ObliqueRAT Analyse

IOB - Indicator of Behavior (546)

Chronologie

Langue

en508
es16
it12
fr6
pl2

De campagne

us518
ru24
cn2
tk2

Acteurs

Activités

Intérêt

Chronologie

Taper

Fournisseur

Produit

Drupal4
Apache HTTP Server4
phpMyAdmin4
Apache Any232
Cisco Small Business RV1602

Vulnérabilités

#VulnérabilitéBaseTemp0dayAujourd'huiExpConCTIEPSSCVE
1Apache HTTP Server mod_proxy_balancer.c balancer_handler cross site scripting4.34.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.070.21782CVE-2012-4558
2Google Android Proxy Auto-Config ic.cc UpdateLoadElement buffer overflow8.58.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.000.00102CVE-2019-2047
3Telegram Desktop Proxy elévation de privilèges8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.000.00219CVE-2018-17613
4https-proxy-agent JSON buffer overflow7.26.9$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00659CVE-2018-3739
5Apache HTTP Server mod_proxy_fcgi.c handle_headers buffer overflow5.35.1$25k-$100k$0-$5kNot DefinedOfficial Fix0.040.00953CVE-2014-3583
6Apple iOS Proxy Authentication elévation de privilèges6.66.4$100k et plus$5k-$25kNot DefinedOfficial Fix0.040.00182CVE-2016-4642
7YoungZSoft CCProxy Proxy Service buffer overflow7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.000.11487CVE-2004-2685
8CNCF Envoy Proxy dénie de service6.46.4$0-$5kCalculateurNot DefinedNot Defined0.000.00341CVE-2020-8659
9Blue Coat ProxySG SGOS divulgation de l'information5.35.1$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00139CVE-2015-4334
10Juniper WLC Proxy ARP/No Broadcast Feature elévation de privilèges5.35.1$5k-$25kCalculateurNot DefinedOfficial Fix0.000.00712CVE-2014-6381
11Symantec ASG/ProxySG FTP Proxy WebFTP Mode Stored cross site scripting5.75.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.00115CVE-2018-18370
12Palo Alto PAN-OS DNS Proxy elévation de privilèges8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.030.06716CVE-2017-8390
13QNAP Proxy Server Setting authentification faible6.36.2$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00069CVE-2017-7639
14Squid Web Proxy cachemgr.cgi elévation de privilèges6.15.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.00267CVE-2019-18860
15Bluecoat SGOS Management Console cross site scripting4.34.1$0-$5kCalculateurNot DefinedOfficial Fix0.020.00265CVE-2010-5192
16Artica Proxy fw.progrss.details.php directory traversal7.47.1$0-$5kCalculateurNot DefinedOfficial Fix0.000.96791CVE-2020-13158
17Artica Proxy settings.inc elévation de privilèges4.94.9$0-$5k$0-$5kNot DefinedNot Defined0.000.00130CVE-2019-7300
18Sarg Squid Analysis Report Generator Proxy Server useragent.c useragent buffer overflow10.09.0$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.000.44560CVE-2008-1167
19Google Android Proxy Configuration hydrogen-alias-analysis.h HAliasAnalyzer.Query elévation de privilèges8.58.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.040.00102CVE-2019-2097
20Check point Firewall-1/VPN-1 IKE Aggressive Mode chiffrement faible5.35.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00409CVE-2002-1623

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDadresse IPHostnameActeurCampagnesIdentifiedTaperConfiance
1185.117.73.222ObliqueRAT31/03/2022verifiedÉlevé
2XXX.XXX.XX.XXXXxxxxxxxxx10/08/2022verifiedÉlevé

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnérabilitésVecteur d'accèsTaperConfiance
1T1006CWE-22Path TraversalpredictiveÉlevé
2T1055CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveÉlevé
3T1059CWE-94Argument InjectionpredictiveÉlevé
4TXXXX.XXXCWE-XXXxxxx Xxxx XxxxxxxxxpredictiveÉlevé
5TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
6TXXXXCWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveÉlevé
7TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveÉlevé
8TXXXXCWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveÉlevé
9TXXXXCWE-XXXxx XxxxxxxxxpredictiveÉlevé
10TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
11TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveÉlevé
12TXXXXCWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveÉlevé
13TXXXX.XXXCWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveÉlevé

IOA - Indicator of Attack (33)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorTaperConfiance
1File/assets/php/upload.phppredictiveÉlevé
2Fileadmin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/listpredictiveÉlevé
3Filecachemgr.cgipredictiveMoyen
4Filecgi-bin/cmh/webcam.shpredictiveÉlevé
5Filexxxxxx.xpredictiveMoyen
6Filexx.xxxxxxx.xxxxxxx.xxxpredictiveÉlevé
7Filexxxxxxxx-xxxxx-xxxxxxxx.xpredictiveÉlevé
8Filexx.xxpredictiveFaible
9Filexxxxxx.xxxpredictiveMoyen
10Filexxxxx.xxxpredictiveMoyen
11Filexxxxxx.xpredictiveMoyen
12Filexxxxx.xxxpredictiveMoyen
13Filexxx_xxxxx_xxxxxxxx.xpredictiveÉlevé
14Filexxx_xxxxx_xxxx.xpredictiveÉlevé
15Filexxxxxxxx_xxxxxx.xxxpredictiveÉlevé
16Filexxxxxxxxxx/xxxxxxxx.xxxpredictiveÉlevé
17Filexxxxxxxxx.xpredictiveMoyen
18Filexxxxx/xxxxx.xxpredictiveÉlevé
19Filexxxxxxxxxxxxx.xxxxpredictiveÉlevé
20Libraryxxxxxxxxx/xxxxxx_xxxxxxxxxxx.xxx.xxxpredictiveÉlevé
21ArgumentxxxxpredictiveFaible
22ArgumentxxxxxxxxxxxxxpredictiveÉlevé
23ArgumentxxxxxxxxxxxxpredictiveMoyen
24ArgumentxxxxxxxxpredictiveMoyen
25Argumentxx_xxxxxxxxpredictiveMoyen
26ArgumentxxxxxxxxxpredictiveMoyen
27Argumentxxxx_xxxxx/xxxx_xxxxxxxxpredictiveÉlevé
28Argumentxxxxxxx.xxx_xxxxxxxxxxpredictiveÉlevé
29ArgumentxxxxxpredictiveFaible
30ArgumentxxxpredictiveFaible
31ArgumentxxxxxxxxpredictiveMoyen
32Argumentxxxx xxxxpredictiveMoyen
33Input Value%xx%xx%xxpredictiveMoyen

Références (3)

The following list contains external sources which discuss the actor and the associated activities:

Might our Artificial Intelligence support you?

Check our Alexa App!