0.00	CVE-2023-3338

IOC - Indicator of Compromise (26)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Identified	Escribe	Confianza
1	1.9.5.38		ScanBox	2020-12-24	verified	Alto
2	45.77.237.243	45.77.237.243.vultrusercontent.com	ScanBox	2024-02-16	verified	Alto
3	50.2.24.211		ScanBox	2020-12-24	verified	Alto
4	66.197.231.62		ScanBox	2021-01-01	verified	Alto
5	69.197.146.80		ScanBox	2021-01-01	verified	Alto
6	69.197.183.142	us-mci1-16.renders.prerender.io	ScanBox	2021-01-01	verified	Alto
7	XX.XXX.XXX.XXX		Xxxxxxx	2021-01-01	verified	Alto
8	XX.XXX.XXX.XXX		Xxxxxxx	2021-01-01	verified	Alto
9	XX.XXX.XXX.XXX	xx-xxxx-xx.xxxxxxx.xxxxxxxxx.xx	Xxxxxxx	2021-01-01	verified	Alto
10	XX.XX.XXX.XXX	xxxxxxxxxxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	2020-12-24	verified	Alto
11	XXX.XX.XXX.XXX		Xxxxxxx	2020-12-24	verified	Alto
12	XXX.XXX.XXX.XXX		Xxxxxxx	2020-12-24	verified	Alto
13	XXX.XX.XX.XXX		Xxxxxxx	2020-12-24	verified	Alto
14	XXX.XX.XX.XXX		Xxxxxxx	2021-01-01	verified	Alto
15	XXX.XX.XX.XXX		Xxxxxxx	2024-02-16	verified	Alto
16	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx	2024-02-16	verified	Alto
17	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	2024-02-16	verified	Alto
18	XXX.XXX.XXX.XX	xx.xx.xxxx.xxxxxx.xxxxxxxxx.xxx	Xxxxxxx	2020-12-24	verified	Alto
19	XXX.XX.XX.XXX	xxxxxxx.xxxxxxxxxxxxxx.xx.xx	Xxxxxxx	2021-01-01	verified	Alto
20	XXX.XX.XXX.XXX	xxx-xx-xxx-x.xx.xxx.xxxxx-xxxxx.xxxxxxxxxx.xxx	Xxxxxxx	2021-01-01	verified	Alto
21	XXX.XX.XX.X	xxx-xx-xx-x.xx.xxxxxx.xxxxx-xxxxxx.xxxxxxxxxx.xxx	Xxxxxxx	2021-01-01	verified	Alto
22	XXX.XX.XXX.XXX	xxx-xx-xxx-x.xx.xxxxxx.xxxxx-xxxxx.xxxxxxxxxx.xxx	Xxxxxxx	2021-01-01	verified	Alto
23	XXX.XXX.XX.XX	x.x.xxxxx.xx	Xxxxxxx	2021-01-01	verified	Alto
24	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx	2024-02-16	verified	Alto
25	XXX.X.XXX.XX		Xxxxxxx	2021-01-01	verified	Alto
26	XXX.X.XXX.XX		Xxxxxxx	2021-01-01	verified	Alto

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1006	CWE-22, CWE-23	Path Traversal	predictive	Alto
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	T1059	CWE-94	Argument Injection	predictive	Alto
4	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
5	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
8	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Alto
9	TXXXX	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
10	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	Alto
12	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	Alto
13	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
14	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto
15	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (83)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	/cgi-bin/wapopen	predictive	Alto
2	File	/proc/self/setgroups	predictive	Alto
3	File	/secure/QueryComponent!Default.jspa	predictive	Alto
4	File	/userRpm/PingIframeRpm.htm	predictive	Alto
5	File	/webman/info.cgi	predictive	Alto
6	File	/wp-admin/options.php	predictive	Alto
7	File	adclick.php	predictive	Medio
8	File	addentry.php	predictive	Medio
9	File	and/or	predictive	Bajo
10	File	xxxxxx.xxxxxx.xxx	predictive	Alto
11	File	xxx.xxx	predictive	Bajo
12	File	xxxxxx.x	predictive	Medio
13	File	xxx-xxx/xxxxxx	predictive	Alto
14	File	xxxxxx.xxx.xxx	predictive	Alto
15	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Alto
16	File	xxxx-xxxxx.xxx	predictive	Alto
17	File	xxxxxxxxx.xxx.xxx	predictive	Alto
18	File	xxxxxxx.xxx	predictive	Medio
19	File	xxxxxxxxxxxx_xxxx.xxx	predictive	Alto
20	File	xxxxxxx/xxxxxxxxxxx.xxx	predictive	Alto
21	File	xxx/xxxxxx.xxx	predictive	Alto
22	File	xxxxx.xxx	predictive	Medio
23	File	xxxx_xxxx.xxx	predictive	Alto
24	File	xxx.xxxx	predictive	Medio
25	File	xxxxxxxxx/xxxxxxx/xxxxx.xxx	predictive	Alto
26	File	xxxxxx/xxx/xxxxxxxx.x	predictive	Alto
27	File	xxxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	Alto
28	File	xxxxxx.xxx	predictive	Medio
29	File	xxx/xxxxxxxxx.xx	predictive	Alto
30	File	xxxxxx.xxx	predictive	Medio
31	File	xxx/xxx/xx_xxx.x	predictive	Alto
32	File	xxx/xxxxxxxxx/xxx_xxxxxxxxx.x	predictive	Alto
33	File	xxxxxxx.xxx	predictive	Medio
34	File	xxxxxxxxxx.xxx	predictive	Alto
35	File	xxxx/xxxxxxxxx.xxx	predictive	Alto
36	File	xxxxx.xxx	predictive	Medio
37	File	xxxxxxxxxxxxxxx.xxx	predictive	Alto
38	File	xxxxxxxxxxxxxxxxxx.xxx	predictive	Alto
39	File	xxxxxxxx.xxx	predictive	Medio
40	File	xxxxxxxxxxxxxxx.xxx	predictive	Alto
41	File	x/xxxxx.xxx	predictive	Medio
42	File	xxx_xxxx_xxxxxx.xxx	predictive	Alto
43	File	xxxxxxx.xxx/xxxxxxx.xxxxxxxxxxxx/xxxxxxx/xxxxxxxxx/xxxxxxxxx.xxxx.xx	predictive	Alto
44	File	xxxx-xxxxxxx.xxx	predictive	Alto
45	File	xxxx.xxxxx.xxxxxx	predictive	Alto
46	File	xx-xxxxx.xxx	predictive	Medio
47	Library	xxx/xxxxxxxxx.xx	predictive	Alto
48	Library	xxxx.xxxxx	predictive	Medio
49	Argument	$_xxxxx	predictive	Bajo
50	Argument	xxxxx_xxxx	predictive	Medio
51	Argument	xxxxxxxx	predictive	Medio
52	Argument	xxxxxxxx	predictive	Medio
53	Argument	xxxxxxxxxx	predictive	Medio
54	Argument	xxxxx	predictive	Bajo
55	Argument	xxxx_xx	predictive	Bajo
56	Argument	xxxxxxxxxxxxxxxx	predictive	Alto
57	Argument	x_xx	predictive	Bajo
58	Argument	xxxxxxxxxx	predictive	Medio
59	Argument	xxxxxxxx	predictive	Medio
60	Argument	xxxx	predictive	Bajo
61	Argument	xxxx/xxxxxx/xxx	predictive	Alto
62	Argument	xx	predictive	Bajo
63	Argument	xxxxxxxx	predictive	Medio
64	Argument	xxx_xxxxxxx_xxx	predictive	Alto
65	Argument	xxxx/xxxxxxxx/xxx/xxx/xxxxxxxx/xxxxxxx	predictive	Alto
66	Argument	xxxxxxxxxxxxxxxxxxxxxxx	predictive	Alto
67	Argument	xxxxxx	predictive	Bajo
68	Argument	xxxx	predictive	Bajo
69	Argument	xxxxxxxx	predictive	Medio
70	Argument	xxxxxx	predictive	Bajo
71	Argument	xxxx_xxxxx	predictive	Medio
72	Argument	xxxxxxxxxx_xxxx	predictive	Alto
73	Argument	xxxxxxxxxxx	predictive	Medio
74	Argument	xxxx	predictive	Bajo
75	Argument	xxxxxx	predictive	Bajo
76	Argument	xxxxxxxxx: x	predictive	Medio
77	Argument	xxx	predictive	Bajo
78	Argument	xxxxxx	predictive	Bajo
79	Argument	xxxxxxxx	predictive	Medio
80	Argument	xxxxxxxx/xxxxxxxx	predictive	Alto
81	Argument	xxxx	predictive	Bajo
82	Input Value	../..	predictive	Bajo
83	Network Port	xxx/xxxx	predictive	Medio

Referencias (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!