Dark Caracal Analisi

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (329)

Linguaggio

en	268
zh	56
ru	4
ja	2

Nazione

la	210
cz	32
cn	32
us	28
my	16

Attori

Cobalt Strike	9
Dark Caracal	7
AsyncRAT	7
Ave Maria	7
RedLine Stealer	7

Interesse

Genere

Not Defined	88
Content Management System	34
WordPress Plugin	16
Programming Language Software	10
Advertising Software	10

Fornitore

Not Defined	122
Microsoft	12
Revive	10
Oracle	8
Apache	6

Prodotto

Revive Adserver	10
WordPress	8
Liferay Portal	6
DedeCMS	6
Adobe ColdFusion	4

Vulnerabilità

#	Vulnerabilità	Base	Temp	0day	Oggi	Sfr	Con	EPSS	CTI	CVE
1	TikiWiki tiki-register.php escalazione di privilegi	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01009	1.73	CVE-2006-6168
2	Synacor Zimbra Collaboration mboximport directory traversal	4.7	4.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.96142	0.00	CVE-2022-27925
3	DEXT5 DEXT5Upload dext5handler.jsp escalazione di privilegi	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01228	0.02	CVE-2020-13442
4	DEXT5Upload dext5handler.jsp directory traversal	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00503	0.02	CVE-2020-35362
5	Tiki Admin Password tiki-login.php autenticazione debole	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	2.96	CVE-2020-15906
6	DZCP deV!L`z Clanportal config.php escalazione di privilegi	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.72	CVE-2010-0966
7	nginx escalazione di privilegi	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	3.30	CVE-2020-12440
8	FasterXML jackson-databind escalazione di privilegi	9.8	9.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00410	0.04	CVE-2019-14540
9	Liferay Portal escalazione di privilegi	9.8	8.8	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00578	0.00	CVE-2011-1571
10	Drupal Sanitization API cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00056	0.02	CVE-2020-13672
11	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	3.59
12	LiteSpeed Cache Plugin Shortcode cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00051	0.03	CVE-2023-4372
13	WebTitan Appliance Extensions Persistent cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
14	ipTIME NAS-I Bulletin Manage escalazione di privilegi	7.1	7.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00988	0.03	CVE-2020-7847
15	request-baskets API Request {name} escalazione di privilegi	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.08109	0.00	CVE-2023-27163
16	PHP phpinfo cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02101	0.04	CVE-2007-1287
17	Microsoft Windows Scripting Engine Remote Code Execution	5.9	5.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.37113	0.00	CVE-2021-34480
18	DevExpress ASP.NET Web Forms ASPxHttpHandlerModule DXR.axd escalazione di privilegi	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00183	0.08	CVE-2022-41479
19	CodeIgniter old escalazione di privilegi	6.6	6.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.06897	0.02	CVE-2022-21647
20	Basilix Webmail login.php3 escalazione di privilegi	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.02

IOC - Indicator of Compromise (9)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	indirizzo IP	Hostname	Attore	Identified	Genere	Fiducia
1	74.208.167.252		Dark Caracal	16/12/2020	verified	Alto
2	77.78.103.41	assigned-77-78-103-41.dc3.cz	Dark Caracal	16/12/2020	verified	Alto
3	XXX.XX.XXX.XX	xxxxx.xxxxxxxx.xxxx	Xxxx Xxxxxxx	16/12/2020	verified	Alto
4	XXX.XX.XXX.XX	xxxxxxx.xxxxx.xx	Xxxx Xxxxxxx	16/12/2020	verified	Alto
5	XXX.XX.XXX.XXX	xxxxx.xxxxxxxxxxxxx.xxx	Xxxx Xxxxxxx	16/12/2020	verified	Alto
6	XXX.XX.XXX.XXX	xxxxxxx.xxxxx.xx	Xxxx Xxxxxxx	16/12/2020	verified	Alto
7	XXX.XX.XXX.XXX	xxxxxxx.xxxxx.xx	Xxxx Xxxxxxx	16/12/2020	verified	Alto
8	XXX.XXX.XXX.XXX		Xxxx Xxxxxxx	16/12/2020	verified	Alto
9	XXX.XXX.XXX.XX		Xxxx Xxxxxxx	16/12/2020	verified	Alto

TTP - Tactics, Techniques, Procedures (20)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilità	Accesso al vettore	Genere	Fiducia
1	T1006	CWE-21, CWE-22, CWE-24	Path Traversal	predictive	Alto
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	T1059	CWE-88, CWE-94, CWE-1321	Argument Injection	predictive	Alto
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Alto
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
6	TXXXX.XXX	CWE-XXX, CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
8	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
9	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Alto
10	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Alto
11	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
12	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Alto
13	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
14	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	Alto
15	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
16	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
17	TXXXX.XXX	CWE-XX	Xxxxxxxxxxxxx	predictive	Alto
18	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto
19	TXXXX.XXX	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Alto
20	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (161)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Genere	Fiducia
1	File	/admin/dl_sendmail.php	predictive	Alto
2	File	/adminPage/conf/reload	predictive	Alto
3	File	/api/baskets/{name}	predictive	Alto
4	File	/api/v2/cli/commands	predictive	Alto
5	File	/apply.cgi	predictive	Media
6	File	/dede/sys_sql_query.php	predictive	Alto
7	File	/Device/Device/GetDeviceInfoList?deviceCode=&searchField=&deviceState=	predictive	Alto
8	File	/DXR.axd	predictive	Media
9	File	/forum/away.php	predictive	Alto
10	File	/mfsNotice/page	predictive	Alto
11	File	/novel/bookSetting/list	predictive	Alto
12	File	/novel/userFeedback/list	predictive	Alto
13	File	/owa/auth/logon.aspx	predictive	Alto
14	File	/spip.php	predictive	Media
15	File	/usr/bin/pkexec	predictive	Alto
16	File	/x_portal_assemble_surface/jaxrs/portal/list?v=8.2.3-4-43f4fe3	predictive	Alto
17	File	/zm/index.php	predictive	Alto
18	File	adclick.php	predictive	Media
19	File	admin.jcomments.php	predictive	Alto
20	File	xxxxx/xxxx-xxxxxxx/xxxxxxxxxxx	predictive	Alto
21	File	xxxxxxxxxxx/xxxxxxx/xxxxx/xxxxx/xxxxxxxxx/xxxxxxxx.xxx	predictive	Alto
22	File	xxxxx.xxx	predictive	Media
23	File	xxxxxxxxxxx.xxx	predictive	Alto
24	File	xxxx/xxxxxxxxxxxx.xxx	predictive	Alto
25	File	xxxx.xxx	predictive	Media
26	File	xx_xxxx_xx_xxxx_xxxx.xxx	predictive	Alto
27	File	xxxx_xxxxxxx.xxx	predictive	Alto
28	File	xxx-xxx/xxxxxxx.xx	predictive	Alto
29	File	xxxxx.xxx	predictive	Media
30	File	xxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxx/xxxx_xxxxx.xxxx	predictive	Alto
31	File	xxxxx-xxxxxxx.xxx	predictive	Alto
32	File	xxxxxxxxxx/xxx_xxxxxxxxxx/xxxxxxx/xxxxxxxxxx.xxx	predictive	Alto
33	File	xxxxxx.xxx	predictive	Media
34	File	xxxxxxxxxx\xxxx.xxx	predictive	Alto
35	File	xxxxxxxxxxx.xxx	predictive	Alto
36	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Alto
37	File	xxxxxxxxxxxx.xxx	predictive	Alto
38	File	xxxx-xxxxxx.xxx	predictive	Alto
39	File	xxxx.xxx	predictive	Media
40	File	xxxxxxxxxxx.xxxxx.xxx	predictive	Alto
41	File	xxxx.xxx	predictive	Media
42	File	xxxxx_xxxxxxxx.xxx	predictive	Alto
43	File	xxxxx_xxxx.xxx	predictive	Alto
44	File	xxxxxxxxxx\xxxxxx\xxxxxxxxxxxxx.xxx	predictive	Alto
45	File	xxxxxxx/xxxxxxxxxxxx.xxx	predictive	Alto
46	File	xxx/xxxxxx.xxx	predictive	Alto
47	File	xxxxxxxx/xxxxxxx/xxxxxxx.xxxx.xxx	predictive	Alto
48	File	xxxxx.xxxx	predictive	Media
49	File	xxxxx.xxx	predictive	Media
50	File	xxxxx.xxx/xxxxxx.xxx/xxxxxxxxxxxxx.xxx/xxxxxxxx.xxx	predictive	Alto
51	File	xxxxx.xxx?x=xxxx&x=xxxx&x=xx_xxx_xxxxxx	predictive	Alto
52	File	xxxxx.xxx?x=xxxx&x=xxxxxxx&x=xxx	predictive	Alto
53	File	xxx.x	predictive	Basso
54	File	xxxx_xxxxxxx.xxx	predictive	Alto
55	File	xx/xxx/xxxxxxxx/xxx_xxxxxxxxx/xxx_xxxxxxxx_xxxxx/_/xxxxxxx_xxx	predictive	Alto
56	File	xxxxx.xxxx	predictive	Media
57	File	xxxxx.xxx	predictive	Media
58	File	xxxx.xxxx	predictive	Media
59	File	xx_xxxx.x	predictive	Media
60	File	xxxxxxx/xxxxxxxx/xxxxxxxx.xxx	predictive	Alto
61	File	xxx/xxxx/xxxx_xxxxxxxxx.x	predictive	Alto
62	File	xxx/xxxxxxxxx/xx_xxxxxx_xxx.x	predictive	Alto
63	File	xxxxxxx_xxxx.xxx	predictive	Alto
64	File	xxxxxxxxxxxxxxxxx.xxx	predictive	Alto
65	File	xxxxxxx.xxx	predictive	Media
66	File	xxxxxxx/xxxxxxx/xxx/xxxxxxxxxx.xxx?xxxxxxxx=xxxx&xxxxxx=xxxxxxxxxx	predictive	Alto
67	File	xxxxxxx_xxxx.xxx	predictive	Alto
68	File	xxxxx.xxx	predictive	Media
69	File	xxxx_xxxx_xxxxxx.xxx	predictive	Alto
70	File	xxxx.xxx	predictive	Media
71	File	xxxxxxxx-xxxxxxxxxxx.xxx	predictive	Alto
72	File	xxxx_xxxxx.xxxx	predictive	Alto
73	File	xxxxxxxxxx_xxxx.xxx	predictive	Alto
74	File	xxx/xxxx/xxxx	predictive	Alto
75	File	xxxxxx/xxxxx/xxxx_xxxxxxx.xxx	predictive	Alto
76	File	xxxxxx\xxxxxxxx\xx_xxxxx_xxxxxxx.xxx	predictive	Alto
77	File	xxxxxxx.xxx.xx.xxxxxxxxxxx.xxx	predictive	Alto
78	File	xxxxxxxxx/xxxxxxxx.xxx	predictive	Alto
79	File	xxxx_xxxxxx.xx	predictive	Alto
80	File	xxxx-xxxxx.xxx	predictive	Alto
81	File	xxxx-xxxxxxxx.xxx	predictive	Alto
82	File	xxxxxxxx.xxx	predictive	Media
83	File	xxxxxx_xxxxx.xxx	predictive	Alto
84	File	xxxxxx.xxx	predictive	Media
85	File	xxxxxxx-xxxxx.xxx	predictive	Alto
86	File	xxxx_xxxxx.xxx	predictive	Alto
87	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	Alto
88	File	xxxx.xxx	predictive	Media
89	File	xx-xxxxx/xxxx.xxx	predictive	Alto
90	File	xx-xxxxx-xxxxxx.xxx	predictive	Alto
91	File	xx-xxxxxxxx/xxxxxxxxx.xxx	predictive	Alto
92	File	xxx/xxxxxxxx/xxxxxxxx.xxx	predictive	Alto
93	File	xxxx.xxx	predictive	Media
94	File	~/xxx/xxxx-xxxxxxxxx.xxx	predictive	Alto
95	File	~/xxxxxxxx/xxxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	Alto
96	File	~/xxxxxxxx/xxxxx-xx-xxxxxxxxxx-xxxxxxxxx.xxx	predictive	Alto
97	File	~/xxxxxxxx/xxxxxx/xxxxxx.xxx	predictive	Alto
98	Library	xxxxxxx/xxx.xxx.xxx.xxx	predictive	Alto
99	Argument	xxxxxxx xx/xxxxxxx xxxx	predictive	Alto
100	Argument	xxx_xxx	predictive	Basso
101	Argument	xxxx	predictive	Basso
102	Argument	xxxxxxxxx	predictive	Media
103	Argument	xxxxxxxx	predictive	Media
104	Argument	xxx_xxx_xx_xxx_xxxxxxxxxx_x	predictive	Alto
105	Argument	xxxxx_xxxx	predictive	Media
106	Argument	xxxx_xxx_xxxx	predictive	Alto
107	Argument	xxxxxxxxxx	predictive	Media
108	Argument	xxx	predictive	Basso
109	Argument	xxxxxxxxxxxxxxx	predictive	Alto
110	Argument	xxxxxx	predictive	Basso
111	Argument	xxxxxxxxxxxxx	predictive	Alto
112	Argument	xxxx	predictive	Basso
113	Argument	xxxxx	predictive	Basso
114	Argument	xxxxxxxxx_xxxxxx	predictive	Alto
115	Argument	xxxxxxxxx	predictive	Media
116	Argument	xx_xxxxxxx	predictive	Media
117	Argument	xxxx	predictive	Basso
118	Argument	xxxxxxxx	predictive	Media
119	Argument	xxxxx	predictive	Basso
120	Argument	xxxxxxxxxxxxxxx	predictive	Alto
121	Argument	xxxxxx_xxxxx	predictive	Media
122	Argument	xx_xx	predictive	Basso
123	Argument	xxxxxxx[xxxxxxx]	predictive	Alto
124	Argument	xxxxxxx	predictive	Basso
125	Argument	xxxxxx	predictive	Basso
126	Argument	xxxxx	predictive	Basso
127	Argument	xxxxxx_xxxx_xxx	predictive	Alto
128	Argument	xx	predictive	Basso
129	Argument	xxx	predictive	Basso
130	Argument	xxxx	predictive	Basso
131	Argument	xxxx	predictive	Basso
132	Argument	xxx xxxxxxxx/xxxxxxx xxxxxxxx	predictive	Alto
133	Argument	xxxxxxxx	predictive	Media
134	Argument	xx	predictive	Basso
135	Argument	xxxxxx/xxxxx/xxxx	predictive	Alto
136	Argument	xxxxxxx	predictive	Basso
137	Argument	xxxx	predictive	Basso
138	Argument	xxxxxxxx	predictive	Media
139	Argument	xxxxxx_xxxxxx	predictive	Alto
140	Argument	xxxxxxx xxxx	predictive	Media
141	Argument	xxxxxxxx_xx	predictive	Media
142	Argument	xxx_xxxxxx	predictive	Media
143	Argument	xxxxxx_xxxxx	predictive	Media
144	Argument	xxxxxxxx	predictive	Media
145	Argument	xxxx_xxxx	predictive	Media
146	Argument	xxxx	predictive	Basso
147	Argument	xxx	predictive	Basso
148	Argument	xxxxxx	predictive	Basso
149	Argument	xxxxxx_xxxx[]	predictive	Alto
150	Argument	xxxxxxx	predictive	Basso
151	Argument	xxx	predictive	Basso
152	Argument	xxxxx	predictive	Basso
153	Argument	xx_xxxxxxxx	predictive	Media
154	Argument	xxx	predictive	Basso
155	Argument	xxxxxxxx	predictive	Media
156	Argument	_xxx_xxxxxxxxxxx_	predictive	Alto
157	Input Value	xxxxx	predictive	Basso
158	Input Value	xxxxxxxxx' xxx 'x'='x	predictive	Alto
159	Input Value	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx	predictive	Alto
160	Pattern	\|xx xx xx xx\|	predictive	Alto
161	Network Port	xxxxx	predictive	Basso

Referenze (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrecedenteVisione D'insiemeIl prossimo ▸

Do you know our Splunk app?

Download it now for free!