ObliqueRAT Analisi

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (546)

Linguaggio

en	506
es	22
it	8
fr	4
zh	2

Nazione

us	514
ru	24
cn	6
tk	2

Attori

ObliqueRAT	2
Conti	2
Fodcha	2
RedLine Stealer	2
Wizard Spider	1

Interesse

Genere

Firewall Software	24
Not Defined	14
Web Server	8
Content Management System	8
Web Browser	2

Fornitore

Not Defined	20
Apache	6
Artica	4
QNAP	4
Genivia	2

Prodotto

Apache HTTP Server	6
WordPress	4
Artica Proxy	4
QNAP Proxy Server	4
Monitorr	2

Vulnerabilità

#	Vulnerabilità	Base	Temp	0day	Oggi	Sfr	Con	EPSS	CTI	CVE
1	Apache HTTP Server mod_proxy_balancer.c balancer_handler cross site scripting	4.3	4.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.21782	0.00	CVE-2012-4558
2	Google Android Proxy Auto-Config ic.cc UpdateLoadElement buffer overflow	8.5	8.2	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00102	0.00	CVE-2019-2047
3	Telegram Desktop Proxy escalazione di privilegi	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00219	0.00	CVE-2018-17613
4	https-proxy-agent JSON buffer overflow	7.2	6.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00659	0.03	CVE-2018-3739
5	Apache HTTP Server mod_proxy_fcgi.c handle_headers buffer overflow	5.3	5.1	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00953	0.03	CVE-2014-3583
6	Apple iOS Proxy Authentication escalazione di privilegi	6.6	6.4	$100k et plus	$5k-$25k	Not Defined	Official Fix	0.00182	0.04	CVE-2016-4642
7	YoungZSoft CCProxy Proxy Service buffer overflow	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.11487	0.00	CVE-2004-2685
8	CNCF Envoy Proxy denial of service	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00341	0.04	CVE-2020-8659
9	Blue Coat ProxySG SGOS rivelazione di un 'informazione	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00139	0.02	CVE-2015-4334
10	Juniper WLC Proxy ARP/No Broadcast Feature escalazione di privilegi	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00712	0.00	CVE-2014-6381
11	Symantec ASG/ProxySG FTP Proxy WebFTP Mode Stored cross site scripting	5.7	5.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00115	0.00	CVE-2018-18370
12	Palo Alto PAN-OS DNS Proxy escalazione di privilegi	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.06716	0.03	CVE-2017-8390
13	QNAP Proxy Server Setting autenticazione debole	6.3	6.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00070	0.00	CVE-2017-7639
14	Squid Web Proxy cachemgr.cgi escalazione di privilegi	6.1	5.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00267	0.04	CVE-2019-18860
15	Bluecoat SGOS Management Console cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00265	0.02	CVE-2010-5192
16	Artica Proxy fw.progrss.details.php directory traversal	7.4	7.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.96791	0.00	CVE-2020-13158
17	Artica Proxy settings.inc escalazione di privilegi	4.9	4.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00130	0.02	CVE-2019-7300
18	Sarg Squid Analysis Report Generator Proxy Server useragent.c useragent buffer overflow	10.0	9.0	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.44560	0.00	CVE-2008-1167
19	Google Android Proxy Configuration hydrogen-alias-analysis.h HAliasAnalyzer.Query escalazione di privilegi	8.5	8.2	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00102	0.04	CVE-2019-2097
20	Check point Firewall-1/VPN-1 IKE Aggressive Mode crittografia debole	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00409	0.03	CVE-2002-1623

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	indirizzo IP	Hostname	Attore	Campagne	Identified	Genere	Fiducia
1	185.117.73.222		ObliqueRAT		31/03/2022	verified	Alto
2	XXX.XXX.XX.XXX		Xxxxxxxxxx		10/08/2022	verified	Alto

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilità	Accesso al vettore	Genere	Fiducia
1	T1006	CWE-22	Path Traversal	predictive	Alto
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	T1059	CWE-94	Argument Injection	predictive	Alto
4	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
6	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
7	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
8	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Alto
9	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
10	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
11	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
12	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto
13	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (33)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Genere	Fiducia
1	File	/assets/php/upload.php	predictive	Alto
2	File	admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list	predictive	Alto
3	File	cachemgr.cgi	predictive	Media
4	File	cgi-bin/cmh/webcam.sh	predictive	Alto
5	File	xxxxxx.x	predictive	Media
6	File	xx.xxxxxxx.xxxxxxx.xxx	predictive	Alto
7	File	xxxxxxxx-xxxxx-xxxxxxxx.x	predictive	Alto
8	File	xx.xx	predictive	Basso
9	File	xxxxxx.xxx	predictive	Media
10	File	xxxxx.xxx	predictive	Media
11	File	xxxxxx.x	predictive	Media
12	File	xxxxx.xxx	predictive	Media
13	File	xxx_xxxxx_xxxxxxxx.x	predictive	Alto
14	File	xxx_xxxxx_xxxx.x	predictive	Alto
15	File	xxxxxxxx_xxxxxx.xxx	predictive	Alto
16	File	xxxxxxxxxx/xxxxxxxx.xxx	predictive	Alto
17	File	xxxxxxxxx.x	predictive	Media
18	File	xxxxx/xxxxx.xx	predictive	Alto
19	File	xxxxxxxxxxxxx.xxxx	predictive	Alto
20	Library	xxxxxxxxx/xxxxxx_xxxxxxxxxxx.xxx.xxx	predictive	Alto
21	Argument	xxxx	predictive	Basso
22	Argument	xxxxxxxxxxxxx	predictive	Alto
23	Argument	xxxxxxxxxxxx	predictive	Media
24	Argument	xxxxxxxx	predictive	Media
25	Argument	xx_xxxxxxxx	predictive	Media
26	Argument	xxxxxxxxx	predictive	Media
27	Argument	xxxx_xxxxx/xxxx_xxxxxxxx	predictive	Alto
28	Argument	xxxxxxx.xxx_xxxxxxxxxx	predictive	Alto
29	Argument	xxxxx	predictive	Basso
30	Argument	xxx	predictive	Basso
31	Argument	xxxxxxxx	predictive	Media
32	Argument	xxxx xxxx	predictive	Media
33	Input Value	%xx%xx%xx	predictive	Media

Referenze (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrecedenteVisione D'insiemeIl prossimo ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!