Sysrv Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (158)

Idioma

en	124
ru	18
ja	8
zh	4
fr	2

País

us	46
ua	38
cn	10
gb	2

Actores

Sysrv	3
Mirai	3
Cobalt Strike	3
AsyncRAT	2
Nanocore RAT	2

Interesar

Escribe

Not Defined	66
Content Management System	18
Firewall Software	6
Cloud Software	6
Web Browser	6

Proveedor

Not Defined	46
Joomla	8
OnePlug	6
Cisco	6
Fortinet	4

Producto

Joomla CMS	8
OnePlug CMS	6
Fortinet FortiOS	4
Multivendor Marketplace Solution for WooCommerce	2
Fortinet FortiProxy	2

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	Apple iOS ImageIO denegación de servicio	6.4	6.3	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.03533	0.00	CVE-2016-1811
2	gopeak MasterLab HTTP POST Request Framework.php sqlInject sql injection	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00181	0.08	CVE-2023-7145
3	Grafana directory traversal	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.97474	0.02	CVE-2021-43798
4	CKFinder File Name escalada de privilegios	7.4	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00155	0.04	CVE-2019-15862
5	PHPMailer Phar Deserialization addAttachment escalada de privilegios	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00748	0.00	CVE-2020-36326
6	Apple iOS CommonCrypto divulgación de información	5.4	5.3	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00181	0.00	CVE-2016-1802
7	Fortinet FortiOS sslvpnd desbordamiento de búfer	9.8	9.3	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.41883	0.00	CVE-2022-42475
8	Fortinet FortiOS/FortiProxy FortiGate SSL-VPN desbordamiento de búfer	9.8	9.6	$25k-$100k	$25k-$100k	Not Defined	Official Fix	0.15407	0.04	CVE-2023-27997
9	WordPress AdServe adclick.php sql injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00073	0.04	CVE-2008-0507
10	Joomla CMS com_easyblog sql injection	6.3	6.1	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00000	0.33
11	ASP Portal add_edit_cat.asp sql injection	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00983	0.02	CVE-2006-1353
12	MyBatis Plus sql injection	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00084	0.00	CVE-2023-25330
13	Zabbix Application Server Privilege Escalation	4.7	4.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00317	0.00	CVE-2021-46088
14	Grafana Labs Permission autenticación débil	9.8	9.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.97240	0.07	CVE-2021-39226
15	Duo Network Gateway Log divulgación de información	4.9	4.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.00	CVE-2020-3483
16	Linux Kernel af_packet.c packet_set_ring desbordamiento de búfer	6.5	6.4	$0-$5k	$0-$5k	High	Official Fix	0.00088	0.04	CVE-2017-7308
17	Biscom Secure File Transfer escalada de privilegios	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02180	0.04	CVE-2020-8796
18	Oracle Siebel CRM Siebel Core - Server Infrastructure divulgación de información	5.9	5.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00194	0.00	CVE-2021-2368
19	studio-42 elfinder phar File Remote Code Execution	5.6	5.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01623	0.02	CVE-2021-23394
20	shell-quote Windows Drive Letter exec escalada de privilegios	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00160	0.06	CVE-2021-42740

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Identified	Escribe	Confianza
1	31.42.177.123	scalemany.com	Sysrv	2022-07-27	verified	Alto
2	31.210.20.120		Sysrv	2022-07-27	verified	Alto
3	XX.XXX.XX.XXX		Xxxxx	2022-07-27	verified	Alto
4	XX.XXX.XXX.XX		Xxxxx	2022-07-27	verified	Alto
5	XXX.XXX.XXX.XX	xxx-xxxx.xxxxx--xxxxxxx.xxx	Xxxxx	2022-07-27	verified	Alto
6	XXX.XX.XXX.XX		Xxxxx	2022-07-27	verified	Alto
7	XXX.XXX.XXX.XX		Xxxxx	2022-07-27	verified	Alto
8	XXX.XX.XX.XX		Xxxxx	2022-07-27	verified	Alto

TTP - Tactics, Techniques, Procedures (16)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1006	CWE-21, CWE-22	Path Traversal	predictive	Alto
2	T1040	CWE-319	Authentication Bypass by Capture-replay	predictive	Alto
3	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
4	T1059	CWE-94	Argument Injection	predictive	Alto
5	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
6	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
7	TXXXX.XXX	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	Alto
8	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
9	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
10	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
11	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
12	TXXXX	CWE-XXX	Xxxxxxx Xxxxxxxxxx Xx Xxx-xxxxxxxx	predictive	Alto
13	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
14	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
15	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto
16	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (81)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	/admin/contenttemp	predictive	Alto
2	File	/htdocs/upnpinc/gena.php	predictive	Alto
3	File	/lab.html	predictive	Medio
4	File	/member/picture/album	predictive	Alto
5	File	/products/details.asp	predictive	Alto
6	File	/public/plugins/	predictive	Alto
7	File	/services/details.asp	predictive	Alto
8	File	/vendor	predictive	Bajo
9	File	adclick.php	predictive	Medio
10	File	add_edit_cat.asp	predictive	Alto
11	File	xxxxx.xxx	predictive	Medio
12	File	xxxxx/xxxxxx.xxxxxxxxx_xxxxx.xxx	predictive	Alto
13	File	xxxxxxx.xxx	predictive	Medio
14	File	xxxxxxxxxxxxx/xxxxxxxxxx/xxx_xxxxx/xxxxxxx/xxxxx.xxx	predictive	Alto
15	File	xxx/xxxx/xxxxxxxxx.xxx	predictive	Alto
16	File	xxxxxxxxxx.xxx	predictive	Alto
17	File	xxxxxxxx_xxxxxxxxxxxxxxxxx.xxx	predictive	Alto
18	File	xxxxxx.xxx.xxx	predictive	Alto
19	File	xxxxxxxx.xxx.xxx	predictive	Alto
20	File	xxxxxxxxxxxxx.xxxxx	predictive	Alto
21	File	xxx/xxxx.x	predictive	Medio
22	File	xxx/xxxxxx.xxx	predictive	Alto
23	File	xxxxxxx.xxx	predictive	Medio
24	File	xxxxxxx/xxxx_xxxxxxxxxx.xxx	predictive	Alto
25	File	xxxx_xxxx.xxx	predictive	Alto
26	File	xxxxxx_xxxxx_xxxxxxx.x	predictive	Alto
27	File	xxx/xxxxxx/xx_xxxxxx.x	predictive	Alto
28	File	xxxx.xxx	predictive	Medio
29	File	xxxxxxx/xxxxxx/xxxxxxxx/xxxxxxxx.xxx	predictive	Alto
30	File	xxxxxxx.xxx	predictive	Medio
31	File	xxxxx/xxxxxxx.xxx	predictive	Alto
32	File	xxxxxxxx.xxx	predictive	Medio
33	File	xxxxxxxx.xxx	predictive	Medio
34	File	xxxxxxxxxxxx_xxxxxxxx.xxx.xxx	predictive	Alto
35	File	xxxx_xxxxxxx_xxxxxxxx.xxx	predictive	Alto
36	File	xxxx_xxxxx.xxxx	predictive	Alto
37	File	xxxxx_xxxx_xxx.xxx	predictive	Alto
38	File	xxxxx_xxxxx.xxx	predictive	Alto
39	File	xxx.xxx	predictive	Bajo
40	File	xxxxxxxx.xxx	predictive	Medio
41	File	xxxxxxx.xxx	predictive	Medio
42	File	xx-xxxxx/xxxxxxx-xxxxxxx.xxx	predictive	Alto
43	File	xx-xxxxx-xxxxxx.xxx	predictive	Alto
44	File	\xxx\xxxxxxxx\xxxxxxxx\xxxxxxxx.xxx	predictive	Alto
45	Library	xxx_xxxxxx.xxx	predictive	Alto
46	Library	xxxxxx[xxxxxx_xxxx	predictive	Alto
47	Library	xxxxxxxxx/xxx/xxxxxxxxxx/xxxx/xxxxx/xxxxxxx.xxxxx.xxx	predictive	Alto
48	Argument	xxxxxxxx	predictive	Medio
49	Argument	xxxxx_xxxx	predictive	Medio
50	Argument	xxx_xxx	predictive	Bajo
51	Argument	xxx_xx	predictive	Bajo
52	Argument	xxxx_xx	predictive	Bajo
53	Argument	xxxxxx[xxxxxx_xxxx]	predictive	Alto
54	Argument	xxxxxxxxxxxx	predictive	Medio
55	Argument	xxxxxxxx	predictive	Medio
56	Argument	xxxx	predictive	Bajo
57	Argument	xx	predictive	Bajo
58	Argument	xxxxxxxxx	predictive	Medio
59	Argument	xxx	predictive	Bajo
60	Argument	xxx_xxxxxxx_xxx	predictive	Alto
61	Argument	xxxxxxx xxxx	predictive	Medio
62	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	Alto
63	Argument	xxxx	predictive	Bajo
64	Argument	xxxxxx_xxxxxx[xxxxxx_xxxx]	predictive	Alto
65	Argument	xxx	predictive	Bajo
66	Argument	xxxxxxx_xx	predictive	Medio
67	Argument	xxx	predictive	Bajo
68	Argument	xxxxxxxxxxx	predictive	Medio
69	Argument	xxxxxx_xxxx	predictive	Medio
70	Argument	xxxxxx	predictive	Bajo
71	Argument	xxxxxxx_xx	predictive	Medio
72	Argument	xxxx	predictive	Bajo
73	Argument	xxxxxxx xxxxxxx	predictive	Alto
74	Argument	xxx	predictive	Bajo
75	Argument	xxxxxxxxx_xxxxx	predictive	Alto
76	Argument	xxxxxxx	predictive	Bajo
77	Argument	xxxxx	predictive	Bajo
78	Argument	xxxx	predictive	Bajo
79	Argument	xxxxxxxx/xxxxxxxx/xxxxxxxxxxx	predictive	Alto
80	Input Value	%xxxxxx+-x+x+xx.x.xx.xxx%xx%xx	predictive	Alto
81	Input Value	..	predictive	Bajo

Referencias (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Do you know our Splunk app?

Download it now for free!