ActionRAT Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (76)

Langue

en	56
de	16
ru	2
it	2

De campagne

us	30
de	14
ca	4

Acteurs

Cobalt Strike	2
ActionRAT	1
Venom RAT	1
njRAT	1

Intérêt

Taper

Not Defined	22
Learning Management Software	6
Virtualization Software	4
Content Management System	4
Packet Analyzer Software	4

Fournisseur

Not Defined	32
IBM	4
Linux Foundation	4
MIT	2
Omron	2

Produit

Moodle	6
Play Framework	6
Linux Foundation Xen	4
tcpdump	4
Joplin	2

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgation de l'information	5.3	5.2	$5k-$25k	Calculateur	High	Workaround	0.02016	0.00	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php elévation de privilèges	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.59	CVE-2010-0966
3	Tiki Admin Password tiki-login.php authentification faible	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	3.14	CVE-2020-15906
4	Joomla CMS com_easyblog sql injection	6.3	6.1	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00000	0.20
5	Michael Salzer Guestbox gbshow.php cross site scripting	4.3	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.04283	0.02	CVE-2006-0860
6	DolphinPHP User Management Page cross site scripting	3.5	3.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00053	0.08	CVE-2022-1086
7	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	4.04
8	vu Mass Mailer Login Page redir.asp sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00238	0.04	CVE-2007-6138
9	Mozilla Firefox/Thunderbird SetOffsets dénie de service	7.5	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.09052	0.00	CVE-2013-1677
10	IBM InfoSphere Master Data Management cross site scripting	3.5	3.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00063	0.00	CVE-2015-1968
11	IBM Rational Collaborative Lifecycle Management Jazz Foundation cross site scripting	3.5	3.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00063	0.00	CVE-2015-0130
12	McAfee ePolicy Orchestrator cross site scripting	4.3	4.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00192	0.02	CVE-2015-4559
13	Moodle configonlylib.php min_get_slash_argument directory traversal	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00177	0.02	CVE-2015-1493
14	WordPress Shortcodes/Post Content elévation de privilèges	6.3	5.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.14163	0.00	CVE-2013-0235
15	Moodle Contacts/Messages divulgation de l'information	5.3	4.6	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00124	0.00	CVE-2015-2266
16	Moodle mdeploy.php elévation de privilèges	6.3	5.5	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00112	0.05	CVE-2015-2267
17	Moodle Regular Expression dénie de service	5.3	4.6	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00282	0.00	CVE-2015-2268
18	Adobe Flash Player buffer overflow	10.0	8.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.03041	0.00	CVE-2015-0342
19	WhatsApp Messenger Profile Image divulgation de l'information	5.3	5.0	$5k-$25k	$0-$5k	Proof-of-Concept	Unavailable	0.00000	0.02
20	Linux Foundation Xen GIC Logging Rate Limit dénie de service	4.0	3.8	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00062	0.02	CVE-2015-1563

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Identified	Taper	Confiance
1	144.91.65.100	vmi652772.contaboserver.net	ActionRAT	07/09/2021	verified	Élevé
2	XXX.XX.XX.XXX	xxxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxxxx	07/09/2021	verified	Élevé
3	XXX.XXX.XX.XX	xxx.xxx.xx.xx.xxxxx.xxx	Xxxxxxxxx	07/09/2021	verified	Moyen
4	XXX.XXX.XXX.XXX	xxxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxxxx	07/09/2021	verified	Élevé

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classe	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Élevé
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Élevé
3	TXXXX	CAPEC-242	CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	Élevé
4	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Élevé
5	TXXXX	CAPEC-19	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
6	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
8	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
9	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
10	TXXXX	CAPEC-157	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Élevé

IOA - Indicator of Attack (37)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/forum/away.php	predictive	Élevé
2	File	/wordpress/wp-admin/admin.php	predictive	Élevé
3	File	admin/index.php	predictive	Élevé
4	File	books.php	predictive	Moyen
5	File	data/gbconfiguration.dat	predictive	Élevé
6	File	xxxxxx.xxx	predictive	Moyen
7	File	xxxxxx.xxx	predictive	Moyen
8	File	xxxxxxxxx.xxx	predictive	Élevé
9	File	xxx/xxxxxx.xxx	predictive	Élevé
10	File	xxx/xxxx/xxx.x/xxxx_xxxxxx.x	predictive	Élevé
11	File	xxxxx.xxx	predictive	Moyen
12	File	xxxxxxx.xxx	predictive	Moyen
13	File	xxxxxxxxx/xxxx-xxxx	predictive	Élevé
14	File	xxxx.xxx	predictive	Moyen
15	File	xxxxx/xxxxxxx/	predictive	Élevé
16	File	xxxxxx.xxx	predictive	Moyen
17	File	xxxxx.xxx	predictive	Moyen
18	File	xxxxxxxx.xxx	predictive	Moyen
19	File	xxxxxxxx_xxxx.xxx	predictive	Élevé
20	File	xxxxxxxxxxxxxx.xxx	predictive	Élevé
21	File	xxxxx.xxx	predictive	Moyen
22	File	xxxx-xxxxx.xxx	predictive	Élevé
23	Library	xxx/xxxxxxxxxxxxx.xxx	predictive	Élevé
24	Argument	xxxxxxxx	predictive	Moyen
25	Argument	xxxxxx	predictive	Faible
26	Argument	xxxxxxx	predictive	Faible
27	Argument	xxxx	predictive	Faible
28	Argument	xxxxxxxx	predictive	Moyen
29	Argument	xx	predictive	Faible
30	Argument	xxxxxxxxxx	predictive	Moyen
31	Argument	xxxxxxxx	predictive	Moyen
32	Argument	xxxxxx	predictive	Faible
33	Argument	xxxxxxxx	predictive	Moyen
34	Argument	xxxxxxx_xx	predictive	Moyen
35	Argument	xxxxxxx	predictive	Faible
36	Argument	xxxx	predictive	Faible
37	Argument	xxxxx	predictive	Faible

Références (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Do you know our Splunk app?

Download it now for free!