PoshC2 Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (509)

Langue

en	374
de	110
zh	12
es	8
pl	4

De campagne

us	396
cn	20
ru	12
es	6
th	2

Acteurs

PoshC2	14
Cobalt Strike	3
RecordBreaker	2
KingMiner	1
PLEASE_READ_ME_VVV	1

Intérêt

Taper

Not Defined	102
Forum Software	20
Operating System	18
Content Management System	12
Web Server	10

Fournisseur

Not Defined	72
Microsoft	16
Apple	14
Apache	12
Asus	10

Produit

Microsoft Windows	10
Apple QuickTime	6
HP Support Assistant	4
Apache Tomcat	4
PHP	4

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgation de l'information	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php elévation de privilèges	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.12	CVE-2010-0966
3	TikiWiki tiki-register.php elévation de privilèges	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01009	2.97	CVE-2006-6168
4	FreeBSD FPU x87 Register divulgation de l'information	4.0	3.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.00
5	Russcom Network Loginphp register.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00677	0.02	CVE-2006-2160
6	Jelsoft vBulletin register.php dénie de service	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01562	0.00	CVE-2006-4272
7	CONTROLzx HMS register_domain.php cross site scripting	3.5	3.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
8	Ultimate PHP Board register.php vulnérabilité inconnue	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00317	0.00	CVE-2006-3206
9	SloughFlash SF-Users register.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00587	0.00	CVE-2006-2167
10	Linux Kernel FXSAVE x87 Register chiffrement faible	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00101	0.05	CVE-2006-1056
11	MGB OpenSource Guestbook email.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.01302	1.02	CVE-2007-0354
12	Cisco AnyConnect Secure Mobility Client Profile Editor XML External Entity	4.9	4.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00074	0.00	CVE-2018-0100
13	Citrix Workspace App Automatic Updater Service elévation de privilèges	7.5	7.5	$5k-$25k	$5k-$25k	Not Defined	Official Fix	0.00088	0.03	CVE-2020-8207
14	X7 Group X7 Chat register.php cross site scripting	4.3	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00615	0.02	CVE-2006-2282
15	Kailash Nadh boastMachine Admin Interface register.php cross site scripting	4.3	3.8	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00807	0.02	CVE-2006-3826
16	GeoClassifieds Enterprise register.php cross site scripting	3.5	3.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.02
17	PhotoPost PHP register.php elévation de privilèges	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
18	Tritanium Bulletin Board register.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00677	0.03	CVE-2006-1815
19	nginx elévation de privilèges	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	4.87	CVE-2020-12440
20	Asus RT-AX82U HTTP Request get_IFTTTTtoken.cgi Remote Code Execution	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00218	0.04	CVE-2022-35401

Campagnes (1)

These are the campaigns that can be associated with the actor:

PoshC2

IOC - Indicator of Compromise (37)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Campagnes	Identified	Taper	Confiance
1	3.120.209.174	ec2-3-120-209-174.eu-central-1.compute.amazonaws.com	PoshC2		16/01/2024	verified	Moyen
2	3.253.77.60	ec2-3-253-77-60.eu-west-1.compute.amazonaws.com	PoshC2		27/10/2023	verified	Moyen
3	13.48.77.144	ec2-13-48-77-144.eu-north-1.compute.amazonaws.com	PoshC2		01/11/2023	verified	Moyen
4	13.78.10.244		PoshC2		13/02/2024	verified	Élevé
5	18.134.14.164	ec2-18-134-14-164.eu-west-2.compute.amazonaws.com	PoshC2		11/10/2023	verified	Moyen
6	35.80.38.180	ec2-35-80-38-180.us-west-2.compute.amazonaws.com	PoshC2		02/01/2024	verified	Moyen
7	35.202.253.45	45.253.202.35.bc.googleusercontent.com	PoshC2		27/03/2022	verified	Moyen
8	45.79.196.203	45-79-196-203.ip.linodeusercontent.com	PoshC2		19/10/2023	verified	Élevé
9	XX.XXX.XXX.XXX		Xxxxxx		27/01/2024	verified	Élevé
10	XX.XXX.XXX.XXX		Xxxxxx		22/06/2021	verified	Élevé
11	XX.XXX.XX.XX		Xxxxxx		22/11/2023	verified	Élevé
12	XX.XX.XX.XXX	xx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxx		04/01/2024	verified	Élevé
13	XX.XXX.XXX.XXX		Xxxxxx		15/11/2023	verified	Élevé
14	XX.XX.XXX.XX	xxxxxxxxxxxxxxxxx.xx.xxxxxxxxx.xxx	Xxxxxx		10/12/2023	verified	Élevé
15	XX.XXX.XXX.XX	xxxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxx		11/11/2023	verified	Élevé
16	XX.XXX.X.XXX	xxxxxxxx.xxxxxx-xx-xxxxxx.xx	Xxxxxx		16/10/2023	verified	Élevé
17	XX.XX.XXX.XX	xxxxxxxx.xx-xx-xx-xxx.xx	Xxxxxx		26/10/2023	verified	Élevé
18	XX.XXX.XX.XXX	xxxxxxx.xxxxxx.xxx	Xxxxxx		09/10/2023	verified	Élevé
19	XX.XXX.XXX.XXX		Xxxxxx		17/10/2022	verified	Élevé
20	XXX.XX.XXX.XXX		Xxxxxx		22/06/2021	verified	Élevé
21	XXX.XXX.XX.XXX	xxxxxx.xxx.xx.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxx		22/11/2023	verified	Élevé
22	XXX.XXX.XXX.XX		Xxxxxx		07/11/2023	verified	Élevé
23	XXX.XX.XXX.XX	xxx.xx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxx		02/01/2024	verified	Élevé
24	XXX.XXX.XXX.XXX	xxxx-xxx.xxx.xxx.xxx-xxxxxx.xxxxxx.xxx	Xxxxxx		03/04/2024	verified	Élevé
25	XXX.XXX.XXX.XX		Xxxxxx		10/12/2023	verified	Élevé
26	XXX.XXX.XX.XXX		Xxxxxx		19/10/2023	verified	Élevé
27	XXX.XX.XX.XXX		Xxxxxx		09/01/2024	verified	Élevé
28	XXX.XX.XXX.XX		Xxxxxx		20/02/2024	verified	Élevé
29	XXX.XXX.XXX.XXX		Xxxxxx		25/01/2024	verified	Élevé
30	XXX.XXX.XX.XX	xxxxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxx		15/12/2023	verified	Élevé
31	XXX.XX.XXX.XX	xxx-xxx-xx-xxx-xx.xxxxxxx-x.xxxxxxxxx.xxx	Xxxxxx		09/11/2023	verified	Moyen
32	XXX.XXX.XX.XX		Xxxxxx		26/01/2024	verified	Élevé
33	XXX.XXX.XXX.XX		Xxxxxx		17/10/2023	verified	Élevé
34	XXX.XXX.XX.XX		Xxxxxx		22/06/2021	verified	Élevé
35	XXX.XXX.XXX.XXX		Xxxxxx		09/10/2023	verified	Élevé
36	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxx		20/10/2023	verified	Élevé
37	XXX.XXX.XXX.XX		Xxxxx	Xxxxxx	31/05/2021	verified	Élevé

TTP - Tactics, Techniques, Procedures (17)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1006	CWE-21, CWE-22, CWE-23	Path Traversal	predictive	Élevé
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Élevé
3	T1059	CWE-94	Argument Injection	predictive	Élevé
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Élevé
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Élevé
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Élevé
8	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
9	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Élevé
10	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Élevé
12	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
13	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
14	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
15	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Élevé
16	TXXXX.XXX	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Élevé
17	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Élevé

IOA - Indicator of Attack (114)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/admin/config/uploadicon.php	predictive	Élevé
2	File	/admin/del_feedback.php	predictive	Élevé
3	File	/cms/category/list	predictive	Élevé
4	File	/inquiries/view_inquiry.php	predictive	Élevé
5	File	/Login	predictive	Faible
6	File	/product/savenewproduct.php?flag=1	predictive	Élevé
7	File	/search	predictive	Faible
8	File	/start_apply.htm	predictive	Élevé
9	File	/sysmanage/updatelib.php	predictive	Élevé
10	File	/thruk/#cgi-bin/extinfo.cgi?type=2	predictive	Élevé
11	File	/var/log/nginx	predictive	Élevé
12	File	booking.php	predictive	Moyen
13	File	browse-category.php	predictive	Élevé
14	File	BSW_cxttongr.htm	predictive	Élevé
15	File	cat.asp	predictive	Faible
16	File	xxxxxxxx.xxx	predictive	Moyen
17	File	xxxxxxxxxx/xxxxxxx.xxxx	predictive	Élevé
18	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Élevé
19	File	xxxxxxxx.xxx	predictive	Moyen
20	File	xxxxxxxxxxx.xxx	predictive	Élevé
21	File	xxxxxxxx.xxx	predictive	Moyen
22	File	xxxxx.xxx	predictive	Moyen
23	File	xxxxxxxxxxxx.xxx	predictive	Élevé
24	File	xxxx.xxx	predictive	Moyen
25	File	xxx_xxxxxxxxxxx.xxx	predictive	Élevé
26	File	xxxx.xxx	predictive	Moyen
27	File	xxx/xxxxxx.xxx	predictive	Élevé
28	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	Élevé
29	File	xxxxx.xxx	predictive	Moyen
30	File	xxxxx.xxx	predictive	Moyen
31	File	xxxxx.xxx?xx=xxxxxxxxxx&xxxx	predictive	Élevé
32	File	xxxxxxx.x	predictive	Moyen
33	File	xxxxxxxxxxx-xxxxxxx-xxxx.xxxx.xxx	predictive	Élevé
34	File	xxxxxxxx/xxxxxxxx_xxxxxxx_xxxxxx/xxxxx.xxx	predictive	Élevé
35	File	xxxx.xxx	predictive	Moyen
36	File	xxxxx.xxx	predictive	Moyen
37	File	xxxxxxx.xxx	predictive	Moyen
38	File	xxx_xxxx_xxx_xxxxxxxxxx.x	predictive	Élevé
39	File	xxx_xxxx.xxx	predictive	Moyen
40	File	xxxx_xxxxxxx.xxx	predictive	Élevé
41	File	xxxxx_xxx.xxx	predictive	Élevé
42	File	xxxxx.xxx	predictive	Moyen
43	File	xxxxx.xxx	predictive	Moyen
44	File	xxxxxxxxxx.xxx	predictive	Élevé
45	File	xxxxxxxx.xxxx	predictive	Élevé
46	File	xxxxxxxx.xxx	predictive	Moyen
47	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	Élevé
48	File	xxxxxxxx_xxxxxx.xxx	predictive	Élevé
49	File	xxxxxxx/xxxxxxxxxx.xxx	predictive	Élevé
50	File	xxxxxx.xx	predictive	Moyen
51	File	xxxxxxx/xxxxxxxx.xxx	predictive	Élevé
52	File	xxxxx.xxx	predictive	Moyen
53	File	xxxxxx.xxx	predictive	Moyen
54	File	xxxxxx-xxxxxx.xxx	predictive	Élevé
55	File	xxxx-xxxxxxxx.xxx	predictive	Élevé
56	File	xxxxx_xxxxxx.xxx	predictive	Élevé
57	File	xxxxxx.xxx	predictive	Moyen
58	File	xx-xxxxx/xxxxx-xxx.xxx?xxxxxxx-xxxxxxxx	predictive	Élevé
59	File	xxxx.xx	predictive	Faible
60	File	~/xxx/xxxx-xxxxxxxxx.xxx	predictive	Élevé
61	File	~/xxx-xxx-xxxx.xxx	predictive	Élevé
62	Library	xxxxxxxx.xxx	predictive	Moyen
63	Library	xxxxxx.xxxxx.xxxxxxx	predictive	Élevé
64	Argument	xx_xxxx_xxxx	predictive	Moyen
65	Argument	xxxxxxx	predictive	Faible
66	Argument	xxxxxxxxx	predictive	Moyen
67	Argument	xxxxxx	predictive	Faible
68	Argument	xxxxxxxx	predictive	Moyen
69	Argument	xxx	predictive	Faible
70	Argument	xxx	predictive	Faible
71	Argument	xxx/xxxxx_xxxx/xxxxxx_xxxx/xxxxxxx_x/xxxxxxx	predictive	Élevé
72	Argument	xxxxxxx_xxxxx	predictive	Élevé
73	Argument	xxxxxxx/xxxx/xxxxx_xxxxx_xx	predictive	Élevé
74	Argument	x[xxxxx]	predictive	Moyen
75	Argument	xxxxxxx	predictive	Faible
76	Argument	xxxxxxxx	predictive	Moyen
77	Argument	xxxxxxx=xxxxxxxx	predictive	Élevé
78	Argument	xx_xxxxx	predictive	Moyen
79	Argument	xxxx	predictive	Faible
80	Argument	xxxxxxxx	predictive	Moyen
81	Argument	xxxx_xxxxxx	predictive	Moyen
82	Argument	xxxxxxxxxx	predictive	Moyen
83	Argument	xxxx/xxxxxxx/xxxxxxx	predictive	Élevé
84	Argument	xxxx_xx	predictive	Faible
85	Argument	xxxx	predictive	Faible
86	Argument	xx	predictive	Faible
87	Argument	xx_xxxxx	predictive	Moyen
88	Argument	xxxxx	predictive	Faible
89	Argument	xxxxxxxx	predictive	Moyen
90	Argument	xxxxx	predictive	Faible
91	Argument	xxxxxxxxxxx	predictive	Moyen
92	Argument	xxxx-xxx-xxxxxxxxx	predictive	Élevé
93	Argument	xxxxx_xx	predictive	Moyen
94	Argument	xxxx	predictive	Faible
95	Argument	xxxx_xxxxx	predictive	Moyen
96	Argument	xxxxxxx_xxx	predictive	Moyen
97	Argument	xxxxxxxx	predictive	Moyen
98	Argument	xx_xxxx	predictive	Faible
99	Argument	xxxxxxx_xxxx	predictive	Moyen
100	Argument	xxxxxx	predictive	Faible
101	Argument	xxx	predictive	Faible
102	Argument	xxx	predictive	Faible
103	Argument	xxxxxxxx	predictive	Moyen
104	Argument	xxxxx/xxx	predictive	Moyen
105	Argument	xxxxxx	predictive	Faible
106	Argument	xxxxxxx	predictive	Faible
107	Argument	xxxxx	predictive	Faible
108	Argument	xxxxx	predictive	Faible
109	Argument	xxxxxx	predictive	Faible
110	Argument	xxx	predictive	Faible
111	Argument	xxx	predictive	Faible
112	Argument	xxxxxxxx	predictive	Moyen
113	Argument	xxx	predictive	Faible
114	Pattern	\|xx\|	predictive	Faible

Références (30)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Might our Artificial Intelligence support you?

Check our Alexa App!