RATicate Analyse

IOB - Indicator of Behavior (52)

Chronologie

Langue

en34
de10
pl4
es2
fr2

De campagne

Acteurs

Activités

Intérêt

Chronologie

Taper

Fournisseur

Produit

Microsoft Windows2
Microsoft IIS2
phpMyAdmin2
Python2
Gempar Script Toko Online2

Vulnérabilités

#VulnérabilitéBaseTemp0dayAujourd'huiExpConCTIEPSSCVE
1All Enthusiast Inc Reviewpost Php Pro showproduct.php sql injection7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.040.00501CVE-2004-2175
2PhotoPost PHP Pro showproduct.php sql injection9.89.4$0-$5k$0-$5kNot DefinedOfficial Fix0.040.00276CVE-2004-0250
3OpenSSH Authentication Username divulgation de l'information5.34.8$5k-$25k$0-$5kHighOfficial Fix0.120.10737CVE-2016-6210
4BitTorrent uTorrent Bencoding Parser elévation de privilèges6.46.4$0-$5k$0-$5kNot DefinedNot Defined0.020.00867CVE-2020-8437
5MDaemon Webmail cross site scripting5.45.3$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00070CVE-2019-8983
6Synology DiskStation Manager Change Password elévation de privilèges7.17.0$0-$5k$0-$5kNot DefinedOfficial Fix0.030.00068CVE-2018-8916
7Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.060.00548CVE-2017-0055
8Todd Miller sudo sudoedit sudoers elévation de privilèges7.87.0$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.000.00061CVE-2015-5602
9Tim Kosse FileZilla Format String7.37.0$25k-$100k$0-$5kNot DefinedOfficial Fix0.040.03339CVE-2007-2318
10BusyBox Terminal lineedit.c add_match elévation de privilèges7.57.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.00522CVE-2017-16544
11Microsoft Office Equation Editor buffer overflow7.57.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.91620CVE-2018-0798
12Citrix ADC/Gateway/NetScaler Gateway/SD-WAN WANOP SSL VPN Web Portal cross site scripting3.53.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.00078CVE-2020-8245
13Gallarific PHP Photo Gallery script gallery.php sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.040.00112CVE-2011-0519
14Gempar Script Toko Online shop_display_products.php sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.020.00100CVE-2009-0296
15K5n WebCalendar send_reminders.php elévation de privilèges7.36.4$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.020.05603CVE-2008-2836
16Microsoft IIS elévation de privilèges9.99.9$25k-$100k$5k-$25kNot DefinedNot Defined0.020.08875CVE-2010-1256
17Python urllib.request.AbstractBasicAuthHandler elévation de privilèges6.46.4$0-$5k$0-$5kNot DefinedOfficial Fix0.070.00837CVE-2020-8492
18nginx URI String elévation de privilèges6.56.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000.95433CVE-2013-4547
19Microsoft Windows Remote Desktop elévation de privilèges7.57.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.000.04662CVE-2019-1333
20Mozilla Firefox/Firefox ESR IFRAME PDF.js elévation de privilèges8.68.2$25k-$100kCalculateurNot DefinedOfficial Fix0.000.01146CVE-2013-5598

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDadresse IPHostnameActeurCampagnesIdentifiedTaperConfiance
179.134.225.11RATicate31/05/2021verifiedÉlevé
2XX.XXX.XXX.XXXxxxxxxx31/05/2021verifiedÉlevé

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnérabilitésVecteur d'accèsTaperConfiance
1T1059CWE-94Argument InjectionpredictiveÉlevé
2T1059.007CWE-79, CWE-80Cross Site ScriptingpredictiveÉlevé
3TXXXXCWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
4TXXXXCWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveÉlevé
5TXXXXCWE-XXXxx XxxxxxxxxpredictiveÉlevé
6TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
7TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveÉlevé
8TXXXXCWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveÉlevé

IOA - Indicator of Attack (21)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorTaperConfiance
1File/etc/sudoerspredictiveMoyen
2File/uncpath/predictiveMoyen
3Filecat.phppredictiveFaible
4Filexxxxxx.xxxpredictiveMoyen
5Filexxxxxxxxxxx/xxxxx.xxxpredictiveÉlevé
6Filexxxxxxx.xxxpredictiveMoyen
7Filexxxxx/xxxxxxxx.xpredictiveÉlevé
8Filexxx.xxpredictiveFaible
9Filexxxxxxx_xxx_xxxxx_xxxxxx.xxxxpredictiveÉlevé
10Filexxxx_xxxxxxxxx.xxxpredictiveÉlevé
11Filexxxx_xxxxxxx_xxxxxxxx.xxxpredictiveÉlevé
12Filexxxxxxxxxxx.xxxpredictiveÉlevé
13Filexxxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxxpredictiveÉlevé
14ArgumentxxxpredictiveFaible
15ArgumentxxxxxpredictiveFaible
16Argumentxxx_xxpredictiveFaible
17ArgumentxxxxxxxxpredictiveMoyen
18ArgumentxxpredictiveFaible
19Argumentxxxx_xxpredictiveFaible
20ArgumentxxxxxpredictiveFaible
21ArgumentxxxxxxxxpredictiveMoyen

Références (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you need the next level of professionalism?

Upgrade your account now!