Stealth Soldier Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (46)

Langue

en	44
es	2

De campagne

us	24
ru	22

Acteurs

Stealth Soldier	1
Eye on the Nile	1
SystemBC	1

Intérêt

Taper

Operating System	8
Not Defined	8
Programming Language Software	2
Database Administration Software	2
Forum Software	2

Fournisseur

Not Defined	8
Linux	6
Thomas R. Pasawicz	2
MGB	2
Google	2

Produit

Linux Kernel	6
Thomas R. Pasawicz HyperBook Guestbook	2
PHP	2
MGB OpenSource Guestbook	2
phpMyAdmin	2

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgation de l'information	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	JForum Login elévation de privilèges	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00151	0.06	CVE-2012-5338
3	Linux Kernel UDP Packet udp.c elévation de privilèges	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.04837	0.03	CVE-2016-10229
4	Linux Kernel buffer overflow	10.0	9.0	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.07416	0.02	CVE-2008-1673
5	vBulletin redirector.php Redirect	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00122	0.09	CVE-2018-6200
6	Linux Kernel nf_conntrack_h323_asn1.c decode_choice dénie de service	7.5	6.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.08412	0.00	CVE-2007-3642
7	Netgear GC108P NSDP Packet sccd authentification faible	6.7	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00073	0.00	CVE-2021-40866
8	Google Android xt_qtaguid.c qtaguid_untag buffer overflow	6.5	6.3	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00042	0.04	CVE-2021-0399
9	TP-LINK Archer C3150v2 dhcp.htm setDefaultHostname cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00536	0.03	CVE-2021-3275
10	Google Android ADSPRPC Heap Manager buffer overflow	8.5	8.2	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00119	0.05	CVE-2018-3586
11	Apple macOS WebKit elévation de privilèges	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00230	0.00	CVE-2021-1801
12	Linux Kernel ptrace.c elévation de privilèges	7.8	7.6	$5k-$25k	$0-$5k	High	Official Fix	0.00052	0.15	CVE-2019-13272
13	Samsung Mobile Devices SEAndroid Protection Mechanism elévation de privilèges	7.4	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00066	0.00	CVE-2020-13829
14	My Link Trader out.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.22
15	PHP phpinfo cross site scripting	6.3	5.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.08985	0.04	CVE-2006-0996
16	phpMyAdmin phpinfo.php divulgation de l'information	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00142	0.00	CVE-2016-9848
17	PHPWind goto.php Redirect	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00348	0.00	CVE-2015-4134
18	MGB OpenSource Guestbook email.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.01302	0.89	CVE-2007-0354
19	Google Chrome TransportDIB SkBitmap Pixel Data render_widget_snapshot_taker.cc WidgetDidReceivePaintAtSizeAck elévation de privilèges	6.5	6.2	$100k et plus	$0-$5k	Not Defined	Official Fix	0.00622	0.00	CVE-2013-2836
20	Pixelpost cross site request forgery	7.0	6.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01098	0.02	CVE-2010-3305

Campagnes (1)

These are the campaigns that can be associated with the actor:

North Africa

IOC - Indicator of Compromise (6)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Campagnes	Identified	Taper	Confiance
1	94.156.33.228		Stealth Soldier	North Africa	08/06/2023	verified	Élevé
2	94.156.33.229		Stealth Soldier	North Africa	08/06/2023	verified	Élevé
3	XXX.XXX.XXX.XXX	xxxxxx.xxx.xxx	Xxxxxxx Xxxxxxx	Xxxxx Xxxxxx	08/06/2023	verified	Élevé
4	XXX.XXX.XXX.XXX	xxxxxx.xxx.xxx	Xxxxxxx Xxxxxxx	Xxxxx Xxxxxx	08/06/2023	verified	Élevé
5	XXX.XXX.XXX.XXX	xxxxxx.xxx.xxx	Xxxxxxx Xxxxxxx	Xxxxx Xxxxxx	08/06/2023	verified	Élevé
6	XXX.XXX.XXX.XXX	xxxxxx.xxx.xxx	Xxxxxxx Xxxxxxx	Xxxxx Xxxxxx	08/06/2023	verified	Élevé

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classe	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Élevé
2	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	Élevé
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
4	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
5	TXXXX	CAPEC-0	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Élevé
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
7	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé

IOA - Indicator of Attack (25)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/forum/away.php	predictive	Élevé
2	File	/out.php	predictive	Moyen
3	File	/sqfs/bin/sccd	predictive	Élevé
4	File	admin/index.php	predictive	Élevé
5	File	xxxxxxx/xxxxxxxxxx/xxxxxx_xxxxxx_xxxxxxxx_xxxxx.xx	predictive	Élevé
6	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Élevé
7	File	xxxx.xxx	predictive	Moyen
8	File	xxxxx.xxx	predictive	Moyen
9	File	xxxx.xxx	predictive	Moyen
10	File	xxx/xxxxxx.xxx	predictive	Élevé
11	File	xxxxxx/xxxxxx.x	predictive	Élevé
12	File	xxx/xxxxxxxxx/xx_xxxxxxxxx_xxxx_xxxx.x	predictive	Élevé
13	File	xxxxxxx.xxx	predictive	Moyen
14	File	xxxx.xxx	predictive	Moyen
15	File	xxxxxxxxxx.xxx	predictive	Élevé
16	File	xxx.x	predictive	Faible
17	File	xx_xxxxxxx.x	predictive	Moyen
18	Argument	xxxxxxxx	predictive	Moyen
19	Argument	xx	predictive	Faible
20	Argument	xxxxxxxx	predictive	Moyen
21	Argument	xxxxxxxxxx	predictive	Moyen
22	Argument	xxxxxx_xx	predictive	Moyen
23	Argument	xxx	predictive	Faible
24	Argument	xxx	predictive	Faible
25	Network Port	xxx	predictive	Faible

Références (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!