OldGremlin Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (220)

Langue

en	196
zh	8
es	4
fr	4
de	2

De campagne

us	100
cn	52
at	12
ce	6
ru	6

Acteurs

Cobalt Strike	13
NetSupportManager RAT	12
Raccoon	10
SideWinder	8
RecordBreaker	7

Intérêt

Taper

Not Defined	84
Firewall Software	14
Router Operating System	10
Content Management System	10
Operating System	10

Fournisseur

Not Defined	70
Microsoft	12
QNAP	6
Sophos	6
Tenda	4

Produit

Microsoft Windows	8
QNAP QTS	6
Liferay Portal	6
WordPress	4
Palo Alto PAN-OS	4

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	CTI	EPSS	CVE
1	Atmail Remote Code Execution	9.8	9.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00251	CVE-2013-5033
2	Arduino LED elévation de privilèges	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00109	CVE-2019-13991
3	Palo Alto PAN-OS GlobalProtect Clientless VPN buffer overflow	8.8	8.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00112	CVE-2021-3056
4	Microsoft IIS IP/Domain Restriction elévation de privilèges	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.07	0.00817	CVE-2014-4078
5	WordPress sql injection	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.05	0.00467	CVE-2022-21664
6	VeronaLabs wp-statistics Plugin API Endpoint Blind sql injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00250	CVE-2019-13275
7	Mikrotik RouterOS SNMP divulgation de l'information	8.0	7.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.08	0.00307	CVE-2022-45315
8	Linksys WRT54GL Web Management Interface SysInfo1.htm divulgation de l'information	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.10	0.00046	CVE-2024-1406
9	RoundCube Webmail Email Message rcube_string_replacer.php linkref_addindex cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00612	CVE-2020-35730
10	Teclib GLPI unlock_tasks.php sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.12149	CVE-2019-10232
11	Sophos Firewall User Portal/Webadmin authentification faible	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.97434	CVE-2022-1040
12	nginx elévation de privilèges	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.24	0.00241	CVE-2020-12440
13	CutePHP CuteNews elévation de privilèges	7.5	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02	0.02086	CVE-2019-11447
14	WordPress Object elévation de privilèges	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.00432	CVE-2022-21663
15	Microsoft Windows Active Directory Domain Services Privilege Escalation	8.8	8.1	$100k et plus	$0-$5k	Proof-of-Concept	Official Fix	0.03	0.07920	CVE-2022-26923
16	QNAP QTS Media Library elévation de privilèges	8.5	8.2	$0-$5k	$0-$5k	High	Official Fix	0.03	0.01394	CVE-2017-13067
17	Peplink Balance Cookie admin.cgi sql injection	8.5	7.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.01457	CVE-2017-8835
18	Cisco Internet of Things Field Network Director Web-based User Interface XML External Entity	5.4	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00150	CVE-2019-1698
19	Mycroft AI WebSocket Server elévation de privilèges	7.7	7.7	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00	0.00269	CVE-2018-1000621
20	RealNetworks RealServer Port 7070 Service dénie de service	7.5	7.3	$0-$5k	$0-$5k	Not Defined	Workaround	0.03	0.02116	CVE-2000-0272

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Identified	Taper	Confiance
1	5.181.156.84	no-rdns.mivocloud.com	OldGremlin	02/06/2022	verified	Élevé
2	45.61.138.170		OldGremlin	02/06/2022	verified	Élevé
3	XX.XXX.XXX.XXX		Xxxxxxxxxx	18/04/2022	verified	Élevé
4	XX.XXX.XXX.XXX	xx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	02/06/2022	verified	Élevé
5	XXX.XXX.XX.XX	xxx.xxx.xx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	02/06/2022	verified	Élevé
6	XXX.XX.XX.X		Xxxxxxxxxx	18/04/2022	verified	Élevé
7	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	18/04/2022	verified	Élevé

TTP - Tactics, Techniques, Procedures (18)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1006	CWE-21, CWE-22, CWE-23	Path Traversal	predictive	Élevé
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Élevé
3	T1059	CWE-94	Argument Injection	predictive	Élevé
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Élevé
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Élevé
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Élevé
8	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
9	TXXXX	CWE-XXX	Xxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx Xxxxx	predictive	Élevé
10	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Élevé
12	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
13	TXXXX	CWE-XXX	Xxxxxxx Xxxxxxxxxx Xx Xxx-xxxxxxxx	predictive	Élevé
14	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	Élevé
15	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	Élevé
16	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
17	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
18	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Élevé

IOA - Indicator of Attack (100)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/api/RecordingList/DownloadRecord?file=	predictive	Élevé
2	File	/apply.cgi	predictive	Moyen
3	File	/php/ping.php	predictive	Élevé
4	File	/rapi/read_url	predictive	Élevé
5	File	/scripts/unlock_tasks.php	predictive	Élevé
6	File	/SysInfo1.htm	predictive	Élevé
7	File	/sysinfo_json.cgi	predictive	Élevé
8	File	/system/user/modules/mod_users/controller.php	predictive	Élevé
9	File	/uncpath/	predictive	Moyen
10	File	/wp-admin/admin-post.php?es_skip=1&option_name	predictive	Élevé
11	File	AppCompatCache.exe	predictive	Élevé
12	File	xxxxxxx/xxxx.xxx	predictive	Élevé
13	File	xxxxxxxx.xxx	predictive	Moyen
14	File	xxx-xxx/xxxxxxx.xx	predictive	Élevé
15	File	xxx-xxx/xxxxx/xxxxx.xxx	predictive	Élevé
16	File	xxxxxx/xxx.x	predictive	Moyen
17	File	xxxxxxxx_xxxxxxxxxxxxxxxxx.xxx	predictive	Élevé
18	File	xxxxxxxxx.xxx.xxx	predictive	Élevé
19	File	xxxxx/xxxxx.xxx	predictive	Élevé
20	File	xxxx_xxxxx.xxx	predictive	Élevé
21	File	xxxxx.xxx	predictive	Moyen
22	File	xxxxxx.xxx	predictive	Moyen
23	File	xxxxxxx/xxxx-xxxxx-xxxxxx.xxx	predictive	Élevé
24	File	xxxxxxx/xxxx-xxxxx-xxxxxx.xxx?xxxxxx=x	predictive	Élevé
25	File	xx/xx-xx.x	predictive	Moyen
26	File	xxx/xxxx_xxxx.x	predictive	Élevé
27	File	xxxxxx/xxxxxxxxxxx	predictive	Élevé
28	File	xxxx_xxxxxx.x	predictive	Élevé
29	File	xxxx/xxxxxxx.x	predictive	Élevé
30	File	xxxxxxxx/xxxxx-xxxxxx-xxxx-xxxxxxx.xxx	predictive	Élevé
31	File	xxxxxxxx/xxxxxxxx/xxxxx-xxxxxxxx-xxxxx.xxx	predictive	Élevé
32	File	xxxxx.xxx?xxx=xxxx&xxx=xxxxxxxx	predictive	Élevé
33	File	xxxxxxxxxx.xxx	predictive	Élevé
34	File	xxxxxxx_xxxxxxx/xxxx.xxx	predictive	Élevé
35	File	xxxxx.xxx	predictive	Moyen
36	File	xxxx/xxxxxxxxx/xxxxxx/xxxxxxxxxxxxxxxxxxxxx.xxx	predictive	Élevé
37	File	xxx/xxx.xxx	predictive	Moyen
38	File	xxxxxx.x	predictive	Moyen
39	File	xxxx.xxx	predictive	Moyen
40	File	xxxxx.xxx	predictive	Moyen
41	File	xxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]	predictive	Élevé
42	File	xxxxx_xxxxxx_xxxxxxxx.xxx	predictive	Élevé
43	File	xxxxxxxx.xxx	predictive	Moyen
44	File	xxxxxxx/xxxxxxxxxx	predictive	Élevé
45	File	xxxxxxx-xxxxxxxxxx/xxx/xxxxx.xxx	predictive	Élevé
46	File	xxxx.xxx	predictive	Moyen
47	File	xxxxx/xxxxx.xxx	predictive	Élevé
48	File	xxxxxxxx.xxx	predictive	Moyen
49	File	xxxxxxxxx.xxx	predictive	Élevé
50	File	xxxx.xxx	predictive	Moyen
51	File	xxxxxxxxxx	predictive	Moyen
52	File	xxxxxxx/xxxxx.xxx	predictive	Élevé
53	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	Élevé
54	Argument	xxxxxx	predictive	Faible
55	Argument	xxxxxxx_xxxx	predictive	Moyen
56	Argument	xxxxxx_xxxx	predictive	Moyen
57	Argument	xxxxx	predictive	Faible
58	Argument	xxx	predictive	Faible
59	Argument	xxxxxxxx	predictive	Moyen
60	Argument	xxxxxx	predictive	Faible
61	Argument	xxxxxxxxxxxxxxxxx	predictive	Élevé
62	Argument	xxxxx	predictive	Faible
63	Argument	xxxxxxxxxxx/xxxxxxxx/xxx/xxxxx	predictive	Élevé
64	Argument	xxxxxx_xx	predictive	Moyen
65	Argument	xxxxx	predictive	Faible
66	Argument	xxxxxx	predictive	Faible
67	Argument	xxxxxxxxxxxx	predictive	Moyen
68	Argument	xxxxxx	predictive	Faible
69	Argument	xx_xxxx [xx][x]/xx_xxxx [xx][x]/xx_xxxx [xx][x]/xx_xxxx [xx][x]/xxxxx	predictive	Élevé
70	Argument	xxxx	predictive	Faible
71	Argument	xxxx	predictive	Faible
72	Argument	xx	predictive	Faible
73	Argument	xxxxxxxxx	predictive	Moyen
74	Argument	xxxxxxxx[xx]	predictive	Moyen
75	Argument	xxxxxxx	predictive	Faible
76	Argument	xxx_xxxx	predictive	Moyen
77	Argument	xxxxx_xx	predictive	Moyen
78	Argument	xxxxxxxx	predictive	Moyen
79	Argument	x_x_x	predictive	Faible
80	Argument	xxxxxxx/xxxxx	predictive	Élevé
81	Argument	xxxxxx_xxx	predictive	Moyen
82	Argument	xxxxxx	predictive	Faible
83	Argument	xxxx_xx	predictive	Faible
84	Argument	xxxxxxxx_xxxxxxxx	predictive	Élevé
85	Argument	xxxxxxxxxxxxxxxxxxxxx	predictive	Élevé
86	Argument	xxxx_xx	predictive	Faible
87	Argument	xxx	predictive	Faible
88	Argument	xxxx	predictive	Faible
89	Argument	xxxxxxxx	predictive	Moyen
90	Argument	xxxx/xx/xxxx/xxx	predictive	Élevé
91	Argument	xxxxxxxx	predictive	Moyen
92	Input Value	.%xx.../.%xx.../	predictive	Élevé
93	Input Value	../../../../../xxx/xxx/xxxxx/xxxx/xxxxxxxx/xxxxx/xxx.xxx	predictive	Élevé
94	Input Value	xxxxxxx -xxx	predictive	Moyen
95	Input Value	xxxxxxxxxx	predictive	Moyen
96	Network Port	xxxx	predictive	Faible
97	Network Port	xxxx	predictive	Faible
98	Network Port	xxxx xxxx	predictive	Moyen
99	Network Port	xxx/xxx	predictive	Faible
100	Network Port	xxx/xxxx	predictive	Moyen

Références (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Do you need the next level of professionalism?

Upgrade your account now!