Koobface Analyse

IOB - Indicator of Behavior (156)

Chronologie

Langue

en142
de4
es4
pl2
fr2

De campagne

us64
il44
gr14
se6
gb4

Acteurs

Activités

Intérêt

Chronologie

Taper

Fournisseur

Produit

Apache HTTP Server8
Oracle Database6
Microsoft IIS6
Apple iOS4
nginx4

Vulnérabilités

#VulnérabilitéBaseTemp0dayAujourd'huiExpConEPSSCTICVE
1Joomla CMS com_easyblog sql injection6.36.1$5k-$25k$5k-$25kNot DefinedNot Defined0.000000.24
2Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.005480.14CVE-2017-0055
3OpenBB read.php sql injection7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.002500.04CVE-2005-1612
4DZCP deV!L`z Clanportal config.php elévation de privilèges7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.009431.19CVE-2010-0966
5SPIP spip.php cross site scripting3.53.4$0-$5k$0-$5kNot DefinedOfficial Fix0.001320.43CVE-2022-28959
6TikiWiki tiki-register.php elévation de privilèges7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.010092.47CVE-2006-6168
7Francisco Burzi PHP-Nuke File case.filemanager.php elévation de privilèges5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.005750.00CVE-2001-0854
8lighttpd Log File http_auth.c elévation de privilèges7.57.1$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.011230.04CVE-2015-3200
9OpenSSH Authentication Username divulgation de l'information5.34.8$5k-$25k$0-$5kHighOfficial Fix0.107370.14CVE-2016-6210
10Signal App RTLO elévation de privilèges6.36.0$0-$5k$0-$5kNot DefinedOfficial Fix0.003060.03CVE-2022-28345
11Cryptshare Server Delete Personal Data Page cross site scripting4.84.6$0-$5k$0-$5kNot DefinedOfficial Fix0.000840.00CVE-2021-3150
12Dell EMC iDRAC7/iDRAC8 elévation de privilèges8.58.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.018750.04CVE-2018-1207
13Linux Kernel do_open_permission elévation de privilèges5.95.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.000440.00CVE-2009-3286
14nginx Log File elévation de privilèges7.87.4$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.000920.04CVE-2016-1247
15Apache Xerces-C XMLReader.cpp buffer overflow9.89.6$25k-$100k$0-$5kNot DefinedOfficial Fix0.030640.00CVE-2016-0729
16Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgation de l'information5.35.2$5k-$25k$0-$5kHighWorkaround0.020160.02CVE-2007-1192
17Fortinet FortiOS/FortiProxy FortiGate SSL-VPN buffer overflow9.89.6$25k-$100k$5k-$25kNot DefinedOfficial Fix0.154070.04CVE-2023-27997
18ZIPFoundation ZIP File directory traversal7.06.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.000510.00CVE-2023-39138
19pkp ojs cross site scripting2.92.9$0-$5k$0-$5kNot DefinedOfficial Fix0.000450.02CVE-2023-5894
20Fortinet FortiVoice HTTP Request directory traversal5.45.3$0-$5k$0-$5kNot DefinedOfficial Fix0.000680.04CVE-2023-37932

IOC - Indicator of Compromise (86)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDadresse IPHostnameActeurCampagnesIdentifiedTaperConfiance
141.214.183.130Koobface09/07/2022verifiedÉlevé
258.241.255.37Koobface09/07/2022verifiedÉlevé
362.0.134.79HFA62-0-134-79.bb.netvision.net.ilKoobface09/07/2022verifiedÉlevé
467.225.102.10567-225-102-105.prna.hsdb.sasknet.sk.caKoobface09/07/2022verifiedÉlevé
577.70.108.163Koobface09/07/2022verifiedÉlevé
677.78.197.176cable-77-78-197-176.static.telemach.baKoobface09/07/2022verifiedÉlevé
777.127.81.103Koobface09/07/2022verifiedÉlevé
877.239.21.34cable-77-239-0-34.dynamic.telemach.baKoobface09/07/2022verifiedÉlevé
978.1.251.2678-1-251-26.adsl.net.t-com.hrKoobface09/07/2022verifiedÉlevé
1078.3.42.9978-3-42-99.adsl.net.t-com.hrKoobface09/07/2022verifiedÉlevé
1178.90.85.7Koobface09/07/2022verifiedÉlevé
1278.183.143.18878.183.143.188.dynamic.ttnet.com.trKoobface09/07/2022verifiedÉlevé
1379.113.8.10779-113-8-107.rdsnet.roKoobface09/07/2022verifiedÉlevé
1479.130.252.204athedsl-4426972.home.otenet.grKoobface09/07/2022verifiedÉlevé
1579.131.26.192athedsl-377538.home.otenet.grKoobface09/07/2022verifiedÉlevé
1679.138.184.25379.138.184.253.bredband.tre.seKoobface09/07/2022verifiedÉlevé
1779.173.242.22479.173.x.224.go.com.joKoobface09/07/2022verifiedÉlevé
1879.175.101.2879-175-101-28.adsl-a-1.sezampro.rsKoobface09/07/2022verifiedÉlevé
19XX.XXX.XXX.XXxxx-xx-xxx-xxx-xx.xxx.xxxxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
20XX.XXX.XXX.XXXxxx-xx-xxx-xxx-xxx.xxx.xxxxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
21XX.XXX.XXX.XXXxxx-xxx-xxx-xx-xx.xxxxx.xxx.xxxxxxxxx.xxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
22XX.XX.XX.Xxxx-xx-x.xxxx.xxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
23XX.XX.XX.XXXxxx-xx-xx-xx-xxx.xxx.xxxxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
24XX.XX.XXX.XXxxx-xx-xx-xxx-xx.xxx.xxxxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
25XX.XX.XX.XXXxxxx-xxx-xxx-xxx-xxx.xxx.xxx.xxxxx.xxxxxxxx-xx.xxXxxxxxxx09/07/2022verifiedÉlevé
26XX.XXX.X.XXxxx-xx-xxx-x-xx.xxx.xxxxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
27XX.XXX.XXX.XXXxxx-xx-xxx-xxx-xxx.xxxxxx.xxxxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
28XX.XXX.XXX.XXxxx-xx-xxx-xxx-xx.xxx.xxxxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
29XX.XXX.XXX.XXXxxx-xx-xxx-xxx-xxx.xxxxxx.xxxxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
30XX.XXX.XX.XXXxxxx-xxx.xx.xxx.xx.xxxxxx.xxXxxxxxxx09/07/2022verifiedÉlevé
31XX.XX.XXX.XXXxxxx-xxxx-xxxxx.xxxxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
32XX.XXX.XXX.XXXxx.xxx.xxx.xxx.xxxxxxx.xxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
33XX.XXX.XXX.XXXxx.xxx.xxx.xxx.xxxxxxx.xxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
34XX.XXX.XXX.XXXxxxxxxxxxxxxxxxxxx.xxxxxx.xxXxxxxxxx09/07/2022verifiedÉlevé
35XX.XXX.XXX.XXxx-xxx-xxx-xx.xx.xxxxxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
36XX.XX.XX.XXxx.xx.xx.xx.xxxxx.xxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
37XX.XXX.XXX.XXxxxxxxx-xxxxx.xxxx.xxxxxx.xxXxxxxxxx09/07/2022verifiedÉlevé
38XX.XXX.XXX.XXXXxxxxxxx09/07/2022verifiedÉlevé
39XX.XXX.XX.XXXxx-xxx-xx-xxx.xx.xxxxxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
40XX.XXX.XXX.XXXxx-xxx-xxx-xxx.xx.xxxxxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
41XX.XXX.XXX.XXxx-xxx-xxx-xx.xx.xxxxxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
42XX.XXX.XXX.XXxx-xxx-xxx-xx.xx.xxxxxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
43XX.XXX.XX.XXxx-xxx-xx-xx.xx.xxxxxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
44XX.XXX.XXX.XXXxxx-xxx-xxx-xxx.xxxxxxx.xxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
45XX.XXX.XX.XXxxx-xxx-xx-xx.xxxxxxx.xxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
46XX.XXX.XXX.XXXxxx-xx-xxx-xxx-xxx.xxxxxxx.xxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
47XX.XXX.XXX.XXXXxxxxxxx09/07/2022verifiedÉlevé
48XX.XXX.XXX.XXXxx-xxx-xxx-xxx.xxxx.xxxx.xxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
49XX.XXX.XX.XXXxxx-xxx-xx-xxx.xxxxxxxx.xxXxxxxxxx09/07/2022verifiedÉlevé
50XX.XX.XXX.XXXxxxxxxx09/07/2022verifiedÉlevé
51XX.XX.XX.XXXxx.xx.xx.xxx.xxxxxxxx.xx.xxXxxxxxxx09/07/2022verifiedÉlevé
52XX.XXX.XXX.XXxx-xxx-xxx-xx.xxxxx.xxx.xxxxxxxxx.xxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
53XX.XXX.XXX.XXXxxx-xxx-xxx-xx.xxxxx.xxx.xxxxxxxxx.xxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
54XX.XXX.XX.XXXxx-xxx-xx-xxx.xxxx.xxx.x-xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
55XX.XX.XXX.XXXxxx-xx-xx-xxx-xxx.xxxx.xxxxxx.xxXxxxxxxx09/07/2022verifiedÉlevé
56XX.XX.X.XXXxxxxxx-xx.xx.x.xxx.xxxx.xxXxxxxxxx09/07/2022verifiedÉlevé
57XX.XXX.XXX.XXXxxxxx-xx-xxx-xxx-xxx.xxxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
58XX.XXX.XXX.XXxxxxx-xx-xxx-xxx-xx.xxxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
59XX.XXX.XXX.XXXxx.xxx.xxx.xxx.xxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
60XXX.XXX.XXX.XXXxxx-xxx-xxx-xxx.xxxxxxx-xx.xxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
61XXX.XX.XXX.XXXxxx.xx.xxx.xxx.xxxxxx.xxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
62XXX.XXX.X.XXXXxxxxxxx09/07/2022verifiedÉlevé
63XXX.XXX.XX.XXXxxxxxxxxx-xxxxxxx-xxx-xxx-xx-xxx.xxxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
64XXX.XX.XXX.XXxxx.xx.xxx.xx.xxxxxx.xxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
65XXX.XXX.XXX.XXxxxx-xxxxx-xxxxxxx-xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxx.xxXxxxxxxx09/07/2022verifiedÉlevé
66XXX.XXX.XXX.XXXXxxxxxxx09/07/2022verifiedÉlevé
67XXX.XXX.XX.XXXxxxxxxx09/07/2022verifiedÉlevé
68XXX.XX.XX.XXxxx-xx-xx-xx.xxxxxx.xxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
69XXX.XX.XX.XXXxxx-xx-xx-xxx.xxx.xxxxxxxx.xxXxxxxxxx09/07/2022verifiedÉlevé
70XXX.XX.XX.XXXxx-xxx-xx-xx-xxx.xx.xxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
71XXX.XXX.XXX.XXXxxxx-xxx-xxx-xxx.xxxxxxxx.xxxxxx.xxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
72XXX.XXX.X.XXXxxxxxxx09/07/2022verifiedÉlevé
73XXX.XXX.XX.XXXxxx.xxx-xxx-xx.xxx.xxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
74XXX.XXX.XXX.XXXxxxxxxx-xx-xxxxxxxxxxxx.xxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
75XXX.XXX.XXX.XXXxxx-xxx-xxx-xxx.xxx.xxx.xxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
76XXX.XXX.XXX.XXxxxxxx.xxx-xxx-xxx.xxxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
77XXX.XXX.XXX.XXXXxxxxxxx09/07/2022verifiedÉlevé
78XXX.XX.XX.XXxxxxxxx-xxxxxxx-xx.xxx-xx-xx.xxxxxxx.xxXxxxxxxx09/07/2022verifiedÉlevé
79XXX.XXX.XX.XXXxxxx-xxx-xxx-xx-xxx.xx.xxxxxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
80XXX.XX.XX.XXXxxxxxxxx-xxxx-xx-xxx.xxxxxxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
81XXX.XXX.XXX.XXxxx-xxx-xxx-xxxxxxxx-xxxxxxx.xxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
82XXX.XXX.XX.XXxxxxxx-xxx-xxx-xx-xx.xxxxxx.xxx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé
83XXX.X.XXX.XXXxxx.xxx.x.xxx.-xxx.xxxxxxxxxxx.xxxXxxxxxxx09/07/2022verifiedÉlevé
84XXX.XXX.XX.XXXxxxxxxx09/07/2022verifiedÉlevé
85XXX.XXX.XXX.XXxx-xxx-xxx-xxx-xx.xxxxxxxx.xxXxxxxxxx09/07/2022verifiedÉlevé
86XXX.XX.XXX.Xxxx-xxx-x.xx.xxx.xxXxxxxxxx09/07/2022verifiedÉlevé

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnérabilitésVecteur d'accèsTaperConfiance
1T1006CWE-21, CWE-22Path TraversalpredictiveÉlevé
2T1040CWE-319Authentication Bypass by Capture-replaypredictiveÉlevé
3T1055CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveÉlevé
4TXXXXCWE-XXXxxxxxxx XxxxxxxxxpredictiveÉlevé
5TXXXX.XXXCWE-XX, CWE-XXXxxxx Xxxx XxxxxxxxxpredictiveÉlevé
6TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
7TXXXXCWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveÉlevé
8TXXXXCWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveÉlevé
9TXXXXCWE-XXXXxxxxxxxxx XxxxxxpredictiveÉlevé
10TXXXXCWE-XXXxx XxxxxxxxxpredictiveÉlevé
11TXXXX.XXXCWE-XXXXxxxxxx Xxxxxxxxxx Xxx Xxxxxxxx Xxxxxxx Xx Xx-xxxx Xxxxxx XxxxxxxxpredictiveÉlevé
12TXXXX.XXXCWE-XXXXxxxxxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
13TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveÉlevé
14TXXXXCWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveÉlevé
15TXXXXCWE-XXXXxxxxxxxxxx XxxxxxpredictiveÉlevé

IOA - Indicator of Attack (65)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorTaperConfiance
1File.htaccesspredictiveMoyen
2File/api/baskets/{name}predictiveÉlevé
3File/spip.phppredictiveMoyen
4File/tmppredictiveFaible
5File/uncpath/predictiveMoyen
6File/var/log/nginxpredictiveÉlevé
7Fileauth-gss2.cpredictiveMoyen
8Filecase.filemanager.phppredictiveÉlevé
9Filexxxxx.xx_xxxxxxxxx.xxxpredictiveÉlevé
10Filexxxxxx/xxx.xpredictiveMoyen
11Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveÉlevé
12Filexxxx_xxx.xxxpredictiveMoyen
13Filexxxxxxx/xxxx/xxxxxxx/xxxxx.xpredictiveÉlevé
14Filexxxxx.xxxpredictiveMoyen
15Filexxx/xxxxxxxx/xxxx_xxxxx_xxxxxxx.xpredictiveÉlevé
16Filexxxxxxxxxxxx.xxxpredictiveÉlevé
17Filexxxxxxx.xxxpredictiveMoyen
18Filexxxxxx/xxxxxxxxx?xx=xxx_xxx.xxxpredictiveÉlevé
19Filexxxx_xxxx.xpredictiveMoyen
20Filexxx/xxxxxx.xxxpredictiveÉlevé
21Filexxxxxxx/xxxxxxxxxx/xxxxxx/xxxxxxxx/xxx/xxxxxxxxxxxxxxxxxxxx.xxxpredictiveÉlevé
22Filexxxxxxxx/xxxx/xxxxx-xxxxxxxxxx.xxxpredictiveÉlevé
23Filexxxxx.xxxpredictiveMoyen
24Filexxxxxxx.xxxpredictiveMoyen
25Filexxxxxxxx/xxxxxxxx_xxxxxxx_xxxxxx/xxxxx.xxxpredictiveÉlevé
26Filexxxxxxxx/xxxxxxxxx.xxxpredictiveÉlevé
27Filexxxxxxxxxx/xxxxxxx.xpredictiveÉlevé
28Filexxx_xxxxx_xxxxx.xpredictiveÉlevé
29Filexxx_xxx_xxx.xxpredictiveÉlevé
30Filexxxx.xxxpredictiveMoyen
31Filexxx.xxxpredictiveFaible
32Filexxx.xpredictiveFaible
33Filexxxxxxxx.xxxpredictiveMoyen
34Filexxx_xxxx.xxpredictiveMoyen
35Filexxxxxxxxx.xxxpredictiveÉlevé
36Filexxxx-xxxxxxxx.xxxpredictiveÉlevé
37Filexxxx/xxxxxxxx/xxxxxxxx.xxxxpredictiveÉlevé
38Filexxx/xxx/xxx-xxx/xxxx.xxxpredictiveÉlevé
39Filexxxxxxxx.xxxpredictiveMoyen
40Filexx-xxxxxxxx/xxxxxx-xxxxxx.xxxpredictiveÉlevé
41Filexxx/xxxxxx.xxxpredictiveÉlevé
42Library/xxxxx/xxxxxxxx/xxxxxxx.xxxpredictiveÉlevé
43Libraryxxxxxxxx.xxxpredictiveMoyen
44Libraryxxxxxx_xxx.xxx.xxxpredictiveÉlevé
45Libraryxxxxxxxxxx.xxxpredictiveÉlevé
46Argument$xxx_xxxxpredictiveMoyen
47ArgumentxxxxxxxxxxxxxxpredictiveÉlevé
48ArgumentxxxxxxxxpredictiveMoyen
49ArgumentxxxxxxxxxxpredictiveMoyen
50Argumentxxxxxxx_xxxpredictiveMoyen
51ArgumentxxxxxxxxxxxpredictiveMoyen
52ArgumentxxxxxxxxpredictiveMoyen
53ArgumentxxxxxpredictiveFaible
54ArgumentxxpredictiveFaible
55Argumentxxxxxxx_xxxpredictiveMoyen
56Argumentxxxxxx_xxxxpredictiveMoyen
57ArgumentxxxxpredictiveFaible
58ArgumentxxxxxxxxpredictiveMoyen
59ArgumentxxxxpredictiveFaible
60Argumentxxxxxx_xxxxpredictiveMoyen
61Argumentxxx_xxpredictiveFaible
62ArgumentxxxpredictiveFaible
63ArgumentxxxpredictiveFaible
64ArgumentxxxxxxxxpredictiveMoyen
65Input Valuexxxxx.xxxpredictiveMoyen

Références (2)

The following list contains external sources which discuss the actor and the associated activities:

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!