RATicate Analisi

IOB - Indicator of Behavior (52)

Sequenza temporale

Linguaggio

en30
de14
pl4
es2
fr2

Nazione

Attori

Attività

Interesse

Sequenza temporale

Genere

Fornitore

Prodotto

Microsoft IIS6
PHPChain2
All Enthusiast Inc Reviewpost Php Pro2
thttpd2
Mozilla Firefox2

Vulnerabilità

#VulnerabilitàBaseTemp0dayOggiSfrConEPSSCTICVE
1All Enthusiast Inc Reviewpost Php Pro showproduct.php sql injection7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.005010.00CVE-2004-2175
2PhotoPost PHP Pro showproduct.php sql injection9.89.4$0-$5k$0-$5kNot DefinedOfficial Fix0.002760.04CVE-2004-0250
3OpenSSH Authentication Username rivelazione di un 'informazione5.34.8$5k-$25k$0-$5kHighOfficial Fix0.107370.12CVE-2016-6210
4BitTorrent uTorrent Bencoding Parser escalazione di privilegi6.46.4$0-$5k$0-$5kNot DefinedNot Defined0.008670.02CVE-2020-8437
5MDaemon Webmail cross site scripting5.45.3$0-$5k$0-$5kNot DefinedOfficial Fix0.000700.02CVE-2019-8983
6Synology DiskStation Manager Change Password escalazione di privilegi7.17.0$0-$5k$0-$5kNot DefinedOfficial Fix0.000680.03CVE-2018-8916
7Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.005480.16CVE-2017-0055
8Todd Miller sudo sudoedit sudoers escalazione di privilegi7.87.0$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.000610.00CVE-2015-5602
9Tim Kosse FileZilla Format String7.37.0$25k-$100k$0-$5kNot DefinedOfficial Fix0.033390.04CVE-2007-2318
10BusyBox Terminal lineedit.c add_match escalazione di privilegi7.57.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.005220.07CVE-2017-16544
11Microsoft Office Equation Editor buffer overflow7.57.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.916200.02CVE-2018-0798
12Citrix ADC/Gateway/NetScaler Gateway/SD-WAN WANOP SSL VPN Web Portal cross site scripting3.53.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000780.00CVE-2020-8245
13Gallarific PHP Photo Gallery script gallery.php sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.001120.04CVE-2011-0519
14Gempar Script Toko Online shop_display_products.php sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.001000.02CVE-2009-0296
15K5n WebCalendar send_reminders.php escalazione di privilegi7.36.4$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.056030.02CVE-2008-2836
16Microsoft IIS escalazione di privilegi9.99.9$25k-$100k$5k-$25kNot DefinedNot Defined0.088750.02CVE-2010-1256
17Python urllib.request.AbstractBasicAuthHandler escalazione di privilegi6.46.4$0-$5k$0-$5kNot DefinedOfficial Fix0.008370.07CVE-2020-8492
18nginx URI String escalazione di privilegi6.56.2$0-$5k$0-$5kNot DefinedOfficial Fix0.954330.04CVE-2013-4547
19Microsoft Windows Remote Desktop escalazione di privilegi7.57.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.046620.00CVE-2019-1333
20Mozilla Firefox/Firefox ESR IFRAME PDF.js escalazione di privilegi8.68.2$25k-$100k$0-$5kNot DefinedOfficial Fix0.011460.00CVE-2013-5598

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDindirizzo IPHostnameAttoreCampagneIdentifiedGenereFiducia
179.134.225.11RATicate31/05/2021verifiedAlto
2XX.XXX.XXX.XXXxxxxxxx31/05/2021verifiedAlto

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilitàAccesso al vettoreGenereFiducia
1T1059CWE-94Argument InjectionpredictiveAlto
2T1059.007CWE-79, CWE-80Cross Site ScriptingpredictiveAlto
3TXXXXCWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveAlto
4TXXXXCWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveAlto
5TXXXXCWE-XXXxx XxxxxxxxxpredictiveAlto
6TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveAlto
7TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveAlto
8TXXXXCWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveAlto

IOA - Indicator of Attack (21)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorGenereFiducia
1File/etc/sudoerspredictiveMedia
2File/uncpath/predictiveMedia
3Filecat.phppredictiveBasso
4Filexxxxxx.xxxpredictiveMedia
5Filexxxxxxxxxxx/xxxxx.xxxpredictiveAlto
6Filexxxxxxx.xxxpredictiveMedia
7Filexxxxx/xxxxxxxx.xpredictiveAlto
8Filexxx.xxpredictiveBasso
9Filexxxxxxx_xxx_xxxxx_xxxxxx.xxxxpredictiveAlto
10Filexxxx_xxxxxxxxx.xxxpredictiveAlto
11Filexxxx_xxxxxxx_xxxxxxxx.xxxpredictiveAlto
12Filexxxxxxxxxxx.xxxpredictiveAlto
13Filexxxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxxpredictiveAlto
14ArgumentxxxpredictiveBasso
15ArgumentxxxxxpredictiveBasso
16Argumentxxx_xxpredictiveBasso
17ArgumentxxxxxxxxpredictiveMedia
18ArgumentxxpredictiveBasso
19Argumentxxxx_xxpredictiveBasso
20ArgumentxxxxxpredictiveBasso
21ArgumentxxxxxxxxpredictiveMedia

Referenze (2)

The following list contains external sources which discuss the actor and the associated activities:

Want to stay up to date on a daily basis?

Enable the mail alert feature now!