TA410 Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (264)

Idioma

en	220
zh	22
ru	8
fr	4
de	2

País

us	102
cn	76
ce	10
ru	6
la	6

Actores

Cobalt Strike	14
NetSupportManager RAT	11
TA410	9
Raccoon	9
SideWinder	8

Interesar

Escribe

Not Defined	94
WordPress Plugin	16
Content Management System	16
Firewall Software	12
Router Operating System	12

Proveedor

Not Defined	90
Microsoft	20
Computrols	6
Sophos	6
QNAP	6

Producto

WordPress	10
Microsoft Windows	8
Computrols CBAS	6
QNAP QTS	6
Microsoft Exchange Server	6

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	DZCP deV!L`z Clanportal config.php escalada de privilegios	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.70	CVE-2010-0966
2	Atmail Remote Code Execution	9.8	9.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00251	0.04	CVE-2013-5033
3	WordPress sql injection	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00467	0.03	CVE-2022-21664
4	Palo Alto PAN-OS GlobalProtect Clientless VPN desbordamiento de búfer	8.8	8.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00112	0.03	CVE-2021-3056
5	VeronaLabs wp-statistics Plugin API Endpoint Blind sql injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00250	0.00	CVE-2019-13275
6	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgación de información	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
7	Linksys WRT54GL Web Management Interface SysInfo1.htm divulgación de información	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00046	0.19	CVE-2024-1406
8	MW WP Form Plugin escalada de privilegios	7.3	7.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00248	0.00	CVE-2023-6316
9	request-baskets API Request {name} escalada de privilegios	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.08109	0.00	CVE-2023-27163
10	Teclib GLPI unlock_tasks.php sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.12149	0.08	CVE-2019-10232
11	Sophos Firewall User Portal/Webadmin autenticación débil	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.97434	0.08	CVE-2022-1040
12	CutePHP CuteNews escalada de privilegios	7.5	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02107	0.08	CVE-2019-11447
13	WordPress Object escalada de privilegios	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00432	0.04	CVE-2022-21663
14	Microsoft Windows Active Directory Domain Services Privilege Escalation	8.8	8.1	$100k y más	$0-$5k	Proof-of-Concept	Official Fix	0.07084	0.04	CVE-2022-26923
15	QNAP QTS Media Library escalada de privilegios	8.5	8.2	$0-$5k	$0-$5k	High	Official Fix	0.01575	0.03	CVE-2017-13067
16	Microsoft Exchange Server ProxyShell Remote Code Execution	9.5	8.2	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.97319	0.00	CVE-2021-34473
17	Microsoft Exchange Server Privilege Escalation	8.8	8.1	$25k-$100k	$0-$5k	Unproven	Official Fix	0.96514	0.04	CVE-2021-42321
18	Bitcoin Core bitcoin-qt wallet.dat Memory cifrado débil	5.0	5.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00236	0.03	CVE-2019-15947
19	OpenSSH Authentication Username divulgación de información	5.3	4.8	$5k-$25k	$0-$5k	High	Official Fix	0.10737	0.09	CVE-2016-6210
20	Samurai Build File util.c canonpath desbordamiento de búfer	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00085	0.00	CVE-2019-19795

IOC - Indicator of Compromise (16)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Identified	Escribe	Confianza
1	5.252.179.227	no-rdns.mivocloud.com	TA410	2022-10-05	verified	Alto
2	43.254.216.104		TA410	2022-10-05	verified	Alto
3	43.254.219.153		TA410	2022-10-05	verified	Alto
4	45.124.115.103	45.124.115.103.static.xtom.hk	TA410	2022-10-05	verified	Alto
5	XX.XXX.XX.XX		Xxxxx	2022-10-05	verified	Alto
6	XX.XXX.XXX.XXX	xx-xxx-xxx-xxx.xxxxxxxxx.xxx	Xxxxx	2022-10-05	verified	Alto
7	XXX.XX.XX.XXX	xxxx.xxxxxxx-xxxxxx.xxx	Xxxxx	2024-02-16	verified	Alto
8	XXX.XXX.X.XXX		Xxxxx	2024-02-16	verified	Alto
9	XXX.XXX.X.XX		Xxxxx	2022-10-05	verified	Alto
10	XXX.XX.XXX.XXX		Xxxxx	2022-10-05	verified	Alto
11	XXX.XXX.XXX.XX		Xxxxx	2022-10-05	verified	Alto
12	XXX.XX.XXX.X	xxxxxx-xxx-xx-xxx-x.xxxxxx.xx.xx	Xxxxx	2022-10-05	verified	Alto
13	XXX.XXX.XX.XX	xxxx.xxxxxxxxxxxxxxx.xxx	Xxxxx	2022-10-05	verified	Alto
14	XXX.XXX.XX.XX	xx-xxxx.xxxxxxxxx.xxx	Xxxxx	2022-10-05	verified	Alto
15	XXX.XXX.XXX.XX		Xxxxx	2024-02-16	verified	Alto
16	XXX.XXX.XXX.XXX		Xxxxx	2022-10-05	verified	Alto

TTP - Tactics, Techniques, Procedures (16)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1006	CWE-22, CWE-23	Path Traversal	predictive	Alto
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	T1059	CWE-94	Argument Injection	predictive	Alto
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Alto
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
8	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
9	TXXXX	CWE-XXX	Xxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx Xxxxx	predictive	Alto
10	TXXXX	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Alto
12	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
13	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
14	TXXXX.XXX	CWE-XX	Xxxxxxxxxxxxx	predictive	Alto
15	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto
16	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (118)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	/api/baskets/{name}	predictive	Alto
2	File	/api/RecordingList/DownloadRecord?file=	predictive	Alto
3	File	/api /v3/auth	predictive	Alto
4	File	/apply.cgi	predictive	Medio
5	File	/cgi-bin/wlogin.cgi	predictive	Alto
6	File	/gena.cgi	predictive	Medio
7	File	/MIME/INBOX-MM-1/	predictive	Alto
8	File	/netflow/jspui/editProfile.jsp	predictive	Alto
9	File	/php/ping.php	predictive	Alto
10	File	/rapi/read_url	predictive	Alto
11	File	/scripts/unlock_tasks.php	predictive	Alto
12	File	/sec/content/sec_asa_users_local_db_add.html	predictive	Alto
13	File	/see_more_details.php	predictive	Alto
14	File	/xxxxxxxx.xxx	predictive	Alto
15	File	/xxxxxxx_xxxx.xxx	predictive	Alto
16	File	/xxxxxx/xxxx/xxxxxxx/xxx_xxxxx/xxxxxxxxxx.xxx	predictive	Alto
17	File	/xx-xxxxx/xxxxx-xxxx.xxx?xx_xxxx=x&xxxxxx_xxxx	predictive	Alto
18	File	xxxxxxxxxxx/xxxxx/xxxxxxxxxx/xxxxxxxxxxxxxxxx.xxxxx.xxx	predictive	Alto
19	File	xxxxxxx/xxxx.xxx	predictive	Alto
20	File	xxxx-xxxx.x	predictive	Medio
21	File	xxxxxx.xxx	predictive	Medio
22	File	xxx-xxx/xxxxx_xxx_xxx	predictive	Alto
23	File	xxxxxx/xxx.x	predictive	Medio
24	File	xxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	Alto
25	File	xxxxxxxxx.xxx.xxx	predictive	Alto
26	File	xxxxx/xxxxx.xxx	predictive	Alto
27	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Alto
28	File	xxxx_xxxxx.xxx	predictive	Alto
29	File	xxxxx.xxx	predictive	Medio
30	File	xxxxxx.xxx	predictive	Medio
31	File	xx/xx-xx.x	predictive	Medio
32	File	xxx/xxxx_xxxx.x	predictive	Alto
33	File	xxxxxx/xxxxxxxxxxx	predictive	Alto
34	File	xxxx_xxxxxx.x	predictive	Alto
35	File	xxxx/xxxxxxx.x	predictive	Alto
36	File	xxx/xxxxxx.xxx	predictive	Alto
37	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	Alto
38	File	xxxxxxxx/xxxxx-xxxxxx-xxxx-xxxxxxx.xxx	predictive	Alto
39	File	xxxxxxxx/xxxxxxxx/xxxxx-xxxxxxxx-xxxxx.xxx	predictive	Alto
40	File	xxxxx.xxx	predictive	Medio
41	File	xxxxx.xxx?x=xxxxx&x=xxxxx&x=xxxxx	predictive	Alto
42	File	xxxxx.xxx?xxx=xxxx&xxx=xxxxxxxx	predictive	Alto
43	File	xxxxxxxxxx.xxx	predictive	Alto
44	File	xxxxxx_xxxx_xxxxxxx.xxx	predictive	Alto
45	File	xxxxx.xxx	predictive	Medio
46	File	xxxx/xxxxxxxxx/xxxxxx/xxxxxxxxxxxxxxxxxxxxx.xxx	predictive	Alto
47	File	xxxx.x	predictive	Bajo
48	File	xxx/xxx.xxx	predictive	Medio
49	File	xxx/xxxxx.xxxx	predictive	Alto
50	File	xxxx_xxxxxxx.xxx	predictive	Alto
51	File	xxx%xx.xxx	predictive	Medio
52	File	xxxxxx.x	predictive	Medio
53	File	xxxx.xxx	predictive	Medio
54	File	xxxxx.xxx	predictive	Medio
55	File	xxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]	predictive	Alto
56	File	xxxxxxxx.xxx	predictive	Medio
57	File	xxxxxxxx.xxx	predictive	Medio
58	File	xxxx.xxx	predictive	Medio
59	File	xxxxx/xxxxx.xxx	predictive	Alto
60	File	xxxxxxxx.xxx	predictive	Medio
61	File	xxxx-xxxxxxxx.xxx	predictive	Alto
62	File	xxxxxxxxx.xxx	predictive	Alto
63	File	xxxx.x	predictive	Bajo
64	File	xxxxxxxxxx	predictive	Medio
65	File	xxxxxxx/xxxxx.xxx	predictive	Alto
66	File	xxxxxx.xxx	predictive	Medio
67	File	xxx/xxxxxx/xxx/xxxxxxxxx.xxx	predictive	Alto
68	Library	xxxxx.xxx	predictive	Medio
69	Argument	xx/xx	predictive	Bajo
70	Argument	xxxxxx	predictive	Bajo
71	Argument	xxxxxxx_xxxx	predictive	Medio
72	Argument	xxxxxx_xxxx	predictive	Medio
73	Argument	xxxxxxxx	predictive	Medio
74	Argument	xxx	predictive	Bajo
75	Argument	xxxxxxxxxxxxxxxxx	predictive	Alto
76	Argument	xxxxx	predictive	Bajo
77	Argument	xxxxxxxxxxx/xxxxxxxx/xxx/xxxxx	predictive	Alto
78	Argument	xxxxxx_xx	predictive	Medio
79	Argument	xxxx	predictive	Bajo
80	Argument	xxxxxx	predictive	Bajo
81	Argument	xxxx	predictive	Bajo
82	Argument	xxxx	predictive	Bajo
83	Argument	xx	predictive	Bajo
84	Argument	xxxxx_xxxx	predictive	Medio
85	Argument	xxxxxxxx[xx]	predictive	Medio
86	Argument	xxx	predictive	Bajo
87	Argument	xxxxxxx	predictive	Bajo
88	Argument	xxxx/xxx_xxxxxxxxx	predictive	Alto
89	Argument	xxx_xxxx	predictive	Medio
90	Argument	xxxx_xxxxx	predictive	Medio
91	Argument	xxxxxxxx	predictive	Medio
92	Argument	xxxx_xxxx	predictive	Medio
93	Argument	xx	predictive	Bajo
94	Argument	xxxxxxx/xxxxx	predictive	Alto
95	Argument	xxxxxxxxxx	predictive	Medio
96	Argument	xxxxxx_xxx	predictive	Medio
97	Argument	xxxx_xxxxxx	predictive	Medio
98	Argument	xxxx_xx	predictive	Bajo
99	Argument	xxxxxxxx_xxxxxxxx	predictive	Alto
100	Argument	xxx_xxxx[x][]	predictive	Alto
101	Argument	xxxxxxxxxxxxxxxxxxxxx	predictive	Alto
102	Argument	xxxx_xx	predictive	Bajo
103	Argument	xxx	predictive	Bajo
104	Argument	xxx	predictive	Bajo
105	Argument	xxxx	predictive	Bajo
106	Argument	xxxxxxxx	predictive	Medio
107	Argument	xxxxxxxx	predictive	Medio
108	Argument	xxxx/xx/xxxx/xxx	predictive	Alto
109	Input Value	.%xx.../.%xx.../	predictive	Alto
110	Input Value	../../../../../xxx/xxx/xxxxx/xxxx/xxxxxxxx/xxxxx/xxx.xxx	predictive	Alto
111	Input Value	xxxxxxx -xxx	predictive	Medio
112	Input Value	xxxxxxxxxx	predictive	Medio
113	Network Port	xxxx	predictive	Bajo
114	Network Port	xxxx	predictive	Bajo
115	Network Port	xxxx xxxx	predictive	Medio
116	Network Port	xxx/xxx	predictive	Bajo
117	Network Port	xxx/xxx	predictive	Bajo
118	Network Port	xxx/xxxx	predictive	Medio

Referencias (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!