menuPass Analisi

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (146)

Linguaggio

en	98
zh	32
fr	6
it	4
ru	2

Nazione

us	128
cn	4
ua	2
it	2
id	2

Attori

menuPass	3
FIN7	1
Dridex	1
TrickBot	1
Conti	1

Interesse

Genere

Not Defined	72
Content Management System	8
Operating System	6
Automation Software	6
Smartphone Operating System	4

Fornitore

Not Defined	46
Apache	10
Apple	6
HPE	4
Oracle	4

Prodotto

ThinkPHP	6
Apache Axis2	4
Apache HTTP Server	2
FreeBSD	2
Seafile	2

Vulnerabilità

#	Vulnerabilità	Base	Temp	0day	Oggi	Sfr	Con	CTI	EPSS	CVE
1	Kubernetes kubelet pprof rivelazione di un 'informazione	7.3	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05	0.55583	CVE-2019-11248
2	shell-quote Windows Drive Letter exec escalazione di privilegi	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00160	CVE-2021-42740
3	Rockwellautomation 1756-ENBT series A Firmware perform escalazione di privilegi	10.0	10.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.48259	CVE-2010-2965
4	Simple Link Directory Plugin SQL Statement qcopd_upvote_action sql injection	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.02705	CVE-2022-0760
5	nginx escalazione di privilegi	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.23	0.00241	CVE-2020-12440
6	Litespeed Technologies OpenLiteSpeed escalazione di privilegi	8.0	7.6	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.06285	CVE-2021-26758
7	DZCP deV!L`z Clanportal config.php escalazione di privilegi	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	1.51	0.00943	CVE-2010-0966
8	emercoin Header denial of service	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00245	CVE-2018-19152
9	OpenSSH Authentication Username rivelazione di un 'informazione	5.3	4.8	$5k-$25k	$0-$5k	High	Official Fix	0.00	0.10737	CVE-2016-6210
10	eSyndicat Directory Software suggest-listing.php cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.05	0.00000
11	Oracle Database Server Privilege Escalation	6.3	6.3	$5k-$25k	$0-$5k	High	Not Defined	0.02	0.05635	CVE-2010-0866
12	WP ALL Export Pro Plugin cross site request forgery	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00136	CVE-2023-5882
13	EMC Replication Manager escalazione di privilegi	4.0	3.8	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00042	CVE-2013-3272
14	WordPress escalazione di privilegi	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.00576	CVE-2013-2204
15	WordPress rivelazione di un 'informazione	4.3	4.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.00358	CVE-2013-2202
16	Cisco Clean Access escalazione di privilegi	9.8	9.3	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.02	0.00850	CVE-2007-0057
17	Fersch Formbankserver AbfrageForm directory traversal	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.01999	CVE-2007-0055
18	Apache Ant ZIP Archive denial of service	4.5	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00073	CVE-2021-36374
19	ThinkPHP Mysql.class.php parseKey sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00153	CVE-2018-18529
20	ThinkPHP Driver.class.php parseOrder sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00163	CVE-2018-18546

Campagne (3)

These are the campaigns that can be associated with the actor:

Cloud Hopper
Xxxxxxx
Xxxxxx Xxx

IOC - Indicator of Compromise (18)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	indirizzo IP	Hostname	Attore	Campagne	Identified	Genere	Fiducia
1	60.2.148.167		menuPass	Poison Ivy	17/12/2020	verified	Alto
2	60.10.1.114	hebei.10.60.in-addr.arpa	menuPass	Poison Ivy	17/12/2020	verified	Alto
3	60.10.1.115	hebei.10.60.in-addr.arpa	menuPass	Poison Ivy	17/12/2020	verified	Alto
4	60.10.1.120	hebei.10.60.in-addr.arpa	menuPass	Poison Ivy	17/12/2020	verified	Alto
5	XX.XX.X.XXX	xxxxx.xx.xx.xx-xxxx.xxxx	Xxxxxxxx	Xxxxxx Xxx	17/12/2020	verified	Alto
6	XX.XXX.XXX.XX	xxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxxx	Xxxxx Xxxxxx	17/12/2020	verified	Alto
7	XX.XXX.XXX.XX	xxx.xxxxxxxx.xxx	Xxxxxxxx		17/12/2020	verified	Alto
8	XX.XXX.XXX.XXX	xxxxx.xxxxxxxxxx.xxx	Xxxxxxxx	Xxxxxxx	17/12/2020	verified	Alto
9	XX.XXX.XXX.XXX		Xxxxxxxx		13/02/2024	verified	Alto
10	XX.XXX.XXX.XXX	xxxxxxxx.xx	Xxxxxxxx		13/02/2024	verified	Alto
11	XXX.XXX.XXX.XX		Xxxxxxxx	Xxxxxx Xxx	17/12/2020	verified	Alto
12	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx.xxxxxx.xxxx.xx	Xxxxxxxx	Xxxxx Xxxxxx	17/12/2020	verified	Alto
13	XXX.XX.XX.XX		Xxxxxxxx	Xxxxxxx	17/12/2020	verified	Alto
14	XXX.XXX.XX.XXX		Xxxxxxxx		17/12/2020	verified	Alto
15	XXX.XX.XXX.XXX		Xxxxxxxx		17/12/2020	verified	Alto
16	XXX.XX.XXX.XXX	xxxxxxx.xxxxx.xxx	Xxxxxxxx		17/12/2020	verified	Alto
17	XXX.XX.XXX.XXX		Xxxxxxxx		13/02/2024	verified	Alto
18	XXX.XX.XXX.XX	xxxxxxxxxx.xxxxxxxxx.xxxx	Xxxxxxxx		10/03/2022	verified	Alto

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilità	Accesso al vettore	Genere	Fiducia
1	T1006	CWE-22	Path Traversal	predictive	Alto
2	T1059	CWE-94, CWE-1321	Argument Injection	predictive	Alto
3	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Alto
4	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
5	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
6	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
7	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
8	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Alto
9	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
10	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
11	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
12	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto
13	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (73)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Genere	Fiducia
1	File	/anony/mjpg.cgi	predictive	Alto
2	File	/debug/pprof	predictive	Media
3	File	/secure/admin/InsightDefaultCustomFieldConfig.jspa	predictive	Alto
4	File	/uncpath/	predictive	Media
5	File	ArchivesMapper.xml	predictive	Alto
6	File	blind\source\high.php	predictive	Alto
7	File	cart.php	predictive	Media
8	File	cat.php	predictive	Basso
9	File	categorie.php3	predictive	Alto
10	File	xxxxx/xxxxxxxx-xxxxxxxxx/xxxxxxxxxxxxxxx.xxxxx.xxx	predictive	Alto
11	File	xxx.xxxxxxx.xxx	predictive	Alto
12	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Alto
13	File	xxxxxx.xx	predictive	Media
14	File	xxxx.xxx	predictive	Media
15	File	xxx_xxxxxx_xxx_xxxxxx.x	predictive	Alto
16	File	xxxxxxxxxxx.xxx/xxxxxxxxxxx	predictive	Alto
17	File	xxxxxxxxx/xxxxx/xxxxxxx_xxxxxxx.xxx	predictive	Alto
18	File	xxxxxx.xx	predictive	Media
19	File	xxx/xxxxxx.xxx	predictive	Alto
20	File	xxxxxxx_xxxx/xxxxxxxx.xxx	predictive	Alto
21	File	xxxxx.xxx	predictive	Media
22	File	xxxxxxxxx/xxx/xxx_xxxxxxxx.xxx	predictive	Alto
23	File	xxx.x	predictive	Basso
24	File	xxxxxxxx/xxxxxxxxx	predictive	Alto
25	File	xxxxxxx/xxxxx/xx/xxxxxx.xxxxx.xxx	predictive	Alto
26	File	xxxxxxx/xxxxx/xx/xxxxxx/xxxxx.xxxxx.xxx	predictive	Alto
27	File	xxx.xxx	predictive	Basso
28	File	xxxx_xxx.xxxx	predictive	Alto
29	File	xxxxxxx.xxx	predictive	Media
30	File	xxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]	predictive	Alto
31	File	xxxx/xxxxx	predictive	Media
32	File	xxxxxx_xxxxxx.xxx	predictive	Alto
33	File	xxxx.xxx	predictive	Media
34	File	xxxxxxx.xxx	predictive	Media
35	File	xxxxxxxxx.xxx	predictive	Alto
36	File	xxxxxxx-xxxxxxx.xxx	predictive	Alto
37	File	xxxxxxxxx/xxxxxxxxxx	predictive	Alto
38	File	xx-xxxxx/xxxxxxxx/xxxxx-xxxx-xxxxxx-xxxxxxxx.xxx	predictive	Alto
39	File	xx-xxxx.xxx	predictive	Media
40	File	xxxx.xx	predictive	Basso
41	Argument	xxxxxxxxxxx	predictive	Media
42	Argument	xxxxxxxx	predictive	Media
43	Argument	xxxxx	predictive	Basso
44	Argument	xxxxx	predictive	Basso
45	Argument	xxx	predictive	Basso
46	Argument	xxxxxxxxxxxxxx	predictive	Alto
47	Argument	xxxxxxx	predictive	Basso
48	Argument	xx	predictive	Basso
49	Argument	xxxxxxxxxxx	predictive	Media
50	Argument	xxxxxxxxxxxxxxx	predictive	Alto
51	Argument	xxxxxxx_xxxxxxx	predictive	Alto
52	Argument	xxxxxxx[xx_xxx_xxxx]	predictive	Alto
53	Argument	xxxx_xxxx/xxxxxxx_xxxxxxxxxxx	predictive	Alto
54	Argument	xx	predictive	Basso
55	Argument	xxx	predictive	Basso
56	Argument	xxxxx	predictive	Basso
57	Argument	xxxxxx	predictive	Basso
58	Argument	xxxx	predictive	Basso
59	Argument	xxxx/xxxxxxx	predictive	Media
60	Argument	xxxxxx xxxxxx	predictive	Alto
61	Argument	xxxxx	predictive	Basso
62	Argument	xxxxxxxx	predictive	Media
63	Argument	xxxxxxxx	predictive	Media
64	Argument	xxxxxxxx	predictive	Media
65	Argument	xxx_xxxx	predictive	Media
66	Argument	xxxx_xx	predictive	Basso
67	Argument	xxxx	predictive	Basso
68	Argument	xxxxx	predictive	Basso
69	Argument	xxxxxxxxx	predictive	Media
70	Argument	xxxxxxxxx	predictive	Media
71	Input Value	::$xxxxx_xxxxxxxxxx	predictive	Alto
72	Input Value	xxxx	predictive	Basso
73	Network Port	xxx xxxxxx xxxx	predictive	Alto

Referenze (7)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrecedenteVisione D'insiemeIl prossimo ▸

Do you know our Splunk app?

Download it now for free!