Tick Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (36)

Langue

en	34
zh	2

De campagne

us	26
cn	8
kr	2

Acteurs

Tick	4
Cobalt Strike	2
PlugX	1

Intérêt

Taper

Not Defined	16
Forum Software	2
Web Server	2
WordPress Plugin	2
Firewall Software	2

Fournisseur

Not Defined	14
Kyocera	2
Canon	2
Bomgar	2
Microsoft	2

Produit

Discuz!	2
PHPWind	2
Kyocera ECOSYS M5526cdw	2
FLDS	2
Task Rabbit Clone	2

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgation de l'information	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	Canon MF210/MF220 System Manager Mode login.html authentification faible	8.5	8.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01367	0.00	CVE-2018-11711
3	WP Contacts Manager Plugin sql injection	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00172	0.00	CVE-2022-1014
4	NodeBB abort cross site request forgery	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00083	0.00	CVE-2022-3978
5	Nodebb JSON File directory traversal	4.6	4.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00104	0.03	CVE-2021-43788
6	TerraMaster TOS Parameter exportUser.php elévation de privilèges	9.3	8.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.96623	0.04	CVE-2020-15568
7	Plex Media Server Camera Upload elévation de privilèges	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01114	0.04	CVE-2019-19141
8	Kyocera ECOSYS M5526cdw Web Application buffer overflow	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00096	0.07	CVE-2019-13206
9	Synacor Zimbra Collaboration XML External Entity	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00441	0.02	CVE-2016-9924
10	Fortinet FortiOS SSL VPN Web Portal buffer overflow	5.4	5.3	$0-$5k	$0-$5k	High	Official Fix	0.00817	0.00	CVE-2018-13383
11	Microsoft IIS cross site scripting	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.29	CVE-2017-0055
12	Discuz! DiscuzX Attachment elévation de privilèges	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00183	0.04	CVE-2018-5259
13	Discuz! admin.php cross site scripting	3.6	3.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00054	0.02	CVE-2018-19464
14	Microsoft SQL Server SQL Master Data Services dénie de service	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00472	0.03	CVE-2014-4061
15	vBulletin redirector.php Redirect	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00122	0.07	CVE-2018-6200
16	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	3.20
17	FLDS redir.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00203	0.43	CVE-2008-5928
18	PHPWind goto.php Redirect	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00348	0.14	CVE-2015-4134
19	MGB OpenSource Guestbook email.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.01302	1.57	CVE-2007-0354
20	esoftpro Online Guestbook Pro ogp_show.php sql injection	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00135	0.00	CVE-2010-4996

IOC - Indicator of Compromise (16)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Identified	Taper	Confiance
1	52.84.186.239	server-52-84-186-239.cdg50.r.cloudfront.net	Tick	22/10/2018	verified	Élevé
2	58.230.118.78	mail.booksr.co.kr	Tick	14/03/2023	verified	Élevé
3	61.106.60.47		Tick	27/03/2022	verified	Élevé
4	103.127.124.76		Tick	14/03/2023	verified	Élevé
5	XXX.XXX.XXX.XXX		Xxxx	14/03/2023	verified	Élevé
6	XXX.XXX.XXX.XXX		Xxxx	05/03/2024	verified	Élevé
7	XXX.XX.XX.XX		Xxxx	14/03/2023	verified	Élevé
8	XXX.XX.XXX.XXX		Xxxx	27/03/2022	verified	Élevé
9	XXX.XX.XXX.XX		Xxxx	22/10/2018	verified	Élevé
10	XXX.XXX.XX.XXX		Xxxx	14/03/2023	verified	Élevé
11	XXX.XXX.XXX.XX		Xxxx	14/10/2022	verified	Élevé
12	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx.xxxxxxxxxxxx.xxx	Xxxx	14/03/2023	verified	Élevé
13	XXX.XXX.XXX.XXX		Xxxx	22/10/2018	verified	Élevé
14	XXX.XXX.XX.XXX	xxxxxxxx.xxxxxxxxxxxxxx.xxx	Xxxx	22/10/2018	verified	Élevé
15	XXX.XX.XXX.XXX		Xxxx	22/10/2018	verified	Élevé
16	XXX.XXX.XX.XXX		Xxxx	27/03/2022	verified	Élevé

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classe	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1		CAPEC-10	CWE-119, CWE-120, CWE-287, CWE-352, CWE-399, CWE-404, CWE-610, CWE-611, CWE-862, CWE-863	Unknown Vulnerability	predictive	Élevé
2	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Élevé
3	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxxxxxxx Xxxxxxxxx	predictive	Élevé
4	TXXXX.XXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxxxx Xxxx Xxxxxxxxx	predictive	Élevé
5	TXXXX	CAPEC-19	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
6	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
7	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxx Xxxxxxxxx	predictive	Élevé
8	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
9	TXXXX.XXX	CAPEC-19	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Élevé

IOA - Indicator of Attack (23)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/forum/away.php	predictive	Élevé
2	File	/login.html	predictive	Moyen
3	File	/register/abort	predictive	Élevé
4	File	/uncpath/	predictive	Moyen
5	File	xxxxx.xxx	predictive	Moyen
6	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Élevé
7	File	xxxxx.xxx	predictive	Moyen
8	File	xxxx.xxx	predictive	Moyen
9	File	xxxxxxxxxxxxxxxxx.xxxx	predictive	Élevé
10	File	xxxxxxx/xxxxxxxxxx.xxx	predictive	Élevé
11	File	xxxxxxx.xxx	predictive	Moyen
12	File	xxxxxxxxx/	predictive	Moyen
13	File	xxx_xxxx.xxx	predictive	Moyen
14	File	xxxxx.xxx	predictive	Moyen
15	File	xxxxxxxxxx.xxx	predictive	Élevé
16	File	xxxxxx_xxxx.xxx	predictive	Élevé
17	Argument	xxx	predictive	Faible
18	Argument	xxxxxxxx_xxxxxx/xxxxxxxx_xxxx/xxxxxxxx_xxxxxxxx/xxxxxxxx_xxxx	predictive	Élevé
19	Argument	xxxx	predictive	Faible
20	Argument	xx	predictive	Faible
21	Argument	xxxxxx	predictive	Faible
22	Argument	xxxxxxxx	predictive	Moyen
23	Argument	xxx	predictive	Faible

Références (5)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Do you need the next level of professionalism?

Upgrade your account now!