Neutrino Exploit Kit Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (99)

Langue

en	94
fr	6

De campagne

us	42
ir	26
ca	12
fr	2
gr	2

Acteurs

Neutrino Exploit Kit	3

Intérêt

Taper

Not Defined	34
Web Server	8
Content Management System	6
Operating System	4
Programming Language Software	4

Fournisseur

Not Defined	30
Apache	6
D-Link	4
Netgear	4
Microsoft	4

Produit

Apache HTTP Server	4
myPHPNuke	2
D-Link DSL-2770L	2
lwIP	2
DeDeCMS	2

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgation de l'information	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php elévation de privilèges	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.16	CVE-2010-0966
3	FLDS redir.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00203	0.09	CVE-2008-5928
4	Squid Web Proxy SSL Certificate Validation divulgation de l'information	7.1	7.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00610	0.02	CVE-2023-46724
5	Lenovo Smart Camera X3/Smart Camera X5/Smart Camera C2E Network Configuration elévation de privilèges	4.7	4.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00083	0.00	CVE-2021-3617
6	Fortinet FortiMail HTTPS sql injection	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00677	0.00	CVE-2021-24007
7	Netgear NMS300 elévation de privilèges	9.8	9.8	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00516	0.00	CVE-2020-35797
8	rConfig sudoers elévation de privilèges	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00166	0.04	CVE-2019-19585
9	vBulletin moderation.php sql injection	7.3	7.0	$0-$5k	$0-$5k	High	Official Fix	0.00284	0.01	CVE-2016-6195
10	PHP unserialize buffer overflow	7.3	6.4	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00000	0.02
11	Apache Tomcat CORS Filter elévation de privilèges	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.07849	0.02	CVE-2018-8014
12	D-Link DSL-2875AL/DSL-2877AL Web Management Server index.asp chiffrement faible	6.4	6.4	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00291	0.00	CVE-2019-15656
13	HTTP/2 Window Size dénie de service	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Workaround	0.09689	0.02	CVE-2019-9511
14	nginx HTTP/2 dénie de service	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.09699	0.04	CVE-2018-16843
15	D-Link DIR-825 router_info.xml PIN elévation de privilèges	6.4	6.4	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00390	0.00	CVE-2019-9126
16	D-Link DSL-2770L atbox.htm Credentials elévation de privilèges	7.5	7.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00369	0.00	CVE-2018-18007
17	Magento sql injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00582	0.03	CVE-2019-7139
18	Atlassian JIRA Server/Data Center Jira Importers Plugin elévation de privilèges	7.2	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01473	0.00	CVE-2019-15001
19	Apache HTTP Server mod_session elévation de privilèges	5.8	5.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00176	0.00	CVE-2018-1283
20	Apache HTTP Server HTTP Digest Authentication Challenge authentification faible	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01815	0.03	CVE-2018-1312

IOC - Indicator of Compromise (9)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Identified	Taper	Confiance
1	45.32.183.118	45.32.183.118.vultrusercontent.com	Neutrino Exploit Kit	01/04/2022	verified	Élevé
2	78.136.221.141		Neutrino Exploit Kit	06/04/2022	verified	Élevé
3	XX.XX.X.XX		Xxxxxxxx Xxxxxxx Xxx	01/04/2022	verified	Élevé
4	XX.XXX.XXX.X	xxxx-xxxxxxxx-xxxxxx.xxxx.xxxxxx.xxx	Xxxxxxxx Xxxxxxx Xxx	06/04/2022	verified	Élevé
5	XX.XXX.XXX.X	xxx.xxxxxx.xx	Xxxxxxxx Xxxxxxx Xxx	06/04/2022	verified	Élevé
6	XX.XX.XXX.XXX	xx-xx-xxx-xxx.xxxxx.xxx.xx	Xxxxxxxx Xxxxxxx Xxx	06/04/2022	verified	Élevé
7	XXX.XX.X.XXX		Xxxxxxxx Xxxxxxx Xxx	06/04/2022	verified	Élevé
8	XXX.X.XXX.X		Xxxxxxxx Xxxxxxx Xxx	01/04/2022	verified	Élevé
9	XXX.XXX.XXX.XX	xxxxxx-xx.xxxxxx-xxxxx.xxx	Xxxxxxxx Xxxxxxx Xxx	06/04/2022	verified	Élevé

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1006	CWE-22	Path Traversal	predictive	Élevé
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Élevé
3	T1059	CWE-94	Argument Injection	predictive	Élevé
4	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Élevé
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
6	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Élevé
7	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
8	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Élevé
9	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Élevé
10	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
11	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
12	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
13	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	Élevé
14	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
15	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Élevé

IOA - Indicator of Attack (55)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/etc/sudoers	predictive	Moyen
2	File	/forum/away.php	predictive	Élevé
3	File	/uncpath/	predictive	Moyen
4	File	arch/x86/kernel/paravirt.c	predictive	Élevé
5	File	ArchiveNews.aspx	predictive	Élevé
6	File	atbox.htm	predictive	Moyen
7	File	blank.php	predictive	Moyen
8	File	xxx_xxxxxxxx.xxx	predictive	Élevé
9	File	xxxx/xxxxxxxxxxxxx.xxx	predictive	Élevé
10	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Élevé
11	File	xxx/xxxx/xxxx.x	predictive	Élevé
12	File	xxxxxxxxxxx/xxxxxxxx/xxxxxxxxxx.xxx	predictive	Élevé
13	File	xxxxxxxx.xxx	predictive	Moyen
14	File	xxxxx_xxxx.xxx	predictive	Élevé
15	File	xxx/xxxxxx.xxx	predictive	Élevé
16	File	xxxxx.xxx	predictive	Moyen
17	File	xxxxx.xxx	predictive	Moyen
18	File	xxxxxxx.xxx	predictive	Moyen
19	File	xxxx.xxx	predictive	Moyen
20	File	xxxx_xxxx.xxx	predictive	Élevé
21	File	xxxxxx/xxxxxxxxxx.x	predictive	Élevé
22	File	xxxx.xxx	predictive	Moyen
23	File	xxxxx.xxx	predictive	Moyen
24	File	xxxxxxx/xxxx/xxxxxxxxx_xxx.xxx	predictive	Élevé
25	File	xxxxx.xxx	predictive	Moyen
26	File	xxxxx.xxx	predictive	Moyen
27	File	xxxxxxxxxx.xxx	predictive	Élevé
28	File	xxxxxx.x	predictive	Moyen
29	File	xxxxxx.xxx	predictive	Moyen
30	File	xxxxxx_xxxx.xxx	predictive	Élevé
31	File	xxxxxx_xxxx.xxx	predictive	Élevé
32	File	xxxxxxxxx.xxx	predictive	Élevé
33	File	xxxxx/xxxxx.xx	predictive	Élevé
34	Library	xxx/xx/xxxxxxx.xx	predictive	Élevé
35	Library	xxxxxxxxxxxx.xxx	predictive	Élevé
36	Argument	-x/-x	predictive	Faible
37	Argument	xxxxxxxx	predictive	Moyen
38	Argument	xxxx_xx	predictive	Faible
39	Argument	xxxxxx_xx	predictive	Moyen
40	Argument	xxxx_xxxx/xxxxx/xxxxxx	predictive	Élevé
41	Argument	xxxx_xxxxxxx	predictive	Moyen
42	Argument	xx	predictive	Faible
43	Argument	xxxxx	predictive	Faible
44	Argument	xxxxxxxxx	predictive	Moyen
45	Argument	xxxxx_xxxx_xxx	predictive	Élevé
46	Argument	xxxxxxx	predictive	Faible
47	Argument	xxxxxxxxx	predictive	Moyen
48	Argument	xxxxxx_xxxx	predictive	Moyen
49	Argument	xxxxxxxxxxxx	predictive	Moyen
50	Argument	xxx	predictive	Faible
51	Argument	xxx	predictive	Faible
52	Argument	xxxx	predictive	Faible
53	Argument	xxxxxxxx/xxxx	predictive	Élevé
54	Argument	xxxxxxxx_x/xxxxxxxx_x	predictive	Élevé
55	Argument	xxxx->xxxxxxx	predictive	Élevé

Références (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!