Sodinokibi Análisis

IOB - Indicator of Behavior (92)

Cronología

Idioma

en80
ru4
pt2
zh2
de2

País

Actores

Ocupaciones

Interesar

Cronología

Escribe

Proveedor

Producto

Microsoft Windows12
njs4
Oracle Java SE4
Linux Kernel4
Google Chrome4

Vulnerabilidad

#VulnerabilidadBaseTemp0dayHoyExpConEPSSCTICVE
1FLDS redir.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.002030.09CVE-2008-5928
2Debian fuse Package cuse escalada de privilegios7.87.5$5k-$25k$0-$5kNot DefinedOfficial Fix0.000420.00CVE-2016-1233
3OpenEMR sl_eob_search.php escalada de privilegios7.57.2$0-$5k$0-$5kNot DefinedOfficial Fix0.001810.00CVE-2018-15154
4Pandao editor.md Markdown cross site scripting4.84.8$0-$5k$0-$5kNot DefinedNot Defined0.000550.06CVE-2023-29641
5LogicBoard CMS away.php Redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable0.000002.88
6OpenX adclick.php Redirect5.34.7$0-$5k$0-$5kUnprovenUnavailable0.004400.75CVE-2014-2230
7Apple Mac OS X Server Wiki Server sql injection5.34.6$5k-$25k$0-$5kUnprovenOfficial Fix0.003392.61CVE-2015-5911
8SAP 3D Visual Enterprise Viewer GIF File denegación de servicio3.83.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.000610.00CVE-2021-27593
9Apple macOS IOMobileFrameBuffer desbordamiento de búfer7.87.2$5k-$25k$0-$5kFunctionalOfficial Fix0.002630.00CVE-2022-22587
10Apple iOS/iPadOS IOMobileFrameBuffer desbordamiento de búfer7.87.2$25k-$100k$5k-$25kFunctionalOfficial Fix0.002630.00CVE-2022-22587
11Apple Safari WebKit denegación de servicio7.37.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.008560.00CVE-2014-4452
12HPE Ezmeral Data Fabric TEZ MapR Ecosystem escalada de privilegios6.36.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.001970.00CVE-2021-29215
13nginx ngx_http_mp4_module divulgación de información5.95.8$0-$5k$0-$5kNot DefinedOfficial Fix0.001980.05CVE-2018-16845
14SonarQube values cifrado débil5.95.9$0-$5k$0-$5kNot DefinedNot Defined0.368800.01CVE-2020-27986
15Bitnami Docker Container .env cifrado débil3.53.4$0-$5k$0-$5kNot DefinedOfficial Fix0.001170.02CVE-2021-21979
16Google Android System escalada de privilegios7.06.3$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.003060.07CVE-2017-13209
17PHP addcslashe Remote Code Execution8.58.1$5k-$25k$0-$5kUnprovenOfficial Fix0.005390.00CVE-2016-4344
18Sophos XG Firewall HTTPS Bookmark desbordamiento de búfer8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.007730.00CVE-2020-15069
19Marvin Minsky Universal Turing Machine escalada de privilegios4.64.4$0-$5k$0-$5kProof-of-ConceptNot Defined0.000480.00CVE-2021-32471
20Sophos Cyberoam Firewall SSL VPN Console escalada de privilegios8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.006420.03CVE-2019-17059

IOC - Indicator of Compromise (28)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDdirección IPHostnameActorCampañasIdentifiedEscribeConfianza
145.55.211.79Sodinokibi2019-05-02verifiedAlto
246.30.215.77webcluster1.webpod6-cph3.one.comSodinokibi2022-04-14verifiedAlto
346.45.134.70server-46.45.134.70.as42926.netSodinokibi2022-04-14verifiedAlto
450.116.71.86box6146.bluehost.comSodinokibi2022-04-14verifiedAlto
552.9.200.151www.drvoip.comSodinokibi2022-04-14verifiedAlto
652.28.116.69ec2-52-28-116-69.eu-central-1.compute.amazonaws.comSodinokibi2022-04-14verifiedMedio
7XX.XXX.XX.XXxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
8XX.XXX.X.XXxxx-xx-xxx-x-xx.xxxxxxx.xxxx-xxxxxxx-xxxxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
9XX.XXX.XX.XXXXxxxxxxxxx2022-04-14verifiedAlto
10XX.XX.XXX.XXXxxxxxxxxxx.xxxxxxx.xxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
11XXX.XXX.XX.XXxx-xxx-xxx-xx-xx.xx.xxxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
12XXX.XX.XXX.XXXxx-xxx-xx-xxx-xxx.xxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
13XXX.XXX.XXX.XXxxxxxx.xxxx.xxXxxxxxxxxx2022-04-14verifiedAlto
14XXX.XX.XX.XXXXxxxxxxxxx2019-05-02verifiedAlto
15XXX.XXX.XXX.XXXxxxx.xxxxxxxxxxxxxxxx.xxXxxxxxxxxx2022-04-14verifiedAlto
16XXX.XXX.XX.XXxxxxxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
17XXX.XX.X.XXXxxx.xxxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
18XXX.XXX.XX.XXXxxxxxx.xxxxxxxxxxxx.xxXxxxxxxxxx2022-04-14verifiedAlto
19XXX.XXX.XXX.XXxx-xxx-xxx-xxx-xx.xxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
20XXX.XXX.XX.XXXxxxxxxxxxx.xxxxxxx.xxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
21XXX.XXX.XX.XXXXxxxxxxxxx2019-05-02verifiedAlto
22XXX.XXX.XX.XXXxxxx.xxxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
23XXX.XX.XXX.XXxxxx.xxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
24XXX.XXX.XXX.XXxxxxx-xx.xxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
25XXX.XX.XXX.XXXxx-xxx-xx-xxx-xxx.xx.xxxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
26XXX.XX.XXX.XXXxxx-xx-xxx-xxx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
27XXX.XXX.XX.Xxxxxxxxxxx.xxx.xxxXxxxxxxxxx2022-04-14verifiedAlto
28XXX.XXX.XX.XXxxxxxxxxxx.xxx.xxxXxxxxxxxxx2022-04-14verifiedAlto

TTP - Tactics, Techniques, Procedures (16)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilidadVector de accesoEscribeConfianza
1T1006CWE-22Path TraversalpredictiveAlto
2T1040CWE-294, CWE-319Authentication Bypass by Capture-replaypredictiveAlto
3T1055CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveAlto
4T1059CWE-94Argument InjectionpredictiveAlto
5TXXXX.XXXCWE-XX, CWE-XXXxxxx Xxxx XxxxxxxxxpredictiveAlto
6TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveAlto
7TXXXXCWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveAlto
8TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveAlto
9TXXXXCWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveAlto
10TXXXXCWE-XXX, CWE-XXXXxxxxxxxxx XxxxxxpredictiveAlto
11TXXXXCWE-XXXxx XxxxxxxxxpredictiveAlto
12TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveAlto
13TXXXX.XXXCWE-XXXXxxxxxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveAlto
14TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveAlto
15TXXXXCWE-XXX, CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveAlto
16TXXXX.XXXCWE-XXXXxx Xxxxxxxxxx XxxxxpredictiveAlto

IOA - Indicator of Attack (34)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClaseIndicatorEscribeConfianza
1File/dev/cusepredictiveMedio
2File/dev/snd/seqpredictiveMedio
3File/forum/away.phppredictiveAlto
4File/tmp/app/.envpredictiveAlto
5File/xxx/xxxxx/xxxxxxxxxxxxxxxxxxxx/xxx/predictiveAlto
6Filexxxxxxx.xxxpredictiveMedio
7Filexxxxx/xxxxxxxx.xxxpredictiveAlto
8Filexxx/xxxxxxxx/xxxxxxpredictiveAlto
9Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveAlto
10Filexxxxxxx.xxxpredictiveMedio
11Filexxxxxxx.xxxxpredictiveMedio
12Filexx/xxxxx.xpredictiveMedio
13Filexxxxxxx.xpredictiveMedio
14Filexxxxx.xxpredictiveMedio
15Filexxxxxxxxx/xxxxxxx/xx_xxx_xxxxxx.xxxpredictiveAlto
16Filexxxxxxx_xxxxxxxxxxxx.xpredictiveAlto
17Filexxxx.xpredictiveBajo
18Filexxx_xxxxx.xpredictiveMedio
19Filexxx_xxxx.xpredictiveMedio
20Filexxx_xxxxx.xpredictiveMedio
21Filexxxxxx/xxxxxxxxxxxxxxxxx.xxpredictiveAlto
22Filexxxxx.xxxpredictiveMedio
23Filexxxx-xxxxxx.xpredictiveAlto
24Filexxxxxxxxx_xxxpredictiveAlto
25Filexxxx/xxx/xxxx-xxxxx.xxxpredictiveAlto
26Argumentxxx_xxxpredictiveBajo
27ArgumentxxxxpredictiveBajo
28ArgumentxxpredictiveBajo
29ArgumentxxxxxxxxxxxxxxpredictiveAlto
30Argumentxxxxx_xxxxxxxpredictiveAlto
31ArgumentxxxxxxpredictiveBajo
32ArgumentxxxxxxxxxpredictiveMedio
33Input Value.%xx.../.%xx.../predictiveAlto
34Input Valuexxxxx/xxxxxxxxpredictiveAlto

Referencias (3)

The following list contains external sources which discuss the actor and the associated activities:

Do you need the next level of professionalism?

Upgrade your account now!