Packrat Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (85)

Langue

en	64
pt	16
es	6

De campagne

br	42
es	8
cl	4
us	2

Acteurs

Packrat	3

Intérêt

Taper

Not Defined	16
Operating System	10
Office Suite Software	8
SSH Server Software	2
Smartphone Operating System	2

Fournisseur

Microsoft	16
Not Defined	12
Sun	4
DZCP	2
Google	2

Produit

Microsoft Windows	6
Microsoft Office	6
Sun Solaris	4
DZCP deV!L`z Clanportal	2
Dropbear SSH	2

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	Dropbear SSH elévation de privilèges	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02911	0.04	CVE-2016-7406
2	OpenSSL Non-prime Moduli BN_mod_sqrt dénie de service	6.4	6.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01342	0.00	CVE-2022-0778
3	VMware ESXi Host Client Stored cross site scripting	5.2	4.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00076	0.00	CVE-2017-4940
4	HP Integrated Lights-Out IPMI Protocol elévation de privilèges	8.2	8.0	$5k-$25k	$0-$5k	High	Workaround	0.27196	0.02	CVE-2013-4786
5	Apache HTTP Server mod_reqtimeout dénie de service	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01696	0.00	CVE-2007-6750
6	Linux Kernel Socket Buffer virtio_bt.c dénie de service	5.7	5.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00045	0.02	CVE-2022-26878
7	Microsoft Windows LSA divulgation de l'information	6.4	5.9	$25k-$100k	$5k-$25k	Functional	Official Fix	0.85287	0.03	CVE-2021-36942
8	Dropbear SSH dbclient/server Memory divulgation de l'information	4.4	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00042	0.01	CVE-2016-7409
9	Dropbear SSH dropbearconvert elévation de privilèges	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00956	0.02	CVE-2016-7407
10	phpMyAdmin grab_globals.lib.php directory traversal	4.8	4.4	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02334	0.12	CVE-2005-3299
11	Ietf MD5 chiffrement faible	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01224	0.00	CVE-2004-2761
12	Sun Solaris Authentication authentification faible	9.8	9.6	$5k-$25k	$0-$5k	High	Workaround	0.01297	0.02	CVE-1999-0502
13	TP-LINK TL-WR840N buffer overflow	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00092	0.00	CVE-2022-26642
14	HP Intelligent Management Center tftpserver.exe elévation de privilèges	10.0	9.5	$25k-$100k	Calculateur	Not Defined	Official Fix	0.05750	0.00	CVE-2011-1853
15	Microsoft Windows SMB Processor EducatedScholar dénie de service	7.3	7.0	$5k-$25k	$0-$5k	High	Official Fix	0.97288	0.00	CVE-2009-3103
16	avahi socket.c dénie de service	5.3	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.07514	0.00	CVE-2011-1002
17	OpenSSL EC divulgation de l'information	3.1	3.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00272	0.00	CVE-2021-4160
18	Linux Kernel KVM elévation de privilèges	7.6	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00056	0.03	CVE-2021-3653
19	Fortinet FortiMail directory traversal	6.4	6.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00093	0.00	CVE-2021-24013
20	Fortinet FortiMail Identity-Based Encryption Service chiffrement faible	4.0	3.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00060	0.00	CVE-2021-26099

IOC - Indicator of Compromise (9)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Identified	Taper	Confiance
1	46.246.89.246	joana.homework.space	Packrat	24/12/2020	verified	Élevé
2	50.62.133.49	ip-50-62-133-49.ip.secureserver.net	Packrat	24/12/2020	verified	Élevé
3	XXX.XXX.X.XX	xxxxxxxx.xxxxxx.xxx.xx	Xxxxxxx	24/12/2020	verified	Élevé
4	XXX.XXX.XX.XX	xxxxxxxx.xxxxxx.xxx.xx	Xxxxxxx	24/12/2020	verified	Élevé
5	XXX.XXX.XXX.XXX	xxxxxxxx.xxxxxx.xxx.xx	Xxxxxxx	24/12/2020	verified	Élevé
6	XXX.XX.XXX.XXX	xxx-xx-xxx-xxx.xxx.xxxxxxxx.xx	Xxxxxxx	24/12/2020	verified	Élevé
7	XXX.XXX.XXX.XXX	xxxxxxxx-xxxxxx-xxx-xxx-xxx.xxxxxxxxxxxxx.xxx	Xxxxxxx	24/12/2020	verified	Élevé
8	XXX.XXX.XXX.XX	xx-xxx-xxx-xxx-xx.xx.xxxxxxxxxxxx.xxx	Xxxxxxx	24/12/2020	verified	Élevé
9	XXX.XX.XXX.XXX	xx-xxx-xx-xxx-xxx.xx.xxxxxxxxxxxx.xxx	Xxxxxxx	24/12/2020	verified	Élevé

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1006	CWE-22	Path Traversal	predictive	Élevé
2	T1059	CWE-94	Argument Injection	predictive	Élevé
3	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Élevé
4	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
5	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Élevé
6	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
7	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
8	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
9	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Élevé

IOA - Indicator of Attack (20)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	api/sms_check.php	predictive	Élevé
2	File	avahi-core/socket.c	predictive	Élevé
3	File	chmextract.c	predictive	Moyen
4	File	xxxxxxx/xxxxxxxxx/xxxxxx_xx.x	predictive	Élevé
5	File	xxxx_xxxxxxx.xxx.xxx	predictive	Élevé
6	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	Élevé
7	File	xxxxx.xxx	predictive	Moyen
8	File	xxxxxx_xxx.x	predictive	Moyen
9	File	xxxxx-xxx.x	predictive	Moyen
10	File	xxxxxxxxxx.xxx	predictive	Élevé
11	Library	xxxxxxxx.xxx	predictive	Moyen
12	Argument	-x	predictive	Faible
13	Argument	xxxx	predictive	Faible
14	Argument	xxx_xxx	predictive	Faible
15	Argument	xxxxx	predictive	Faible
16	Argument	xxxxxxxx	predictive	Moyen
17	Argument	xxxxxxxx	predictive	Moyen
18	Argument	xxxx	predictive	Faible
19	Argument	xxxxxxxx/xxxx	predictive	Élevé
20	Argument	x_xx_xxxxxxxxxxxxxxxx	predictive	Élevé

Références (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!