Arid Viper Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (400)

Langue

en	364
de	14
ru	12
pl	8
fr	2

De campagne

us	356
de	14
ru	12
pl	8
ir	4

Acteurs

Arid Viper	8
RecordBreaker	2
Vidar	2
Desert Falcons	2
Socks5 Systemz	1

Intérêt

Taper

Not Defined	22
Programming Language Software	8
Content Management System	8
Web Server	6
Web Browser	4

Fournisseur

Not Defined	38
Oracle	4
Google	2
Facebook	2
Phplivesupport.	2

Produit

OpenSSH	4
nginx	4
systemd	2
Google Chrome	2
jQuery	2

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	jforum User elévation de privilèges	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00289	0.06	CVE-2019-7550
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgation de l'information	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
3	DZCP deV!L`z Clanportal config.php elévation de privilèges	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.10	CVE-2010-0966
4	Dreaxteam Xt-News add_comment.php cross site scripting	4.3	4.2	$0-$5k	$0-$5k	High	Unavailable	0.00599	0.07	CVE-2006-6746
5	Enigma2 Coppermine Bridge e2_header.inc.php elévation de privilèges	9.8	9.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.10026	0.00	CVE-2006-6864
6	IBM WebSphere Service Registry/Repository Access Restriction elévation de privilèges	4.3	4.1	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00162	0.00	CVE-2014-6160
7	Big Webmaster Big Webmaster Guestbook Script addguest.cgi cross site scripting	4.3	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00615	0.04	CVE-2006-2231
8	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	4.16
9	Joomla CMS remember.php elévation de privilèges	5.4	4.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.03044	0.00	CVE-2013-3242
10	Joomla CMS Media Manager directory traversal	8.5	8.2	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.90167	0.04	CVE-2019-10945
11	Pligg cloud.php sql injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.55
12	Apple macOS authentification faible	5.6	5.4	$5k-$25k	$0-$5k	High	Official Fix	0.02181	0.02	CVE-2023-41991
13	Oracle Java SE JSSE vulnérabilité inconnue	7.4	7.2	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00111	0.06	CVE-2023-21930
14	ICQ fetch elévation de privilèges	10.0	9.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00346	0.00	CVE-2011-0487
15	WebP Converter for Media Plugin passthru.php Redirect	4.9	4.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00106	0.04	CVE-2021-25074
16	CasaOS API elévation de privilèges	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01187	0.04	CVE-2022-24193
17	jQuery cross site scripting	4.3	3.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00306	0.03	CVE-2011-4969
18	Oracle Retail Central Office Security cross site scripting	6.2	6.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00384	0.02	CVE-2021-41184
19	InsydeH2O SMM HandleProtocol dénie de service	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2021-41839
20	PHP zip Extension php_zip.c buffer overflow	9.8	9.3	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.06326	0.03	CVE-2016-5773

Campagnes (1)

These are the campaigns that can be associated with the actor:

Hamas

IOC - Indicator of Compromise (18)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Campagnes	Identified	Taper	Confiance
1	54.255.143.112	ec2-54-255-143-112.ap-southeast-1.compute.amazonaws.com	Arid Viper		24/12/2020	verified	Moyen
2	91.199.147.84	s726618.srvape.com	Arid Viper	Hamas	30/10/2023	verified	Élevé
3	94.131.98.3	stockdc1.com	Arid Viper	Hamas	30/10/2023	verified	Élevé
4	95.164.18.204	vm1554543.stark-industries.solutions	Arid Viper	Hamas	30/10/2023	verified	Élevé
5	XX.XXX.XX.XX	xxxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxxx Xxxxx	Xxxxx	30/10/2023	verified	Élevé
6	XXX.XX.XXX.XX	xxxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxxx Xxxxx	Xxxxx	30/10/2023	verified	Élevé
7	XXX.XX.XXX.XX	xxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxxx Xxxxx	Xxxxx	30/10/2023	verified	Élevé
8	XXX.XXX.XX.XX	xx.xx.xxx.xxx.xxxxxxxxxx.xxx.xxxxxxxxx.xxx	Xxxx Xxxxx		24/12/2020	verified	Élevé
9	XXX.XX.XX.XXX		Xxxx Xxxxx	Xxxxx	30/10/2023	verified	Élevé
10	XXX.XX.XXX.XXX	xxx.xxxxxxxx.xxx	Xxxx Xxxxx	Xxxxx	30/10/2023	verified	Élevé
11	XXX.XXX.XXX.XX	xxxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxxx Xxxxx	Xxxxx	30/10/2023	verified	Élevé
12	XXX.XXX.XXX.XX	xxxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxxx Xxxxx	Xxxxx	30/10/2023	verified	Élevé
13	XXX.XX.XX.XXX	xxxxxx.xxx.xx.xx.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxx Xxxxx		24/12/2020	verified	Élevé
14	XXX.XX.XX.XXX	xxxxxxxxx.xxx.xx	Xxxx Xxxxx		24/12/2020	verified	Élevé
15	XXX.XXX.XXX.XX	xxx.xxxxxxxxx.xxx	Xxxx Xxxxx		24/12/2020	verified	Élevé
16	XXX.X.XX.XXX	xxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxxx Xxxxx	Xxxxx	30/10/2023	verified	Élevé
17	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxx.xxxxxxxxxxxx.xx	Xxxx Xxxxx		24/12/2020	verified	Élevé
18	XXX.XXX.XXX.X	xxxxxx.xxxxxxxxxxxxx.xxx	Xxxx Xxxxx		24/12/2020	verified	Élevé

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1006	CWE-22	Path Traversal	predictive	Élevé
2	T1059	CWE-94	Argument Injection	predictive	Élevé
3	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Élevé
4	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
5	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Élevé
6	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
7	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Élevé
8	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
9	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
10	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé

IOA - Indicator of Attack (50)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/forum/away.php	predictive	Élevé
2	File	addguest.cgi	predictive	Moyen
3	File	add_comment.php	predictive	Élevé
4	File	admin/index.php	predictive	Élevé
5	File	api_jsonrpc.php	predictive	Élevé
6	File	cloud.php	predictive	Moyen
7	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Élevé
8	File	xx_xxxxxx.xxx.xxx	predictive	Élevé
9	File	xxxxxx/xxx/xxxxxxx.xxx	predictive	Élevé
10	File	xxxxx.xxx	predictive	Moyen
11	File	xxxxx/xxxxx_xxxxx_x	predictive	Élevé
12	File	xxxxxx.x	predictive	Moyen
13	File	xx.xxx	predictive	Faible
14	File	xxxx/xxx_xxxx_xxxxx.x	predictive	Élevé
15	File	xxx/xxxxxx.xxx	predictive	Élevé
16	File	xxxxx.xxx	predictive	Moyen
17	File	xxxxxxxxxxx.xxx	predictive	Élevé
18	File	xxxxxx/xxxxxx/xxxx.x	predictive	Élevé
19	File	xxxxxxxx.xxx	predictive	Moyen
20	File	xxxxxxx_xxx.xxx	predictive	Élevé
21	File	xxxxx/xxxxx.xxx.xxx	predictive	Élevé
22	File	xxxxxxxx.xxx	predictive	Moyen
23	File	xxx_xxx.x	predictive	Moyen
24	File	xxxxxxx/xxxxxx/xxxxxxxx/xxxxxxxx.xxx	predictive	Élevé
25	File	xxxxxxxxxxxx.xxx	predictive	Élevé
26	File	xxxxx/xxxxxxxxxxx/xxxxx.xxx	predictive	Élevé
27	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	Élevé
28	File	xxx.x	predictive	Faible
29	File	xxxx-xxxx.x	predictive	Moyen
30	File	xxxxx/xxxxxxxx.xxx	predictive	Élevé
31	File	xx/xx/xxxxx	predictive	Moyen
32	Argument	xxxxxxxx	predictive	Moyen
33	Argument	xxxxxxxx	predictive	Moyen
34	Argument	xxxxxxxxxx	predictive	Moyen
35	Argument	xxxxxxxxxxxx/xxxxxxx	predictive	Élevé
36	Argument	xxxx/xxxx	predictive	Moyen
37	Argument	xxxxxxxxx	predictive	Moyen
38	Argument	xxxx_xxx	predictive	Moyen
39	Argument	xxxxxx	predictive	Faible
40	Argument	xxxxxxxxxxx	predictive	Moyen
41	Argument	xxx_xxxx_xxxxxxxx	predictive	Élevé
42	Argument	xxxxx xxxx/xxxx xxxx	predictive	Élevé
43	Argument	xxxxxx	predictive	Faible
44	Argument	xx	predictive	Faible
45	Argument	xx_xxxx	predictive	Faible
46	Argument	xxxx_xxx	predictive	Moyen
47	Argument	xxxxxxxx	predictive	Moyen
48	Argument	xxxxxxx_xxxxx_xxxxx_xxxxxxx=xxxxx	predictive	Élevé
49	Argument	xxxxxxxx_xxx	predictive	Moyen
50	Argument	xxx	predictive	Faible

Références (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!