TA428 Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (150)

Langue

en	120
zh	20
ko	4
fr	2
ar	2

De campagne

cn	50
us	48
ir	2
fr	2

Acteurs

TA428	7
RedLine Stealer	1
Cobalt Strike	1
Mirai	1
TA505	1

Intérêt

Taper

Not Defined	48
Content Management System	12
Programming Language Software	6
WordPress Plugin	6
Router Operating System	6

Fournisseur

Not Defined	58
Microsoft	16
Google	10
Qualcomm	4
GNU	4

Produit

Microsoft Windows	6
Google Chrome	4
Microsoft IIS	4
CMS Made Simple	4
Qualcomm Snapdragon Auto	4

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgation de l'information	5.3	5.2	$5k-$25k	Calculateur	High	Workaround	0.02016	0.02	CVE-2007-1192
2	Microsoft IIS cross site scripting	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.15	CVE-2017-0055
3	Sir GNUboard sql injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00112	0.00	CVE-2014-2339
4	Devilz Clanportal sql injection	7.3	7.0	$0-$5k	$0-$5k	High	Official Fix	0.00684	0.08	CVE-2006-6339
5	WordPress WP_Query class-wp-query.php sql injection	8.5	8.4	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00318	0.02	CVE-2017-5611
6	Cisco ASA WebVPN Login Page logon.html cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00192	0.05	CVE-2014-2120
7	Microsoft Windows Registry Password divulgation de l'information	3.7	3.6	$25k-$100k	$0-$5k	Not Defined	Workaround	0.00000	0.02
8	Brocade Fabric OS CLI Local Privilege Escalation	7.8	7.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2022-33182
9	WordPress Password Reset wp-login.php mail elévation de privilèges	6.1	5.8	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.02827	0.00	CVE-2017-8295
10	PHP Everywhere Plugin Shortcode Privilege Escalation	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00108	0.02	CVE-2022-24663
11	Microsoft Windows ICMP Remote Code Execution	9.8	8.9	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.02818	0.04	CVE-2023-23415
12	Microsoft Windows Win32k Local Privilege Escalation	7.8	7.1	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00159	0.04	CVE-2023-29336
13	Google WebP libwebp buffer overflow	7.5	7.4	$5k-$25k	$0-$5k	High	Official Fix	0.68001	0.05	CVE-2023-4863
14	RARLabs WinRAR ZIP Archive Remote Code Execution	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.44373	0.05	CVE-2023-38831
15	SourceCodester Doctors Appointment System login.php sql injection	7.4	7.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00064	0.05	CVE-2023-4219
16	Microsoft Excel Remote Code Execution	7.3	6.7	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00113	0.00	CVE-2023-33158
17	Microsoft Visual Studio vulnérabilité inconnue	5.1	4.8	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00078	0.00	CVE-2023-28299
18	Microsoft Office Local Privilege Escalation	7.0	6.4	$0-$5k	$0-$5k	Unproven	Official Fix	0.00411	0.02	CVE-2023-33146
19	Th3-822 Rapidleech zip.php zip_go cross site scripting	4.4	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00063	0.09	CVE-2021-4312
20	Google Chrome Blink elévation de privilèges	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00131	0.00	CVE-2022-3315

IOC - Indicator of Compromise (10)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Identified	Taper	Confiance
1	5.180.174.10		TA428	16/08/2022	verified	Élevé
2	45.63.27.162	45.63.27.162.vultrusercontent.com	TA428	16/08/2022	verified	Élevé
3	XX.XX.XXX.XXX	xx.xx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxx	16/02/2024	verified	Élevé
4	XX.XXX.XXX.XXX		Xxxxx	16/08/2022	verified	Élevé
5	XX.XX.XXX.XXX	xxx-xxxxxxxx.xxx.xxx.xxx	Xxxxx	16/08/2022	verified	Élevé
6	XX.XXX.XXX.XX	xxxxxxxxxx.xx	Xxxxx	16/02/2024	verified	Élevé
7	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxx	16/02/2024	verified	Élevé
8	XXX.XXX.XXX.XXX	xxxxxxxxx.xxxxx.xxx	Xxxxx	16/08/2022	verified	Élevé
9	XXX.XXX.XX.XX	xxx-xxx-xx-xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxx	16/02/2024	verified	Élevé
10	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxx	16/08/2022	verified	Élevé

TTP - Tactics, Techniques, Procedures (19)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classe	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Élevé
2	T1040	CAPEC-102	CWE-319	Authentication Bypass by Capture-replay	predictive	Élevé
3	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Élevé
4	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Élevé
5	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Élevé
6	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
7	TXXXX	CAPEC-108	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Élevé
8	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
9	TXXXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Élevé
10	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
11	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Élevé
12	TXXXX	CAPEC-50	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
13	TXXXX	CAPEC-38	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	Élevé
14	TXXXX.XXX	CAPEC-	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	Élevé
15	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
16	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	Élevé
17	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
18	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Élevé
19	TXXXX.XXX	CAPEC-	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Élevé

IOA - Indicator of Attack (61)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/+CSCOE+/logon.html	predictive	Élevé
2	File	/api/addusers	predictive	Élevé
3	File	/debug/pprof	predictive	Moyen
4	File	/forum/away.php	predictive	Élevé
5	File	/uncpath/	predictive	Moyen
6	File	adclick.php	predictive	Moyen
7	File	admin.cgi?action=%s	predictive	Élevé
8	File	xxxxxxxxxxx/xxxx/xxxxxxxxxx/xxxxxx.xxx	predictive	Élevé
9	File	xxxxx.xxx	predictive	Moyen
10	File	xxxxxxxx.xxx	predictive	Moyen
11	File	xxxxx/xxxxxxx.xxx	predictive	Élevé
12	File	xxxxxxx/xxxxxxx/xxx.xxx	predictive	Élevé
13	File	xxxxxx.xxx	predictive	Moyen
14	File	xxxxxxxxxxx/xxxxxx/xxx.xxx	predictive	Élevé
15	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Élevé
16	File	xxxxxx.xxx	predictive	Moyen
17	File	xxxx_xxx.xxx	predictive	Moyen
18	File	xxx/xxxxxx.xxx	predictive	Élevé
19	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	Élevé
20	File	xxxxxxxxxx/xxx/xxxxxx_xxxx.xxx	predictive	Élevé
21	File	xxxxxxxxxxx/xx_xxxx.x	predictive	Élevé
22	File	xxx\xxxxxxx\xxxxxxxx\xxxxx.xxxxxxxxxxxxxxx.xxx	predictive	Élevé
23	File	xxxxx.xxx	predictive	Moyen
24	File	xxx_xxxxxx_xxxxxx.xx	predictive	Élevé
25	File	xxxxxx/xxxxxxxxxxx.xxx?xxxx=xx&x=xxxxxxx	predictive	Élevé
26	File	xxx/xxxxx_xxxx.x	predictive	Élevé
27	File	xxxxxx/xxxxxxxxxx.xxx	predictive	Élevé
28	File	xxxxxxxxxxxxxx/xxxx/xxxxxxxxxxx/xxxxxxxxxxxxxxx.xxxx	predictive	Élevé
29	File	xxxxxxxx_xxxx.xxx	predictive	Élevé
30	File	xxxxxxx.xxx/xxxxx.xxx	predictive	Élevé
31	File	xxxxxxxxxxx.xxx	predictive	Élevé
32	File	xxxxx.xxx	predictive	Moyen
33	File	xxxxxxxxxxxxxxx.xxx	predictive	Élevé
34	File	xxx/xxx/xxx_xxxx/xxxx.x	predictive	Élevé
35	File	xxx/xxxxxxx.x	predictive	Élevé
36	File	xxxxxxxxxx.xxx	predictive	Élevé
37	File	xxxxxxxxxx.xxxx	predictive	Élevé
38	File	xx-xxxxx-xxxxxx.xxx	predictive	Élevé
39	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	Élevé
40	File	xx-xxxxx.xxx	predictive	Moyen
41	Library	xxx-xx-xxx-xxxx-xxxx-xx-x-x.xxx	predictive	Élevé
42	Library	xxx_xxxx.xxx	predictive	Moyen
43	Library	xxxxxxxxxxxxxxx.xxx	predictive	Élevé
44	Argument	xxxxxxx	predictive	Faible
45	Argument	xxxxxxxx	predictive	Moyen
46	Argument	xxxxx_xxxx	predictive	Moyen
47	Argument	xxxxx_xxxx/xx_xxxxx_xxxxx_xx/xx_xxxxx_xxxxx_xxxxx_xxxx_xxxx/xxxxx_xxxxxxxxx_xxxx/xxxxxx_xxxxxx_xxxxx	predictive	Élevé
48	Argument	xxxxxxx	predictive	Faible
49	Argument	xxxxxxxxxxxx	predictive	Moyen
50	Argument	xxxx_xxx	predictive	Moyen
51	Argument	xxxx	predictive	Faible
52	Argument	xxxx	predictive	Faible
53	Argument	xx	predictive	Faible
54	Argument	xxxxx	predictive	Faible
55	Argument	xxxxxxx_xxxx	predictive	Moyen
56	Argument	xxxxxx	predictive	Faible
57	Argument	xxxx	predictive	Faible
58	Argument	xxxxxxxxx	predictive	Moyen
59	Argument	xxxx->xxxxxxx	predictive	Élevé
60	Input Value	..	predictive	Faible
61	Input Value	/../	predictive	Faible

Références (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!