Gallmaker Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (251)

Langue

en	196
zh	44
ru	6
pl	4
de	2

De campagne

la	212
us	14
cn	2

Acteurs

Cobalt Strike	11
Ave Maria	8
AsyncRAT	5
RedLine Stealer	4
Remcos	4

Intérêt

Taper

Not Defined	106
Content Management System	16
Groupware Software	10
Programming Language Software	8
Operating System	8

Fournisseur

Not Defined	112
Microsoft	14
Apache	8
Revive	6
Cisco	4

Produit

Revive Adserver	6
Microsoft Exchange Server	6
Moodle	6
Apache Airflow	4
Adobe ColdFusion	4

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	TikiWiki tiki-register.php elévation de privilèges	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01009	2.39	CVE-2006-6168
2	Tiki Admin Password tiki-login.php authentification faible	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	3.98	CVE-2020-15906
3	Drupal Sanitization API cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00056	0.02	CVE-2020-13672
4	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	3.05
5	LiteSpeed Cache Plugin Shortcode cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00051	0.03	CVE-2023-4372
6	WebTitan Appliance Extensions Persistent cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
7	ipTIME NAS-I Bulletin Manage elévation de privilèges	7.1	7.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00988	0.03	CVE-2020-7847
8	request-baskets API Request {name} elévation de privilèges	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.08109	0.00	CVE-2023-27163
9	DZCP deV!L`z Clanportal config.php elévation de privilèges	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.17	CVE-2010-0966
10	PHP phpinfo cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02101	0.05	CVE-2007-1287
11	nginx elévation de privilèges	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	5.53	CVE-2020-12440
12	Microsoft Windows Scripting Engine Remote Code Execution	5.9	5.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.37113	0.00	CVE-2021-34480
13	DevExpress ASP.NET Web Forms ASPxHttpHandlerModule DXR.axd elévation de privilèges	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00183	0.09	CVE-2022-41479
14	Basilix Webmail login.php3 elévation de privilèges	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.02
15	JoomlaTune Com Jcomments admin.jcomments.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00489	0.04	CVE-2010-5048
16	Microsoft Office Remote Code Execution	7.0	6.1	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00169	0.00	CVE-2023-21735
17	Alt-N MDaemon Worldclient elévation de privilèges	4.9	4.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00090	0.06	CVE-2021-27182
18	CouchCMS mysql2i.func.php Path divulgation de l'information	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	0.02	CVE-2019-1010042
19	Esri ArcGIS Server sql injection	8.1	8.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00123	0.04	CVE-2021-29114
20	Shenzhen Yunni Technology iLnkP2P UID Generator Random chiffrement faible	7.7	7.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00176	0.03	CVE-2019-11219

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Identified	Taper	Confiance
1	94.140.116.124		Gallmaker	17/12/2020	verified	Élevé
2	XX.XXX.XXX.XXX		Xxxxxxxxx	17/12/2020	verified	Élevé
3	XXX.XX.XXX.XX	xxxxxxx.xxxxx.xx	Xxxxxxxxx	17/12/2020	verified	Élevé

TTP - Tactics, Techniques, Procedures (19)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1006	CWE-21, CWE-22, CWE-24	Path Traversal	predictive	Élevé
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Élevé
3	T1059	CWE-88, CWE-94, CWE-1321	Argument Injection	predictive	Élevé
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Élevé
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Élevé
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Élevé
8	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
9	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Élevé
10	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Élevé
11	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
12	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Élevé
13	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
14	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
15	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
16	TXXXX.XXX	CWE-XX	Xxxxxxxxxxxxx	predictive	Élevé
17	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Élevé
18	TXXXX.XXX	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Élevé
19	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Élevé

IOA - Indicator of Attack (140)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/admin/dl_sendmail.php	predictive	Élevé
2	File	/adminPage/conf/reload	predictive	Élevé
3	File	/api/baskets/{name}	predictive	Élevé
4	File	/api/v2/cli/commands	predictive	Élevé
5	File	/Device/Device/GetDeviceInfoList?deviceCode=&searchField=&deviceState=	predictive	Élevé
6	File	/DXR.axd	predictive	Moyen
7	File	/forum/away.php	predictive	Élevé
8	File	/mfsNotice/page	predictive	Élevé
9	File	/novel/bookSetting/list	predictive	Élevé
10	File	/novel/userFeedback/list	predictive	Élevé
11	File	/owa/auth/logon.aspx	predictive	Élevé
12	File	/spip.php	predictive	Moyen
13	File	/x_portal_assemble_surface/jaxrs/portal/list?v=8.2.3-4-43f4fe3	predictive	Élevé
14	File	/zm/index.php	predictive	Élevé
15	File	adclick.php	predictive	Moyen
16	File	admin.cropcanvas.php	predictive	Élevé
17	File	xxxxx.xxxxxxxxx.xxx	predictive	Élevé
18	File	xxxxxxxxxxx/xxxxxxx/xxxxx/xxxxx/xxxxxxxxx/xxxxxxxx.xxx	predictive	Élevé
19	File	xxxx/xxxxxxxxxxxx.xxx	predictive	Élevé
20	File	xxxx.xxx	predictive	Moyen
21	File	xx_xxxx_xx_xxxx_xxxx.xxx	predictive	Élevé
22	File	xxxxxxx.x	predictive	Moyen
23	File	xxxx_xxxxxxx.xxx	predictive	Élevé
24	File	xxx-xxx/xxxxx	predictive	Élevé
25	File	xxxxx.xxx	predictive	Moyen
26	File	xxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxx/xxxx_xxxxx.xxxx	predictive	Élevé
27	File	xxxxx-xxxxxxx.xxx	predictive	Élevé
28	File	xxxxxxxxxx/xxx_xxxxxxxxxx/xxxxxxx/xxxxxxxxxx.xxx	predictive	Élevé
29	File	xxxxxxxxxx\xxxx.xxx	predictive	Élevé
30	File	xxxxxxxxxxx.xxx	predictive	Élevé
31	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Élevé
32	File	xx.xxx	predictive	Faible
33	File	xxxxxxx/xxx/xxxxxxxx/xxxxxx/xxxxxxx.x	predictive	Élevé
34	File	xxxx-xxxxxx.xxx	predictive	Élevé
35	File	xxxxxxxxxxx.xxxxx.xxx	predictive	Élevé
36	File	xxxx.xxx	predictive	Moyen
37	File	xxxxx_xxxx.xxx	predictive	Élevé
38	File	xxxxxxxxxx\xxxxxx\xxxxxxxxxxxxx.xxx	predictive	Élevé
39	File	xxx/xxxxxx.xxx	predictive	Élevé
40	File	xxxxxxxx/xxxxxxx/xxxxxxx.xxxx.xxx	predictive	Élevé
41	File	xxxxx.xxxx	predictive	Moyen
42	File	xxxxx.xxx	predictive	Moyen
43	File	xxxxx.xxx/xxxxxx.xxx/xxxxxxxxxxxxx.xxx/xxxxxxxx.xxx	predictive	Élevé
44	File	xxxxx.xxx?x=xxxx&x=xxxx&x=xx_xxx_xxxxxx	predictive	Élevé
45	File	xxxxx.xxx?x=xxxx&x=xxxxxxx&x=xxx	predictive	Élevé
46	File	xxxx_xxxxxxx.xxx	predictive	Élevé
47	File	xxxxx.xxxx	predictive	Moyen
48	File	xxxxx.xxx	predictive	Moyen
49	File	xxxx.xxxx	predictive	Moyen
50	File	xxxxxxxxx.x	predictive	Moyen
51	File	xx_xxxx.x	predictive	Moyen
52	File	xxx/xxxx/xxxx_xxxxxxxxx.x	predictive	Élevé
53	File	xxxxxxx_xxxx.xxx	predictive	Élevé
54	File	xxxxxxxxxxxxxxxxx.xxx	predictive	Élevé
55	File	xxxxxxx.xxx	predictive	Moyen
56	File	xxxxxxxxxxxxxx.xxx	predictive	Élevé
57	File	xxxxxxxxxx_xxxxxxxxx.xxx	predictive	Élevé
58	File	xxxxxxx/xxxxxxx/xxx/xxxxxxxxxx.xxx?xxxxxxxx=xxxx&xxxxxx=xxxxxxxxxx	predictive	Élevé
59	File	xxxxxx/xxx/xxxxxxxx/xxxxx/xxxxx_xxxx.xx	predictive	Élevé
60	File	xxxx/xxxxxxxxxxxxxx/xxxx_xxxxxxx.x	predictive	Élevé
61	File	xxxx_xxxx_xxxxxx.xxx	predictive	Élevé
62	File	xxxxxxx_xxxxxx.xxx	predictive	Élevé
63	File	xxxx_xxxxx.xxxx	predictive	Élevé
64	File	xxxxxxxxxx_xxxx.xxx	predictive	Élevé
65	File	xxx/xxxx/xxxx	predictive	Élevé
66	File	xxxxxx\xxxxxxxx\xx_xxxxx_xxxxxxx.xxx	predictive	Élevé
67	File	xxxxxxx.xxx.xx.xxxxxxxxxxx.xxx	predictive	Élevé
68	File	xxxxxxxxx/xxxxxxxx.xxx	predictive	Élevé
69	File	xxxx_xxxxxx.xx	predictive	Élevé
70	File	xxxx-xxxxx.xxx	predictive	Élevé
71	File	xxxx-xxxxxxxx.xxx	predictive	Élevé
72	File	xxxxxxxxx.xxx	predictive	Élevé
73	File	xxxxxx_xxxxx.xxx	predictive	Élevé
74	File	xxxxxx.xxx	predictive	Moyen
75	File	xxxxxxx-xxxxx.xxx	predictive	Élevé
76	File	xxxx_xxxxx.xxx	predictive	Élevé
77	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	Élevé
78	File	xxxx.xxx	predictive	Moyen
79	File	xx-xxxxx-xxxxxx.xxx	predictive	Élevé
80	File	xx-xxxxxxxx/xxxxxxxxx.xxx	predictive	Élevé
81	File	xxx/xxxxxxxx/xxxxxxxx.xxx	predictive	Élevé
82	File	xxxx.xxx	predictive	Moyen
83	File	~/xxx/xxxx-xxxxxxxxx.xxx	predictive	Élevé
84	File	~/xxxxxxxx/xxxxx-xx-xxxxxxxxxx-xxxxxxxxx.xxx	predictive	Élevé
85	Library	xxxxxxx/xxx.xxx.xxx.xxx	predictive	Élevé
86	Argument	xxx_xxx	predictive	Faible
87	Argument	xxxx	predictive	Faible
88	Argument	xxxxxxxxx	predictive	Moyen
89	Argument	xxxxxxxx	predictive	Moyen
90	Argument	xxx_xxx_xx_xxx_xxxxxxxxxx_x	predictive	Élevé
91	Argument	xxxxx_xxxx	predictive	Moyen
92	Argument	xxxx_xxx_xxxx	predictive	Élevé
93	Argument	xxxxxxxxxx	predictive	Moyen
94	Argument	xxx	predictive	Faible
95	Argument	xxxxxxxxxxxxxxx	predictive	Élevé
96	Argument	xxxxxxxxxxxx	predictive	Moyen
97	Argument	xxxx	predictive	Faible
98	Argument	xxxxxxxxx_xxxxxx	predictive	Élevé
99	Argument	xxxxxxxxx	predictive	Moyen
100	Argument	xx_xxxxxxx	predictive	Moyen
101	Argument	xxxx	predictive	Faible
102	Argument	xxxxxxxx	predictive	Moyen
103	Argument	xxxxx	predictive	Faible
104	Argument	xxxxxx_xxxxx	predictive	Moyen
105	Argument	xx_xx	predictive	Faible
106	Argument	xxxxxxx[xxxxxxx]	predictive	Élevé
107	Argument	xxxxxxx	predictive	Faible
108	Argument	xxxxxx	predictive	Faible
109	Argument	xxxxx	predictive	Faible
110	Argument	xx	predictive	Faible
111	Argument	xxx	predictive	Faible
112	Argument	xxxx	predictive	Faible
113	Argument	xxxx	predictive	Faible
114	Argument	xxx xxxxxxxx/xxxxxxx xxxxxxxx	predictive	Élevé
115	Argument	xxxxxxxx	predictive	Moyen
116	Argument	xxxxxx/xxxxx/xxxx	predictive	Élevé
117	Argument	xxxxxxx	predictive	Faible
118	Argument	xxxx	predictive	Faible
119	Argument	xxxxxx_xxxxxx	predictive	Élevé
120	Argument	xxx	predictive	Faible
121	Argument	xxxxxxxx_xx	predictive	Moyen
122	Argument	xxxxxx_xxxxx	predictive	Moyen
123	Argument	xxxxxx	predictive	Faible
124	Argument	xxxx_xxxx	predictive	Moyen
125	Argument	xxxx	predictive	Faible
126	Argument	xxxxxx	predictive	Faible
127	Argument	xxxxxxx	predictive	Faible
128	Argument	xxx	predictive	Faible
129	Argument	xxxxx	predictive	Faible
130	Argument	xxxxx/xxx	predictive	Moyen
131	Argument	xxxx_xx	predictive	Faible
132	Argument	xxx	predictive	Faible
133	Argument	xxxxxxxx	predictive	Moyen
134	Argument	xxx:xxxx	predictive	Moyen
135	Argument	_xxx_xxxxxxxxxxx_	predictive	Élevé
136	Input Value	xxxxxxxxx' xxx 'x'='x	predictive	Élevé
137	Input Value	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx	predictive	Élevé
138	Pattern	\|xx xx xx xx\|	predictive	Élevé
139	Network Port	xxxxx	predictive	Faible
140	Network Port	xxx/xxxx	predictive	Moyen

Références (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Do you know our Splunk app?

Download it now for free!