TeleBots Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (159)

Langue

en	120
de	18
es	8
it	6
fr	4

De campagne

us	56
ch	46
nl	10
ro	6
it	6

Acteurs

TeleBots	4
RTM	1
APT10	1
APT28	1
Bandook	1

Intérêt

Taper

Not Defined	54
Content Management System	16
Web Server	10
Forum Software	8
Programming Language Software	6

Fournisseur

Not Defined	50
Apache	10
GNU	8
SourceCodester	4
Huawei	4

Produit

Apache HTTP Server	10
WordPress	4
Huawei SXXXX	4
NVIDIA Windows GPU Display Driver	4
ProFTPD	4

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	CTI	EPSS	CVE
1	Backdoor.Win32.Tiny.c Service Port 7778 elévation de privilèges	7.3	6.4	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.04	0.00000
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgation de l'information	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02	0.02016	CVE-2007-1192
3	Linux Kernel NILFS File System inode.c security_inode_alloc buffer overflow	8.3	8.1	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.02	0.00042	CVE-2022-2978
4	Crow HTTP Pipelining buffer overflow	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	0.00416	CVE-2022-38667
5	mySCADA myPRO elévation de privilèges	9.2	9.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00105	CVE-2022-2234
6	GNU Bash Environment Variable variables.c Shellshock elévation de privilèges	9.8	9.3	$100k et plus	$0-$5k	High	Official Fix	0.09	0.97564	CVE-2014-6271
7	Microsoft Visual Studio XML External Entity	6.3	5.5	$5k-$25k	$0-$5k	Proof-of-Concept	Unavailable	0.00	0.00000
8	ProFTPD mod_copy elévation de privilèges	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.94462	CVE-2019-12815
9	OpenSSH Authentication Username divulgation de l'information	5.3	4.8	$5k-$25k	$0-$5k	High	Official Fix	0.04	0.10737	CVE-2016-6210
10	Zeus Zeus Web Server buffer overflow	10.0	9.0	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.11877	CVE-2010-0359
11	WordPress WP_Query class-wp-query.php sql injection	8.5	8.4	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.00318	CVE-2017-5611
12	Git Plugin Build elévation de privilèges	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.05	0.01156	CVE-2022-36883
13	FreeBSD Ping pr_pack buffer overflow	7.3	7.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.00043	CVE-2022-23093
14	Red Hat OpenShift server_priv.pem elévation de privilèges	4.5	4.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00	0.00042	CVE-2013-4281
15	Linux Kernel NTFS3 Subsystem Privilege Escalation	7.0	7.0	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.03	0.00042	CVE-2022-3238
16	SQLite ALTER TABLE buffer overflow	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00221	CVE-2020-35527
17	md2roff Markdown File buffer overflow	7.6	7.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.00208	CVE-2022-41220
18	Nissan/Kia/Hyundai Vehicle Remote Keyless Entry RollBack authentification faible	6.4	6.4	$5k-$25k	$5k-$25k	Proof-of-Concept	Not Defined	0.02	0.00333	CVE-2022-37418
19	Citrix Gateway Plug-in elévation de privilèges	8.8	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00044	CVE-2022-21827
20	Splunk Enterprise Command-Line Interface authentification faible	6.2	6.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00178	CVE-2022-32156

Campagnes (1)

These are the campaigns that can be associated with the actor:

Ukraine

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Campagnes	Identified	Taper	Confiance
1	5.39.218.152		TeleBots	Ukraine	27/03/2022	verified	Élevé
2	46.28.200.132	hosted-by.solarcom.ch	TeleBots	Ukraine	27/03/2022	verified	Élevé
3	XX.XXX.XXX.XXX	xxxxxxxxxxx.xxx	Xxxxxxxx		31/05/2021	verified	Élevé
4	XX.XXX.XX.XX		Xxxxxxxx	Xxxxxxx	27/03/2022	verified	Élevé
5	XX.XXX.XXX.XXX	xx-xxx-xxx-xxx.xxxxxx-xx-xxxxxxxxxxx.xxx	Xxxxxxxx		31/05/2021	verified	Élevé
6	XX.XXX.XX.X	xxxxxx-x.xx.xxx.xx.xxxxxx.xxx	Xxxxxxxx		31/05/2021	verified	Élevé
7	XXX.XX.XXX.XX	xx-xxxxxx-xxx-xx-xxx-xx.xxxxxx.xx	Xxxxxxxx	Xxxxxxx	27/03/2022	verified	Élevé
8	XXX.XX.XX.X	xxxxxxxxxxx.xxxxxxxxxxx.xxx	Xxxxxxxx	Xxxxxxx	27/03/2022	verified	Élevé

TTP - Tactics, Techniques, Procedures (16)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1006	CWE-22	Path Traversal	predictive	Élevé
2	T1059	CWE-94	Argument Injection	predictive	Élevé
3	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Élevé
4	T1068	CWE-264, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	Élevé
5	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Élevé
6	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Élevé
7	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
8	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Élevé
9	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Élevé
10	TXXXX	CWE-XXX	Xxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx Xxxxx	predictive	Élevé
11	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
12	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
13	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	Élevé
14	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
15	TXXXX.XXX	CWE-XX	Xxxxxxxxxxxxx	predictive	Élevé
16	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Élevé

IOA - Indicator of Attack (121)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	.htaccess	predictive	Moyen
2	File	/cgi-bin/supervisor/PwdGrp.cgi	predictive	Élevé
3	File	/CMD_SELECT_USERS	predictive	Élevé
4	File	/configs/application.ini	predictive	Élevé
5	File	/dashboard/updatelogo.php	predictive	Élevé
6	File	/etc/openshift/server_priv.pem	predictive	Élevé
7	File	/index.php	predictive	Moyen
8	File	/mkshop/Men/profile.php	predictive	Élevé
9	File	/Noxen-master/users.php	predictive	Élevé
10	File	/phppath/php	predictive	Moyen
11	File	/uncpath/	predictive	Moyen
12	File	admin-ajax.php	predictive	Élevé
13	File	admin/google_search_console/class-gsc-table.php	predictive	Élevé
14	File	admin/menus/edit.php	predictive	Élevé
15	File	album_portal.php	predictive	Élevé
16	File	xxxx/xxx/xxxxxx/xxxxx-xxxxx_xxxx.x	predictive	Élevé
17	File	xxxxxxxx.xxx	predictive	Moyen
18	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Élevé
19	File	xxxx\xx_xx.xxx	predictive	Élevé
20	File	xxxxxxx.xxx	predictive	Moyen
21	File	xx.x	predictive	Faible
22	File	xxxxx.xxx	predictive	Moyen
23	File	xxxxxxxxxxxxxxxxxxx	predictive	Élevé
24	File	xxxxxxxxxx/xxxxxxxxxx/xxxxxxxxx.xxx	predictive	Élevé
25	File	xxxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxx	predictive	Élevé
26	File	xxxxxxxx/xxxxxxx.xxx	predictive	Élevé
27	File	xxxxxxxx/xxx/xxx_xx_xxxxxxx.xxx	predictive	Élevé
28	File	xxxxx.xxx	predictive	Moyen
29	File	xxxxx.x	predictive	Faible
30	File	xxxxxxxxxx.xxx	predictive	Élevé
31	File	xxxx_xxxx.xxx	predictive	Élevé
32	File	xxxxxx.x	predictive	Moyen
33	File	xx.xxx	predictive	Faible
34	File	xxxx.xxx	predictive	Moyen
35	File	xxxxx/x/xxx/xxxx.xxx	predictive	Élevé
36	File	xxxxxxxx.xxxxx.xxx	predictive	Élevé
37	File	xxxx.xxx	predictive	Moyen
38	File	xxxxxxxxxxxxx.xxx	predictive	Élevé
39	File	xxxxxxxxxxxxxx.xxx	predictive	Élevé
40	File	xxxxxxx_xxxx.xxx	predictive	Élevé
41	File	xxxxxxx.xxx	predictive	Moyen
42	File	xxxxx_xxxxxxx.xxx	predictive	Élevé
43	File	xxxxxx.xxx	predictive	Moyen
44	File	xxxxxx.xxx	predictive	Moyen
45	File	xxx/xxx_xxx	predictive	Moyen
46	File	xxxx.xxx	predictive	Moyen
47	File	xxxxxx.x	predictive	Moyen
48	File	xxxx.xxx	predictive	Moyen
49	File	xxxx_xxxx.xxx	predictive	Élevé
50	File	xxxxxxxxxxxxxxxx.xx	predictive	Élevé
51	File	xxxxxx-xxxxx-xxxxxx.xxx	predictive	Élevé
52	File	xxxxxxxx/xxx	predictive	Moyen
53	File	xxxxxx.xxx	predictive	Moyen
54	File	xxxxxx.xxx	predictive	Moyen
55	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	Élevé
56	File	xxxxxxxxx.x	predictive	Moyen
57	File	xxxxxxx.xxx	predictive	Moyen
58	File	xxxxxxx.xxx	predictive	Moyen
59	File	xxxx_xxx.xxx	predictive	Moyen
60	File	xxx/xxxxxx/xxxxxxxxxxxxx.xxx	predictive	Élevé
61	File	xx-xxxxxxx.xxx	predictive	Élevé
62	File	xx-xxxxxxxx/xxxxx-xx-xxxxxxxxx-xxxxxxx.xxx	predictive	Élevé
63	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	Élevé
64	File	xx-xxxxxxxx/xxxx.xxx	predictive	Élevé
65	File	xx-xxxxxxxx.xxx	predictive	Élevé
66	File	xxxxxxxxxxxx.xxx	predictive	Élevé
67	Library	xxx.xxx	predictive	Faible
68	Library	xxxxxxxx.xxx	predictive	Moyen
69	Argument	xxxx	predictive	Faible
70	Argument	xxxxxxxxx	predictive	Moyen
71	Argument	xxxx_xxx	predictive	Moyen
72	Argument	xxx	predictive	Faible
73	Argument	xxxx_xx	predictive	Faible
74	Argument	xxxxx	predictive	Faible
75	Argument	xxx	predictive	Faible
76	Argument	xxxx_xx	predictive	Faible
77	Argument	xxxxxxx	predictive	Faible
78	Argument	xxxxxxxxxxx	predictive	Moyen
79	Argument	xxxxxx	predictive	Faible
80	Argument	xxxxxx_xxxx_xxxxxxxx	predictive	Élevé
81	Argument	xxxxxxxx	predictive	Moyen
82	Argument	xxx_xxxx/xxx_xxxxxxx	predictive	Élevé
83	Argument	xxxxxxxxxxx	predictive	Moyen
84	Argument	xxxx/xxxx_xx	predictive	Moyen
85	Argument	xxxxxxxxx	predictive	Moyen
86	Argument	xxxx_xxxxxxx	predictive	Moyen
87	Argument	xx	predictive	Faible
88	Argument	xxxxxxxxxx	predictive	Moyen
89	Argument	xxx	predictive	Faible
90	Argument	xxxx	predictive	Faible
91	Argument	xxxxxxxx	predictive	Moyen
92	Argument	xxxxxxxxxxxxx_xx	predictive	Élevé
93	Argument	xxx_xx	predictive	Faible
94	Argument	xxxxxx	predictive	Faible
95	Argument	xxxxxx	predictive	Faible
96	Argument	xxxxxx_xxxx	predictive	Moyen
97	Argument	xxxxxxxx	predictive	Moyen
98	Argument	xxxxx_xxxx_xxxx	predictive	Élevé
99	Argument	xxxxxxxxx	predictive	Moyen
100	Argument	xxxxxxxxx	predictive	Moyen
101	Argument	xxxxxxxxx	predictive	Moyen
102	Argument	xxxxxxxx_xx	predictive	Moyen
103	Argument	xxxxxxx_xx	predictive	Moyen
104	Argument	xxxxxx	predictive	Faible
105	Argument	xxxxxxx	predictive	Faible
106	Argument	xxxxxx	predictive	Faible
107	Argument	xxxxxx	predictive	Faible
108	Argument	xxxxxxxxx	predictive	Moyen
109	Argument	xxxxx_xx	predictive	Moyen
110	Argument	xxxx_xx	predictive	Faible
111	Argument	xxxx_xxxxx	predictive	Moyen
112	Argument	x_xxx	predictive	Faible
113	Argument	x-xxxx-xxxxx	predictive	Moyen
114	Argument	xxxxx/xxxxx	predictive	Moyen
115	Input Value	"><xxxxxx>xxxxx(/xxx/)</xxxxxx>	predictive	Élevé
116	Input Value	..	predictive	Faible
117	Input Value	x" xxxxxxxxxxx=xxxxxx(xxxxxx) xxx="	predictive	Élevé
118	Input Value	xxxxx' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx) xxx 'xxxx'='xxxx&xxxxxxxx=xxxxxxxxxx	predictive	Élevé
119	Input Value	xxx_xxx_xxxx_xxxx'"><xxxxxx>xxxxx(/xxxxx.xx/)</xxxxxx>	predictive	Élevé
120	Pattern	() {	predictive	Faible
121	Network Port	xxx/xxxx	predictive	Moyen

Références (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Interested in the pricing of exploits?

See the underground prices here!