VBREVSHELL Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (126)

Idioma

en	118
zh	8

País

us	92
cn	18
br	2
nl	2
gb	2

Actores

VBREVSHELL	5
Cobalt Strike	3
HyperBro	1

Interesar

Escribe

Not Defined	8
Router Operating System	4
Web Server	4
Operating System	2
Unified Communication Software	2

Proveedor

Not Defined	12
Cisco	6
Microsoft	4
Palo Alto	2
Goahead	2

Producto

Microsoft Windows	2
Cisco Packaged Contact Center Enterprise	2
Cisco Unified Communications Manager	2
Cisco Unified Communications Manager IM & Presence ...	2
Cisco Unified Communications Manager Session Manag ...	2

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	Responsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit cross site scripting	3.2	3.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00127	0.00	CVE-2018-25085
2	Microsoft Windows NetBIOS WinNuke denegación de servicio	7.5	7.2	$25k-$100k	$0-$5k	High	Official Fix	0.00304	0.03	CVE-1999-0153
3	jforum User escalada de privilegios	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00289	0.06	CVE-2019-7550
4	python-django escalada de privilegios	7.6	7.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00209	0.37	CVE-2023-31047
5	Palo Alto PAN-OS Web Interface escalada de privilegios	7.2	7.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00182	0.02	CVE-2021-3050
6	Cisco Packaged Contact Center Enterprise escalada de privilegios	9.9	9.8	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00162	0.04	CVE-2024-20253
7	Paddle denegación de servicio	5.5	5.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00046	0.04	CVE-2023-38677
8	DolphinPHP Incomplete Fix CVE-2021-46097 common.php escalada de privilegios	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01283	0.06	CVE-2023-0935
9	PbootCMS GET Request sql injection	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00109	0.05	CVE-2021-37497
10	October CMS Admin Panel escalada de privilegios	5.8	5.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00090	0.06	CVE-2022-35944
11	WordPress cross site scripting	4.3	4.1	$5k-$25k	$0-$5k	High	Official Fix	0.00192	0.00	CVE-2008-2068
12	Microsoft IIS cross site scripting	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.06	CVE-2017-0055
13	Goahead Web Server Multi-Part Request desbordamiento de búfer	9.0	8.9	$0-$5k	$0-$5k	Not Defined	Workaround	0.47818	0.04	CVE-2019-5096
14	Bitcoin wallet.dat AES Encryption Padding cifrado débil	7.1	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.11
15	QNAP QTS Helpdesk escalada de privilegios	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00274	0.03	CVE-2018-0714
16	Linux Kernel Call tcp_collapse_ofo_queue escalada de privilegios	6.4	6.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.78302	0.04	CVE-2018-5390
17	Cisco Linksys Router tmUnblock.cgi escalada de privilegios	9.8	9.2	$25k-$100k	$0-$5k	High	Workaround	0.00000	0.04
18	AVTECH IP Camera/NVR/DVR PwdGrp.cgi escalada de privilegios	9.8	9.2	$5k-$25k	$0-$5k	High	Unavailable	0.00000	0.00
19	vBulletin redirector.php Redirect	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00106	0.32	CVE-2018-6200
20	Google Android Ashmem desbordamiento de búfer	6.5	5.9	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00101	0.03	CVE-2017-13216

IOC - Indicator of Compromise (12)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Identified	Escribe	Confianza
1	8.134.126.121		VBREVSHELL	2024-04-01	verified	Alto
2	27.124.47.147		VBREVSHELL	2023-10-15	verified	Alto
3	45.77.250.196	45.77.250.196.vultrusercontent.com	VBREVSHELL	2023-11-29	verified	Alto
4	XX.XXX.XXX.XX		Xxxxxxxxxx	2023-10-21	verified	Alto
5	XX.XXX.XXX.XX		Xxxxxxxxxx	2023-11-03	verified	Alto
6	XX.XX.XX.XX		Xxxxxxxxxx	2023-11-29	verified	Alto
7	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxxxxxxxx	2024-03-09	verified	Alto
8	XXX.XXX.XXX.XX	xxx-xxx-xxx-xxx-xx.xxxxxxx.xxxxxxxx-xxx.xxx	Xxxxxxxxxx	2023-10-29	verified	Alto
9	XXX.XXX.XXX.XX		Xxxxxxxxxx	2023-11-10	verified	Alto
10	XXX.XXX.XXX.XX		Xxxxxxxxxx	2023-10-15	verified	Alto
11	XXX.XXX.XX.XXX		Xxxxxxxxxx	2023-10-15	verified	Alto
12	XXX.XX.XX.XXX	xxx-xx-xx-xxx-xxxxxxxxx.xxxxxxxx.xxx	Xxxxxxxxxx	2023-10-15	verified	Alto

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Clase	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Alto
2	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	Alto
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
4	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
5	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
6	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
8	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	Alto
9	TXXXX	CAPEC-157	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto
10	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (15)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	/cgi-bin/supervisor/PwdGrp.cgi	predictive	Alto
2	File	/uncpath/	predictive	Medio
3	File	common.php	predictive	Medio
4	File	xxxxxxxxxx.xxx	predictive	Alto
5	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	Alto
6	File	xxxxxxxxxx_xxxxx.xxxxxx	predictive	Alto
7	File	xxxxx.xxx	predictive	Medio
8	File	xxxxxxxxx.xxx	predictive	Alto
9	File	xxxxxx.xxx	predictive	Medio
10	Argument	xxxxx.xxxxxxxxx/xxxxx.xxxxxxxxxx	predictive	Alto
11	Argument	xx	predictive	Bajo
12	Argument	xxxxxxxx	predictive	Medio
13	Argument	xxxx_xx	predictive	Bajo
14	Argument	xxx	predictive	Bajo
15	Network Port	xxx/xxxx	predictive	Medio

Referencias (13)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!