SharpPanda Analisi

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (140)

Linguaggio

en	108
zh	24
jp	4
it	2
de	2

Nazione

us	82
cn	30
sg	22
jp	4
mt	2

Attori

SharpPanda	11
Cobalt Strike	5
XOR DDoS	1
Meterpreter	1
Pikabot	1

Interesse

Genere

Not Defined	34
Firewall Software	10
Programming Language Software	6
Web Server	6
Database Software	6

Fornitore

Not Defined	30
Oracle	14
Palo Alto	8
Citrix	8
Cisco	4

Prodotto

Palo Alto PAN-OS	8
Oracle WebLogic Server	4
Oracle MySQL Server	4
PHP	4
PHP Link Directory	2

Vulnerabilità

#	Vulnerabilità	Base	Temp	0day	Oggi	Sfr	Con	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash rivelazione di un 'informazione	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	vu Mass Mailer Login Page redir.asp sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00181	0.07	CVE-2007-6138
3	PHP phpinfo cross site scripting	6.3	5.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.08985	0.04	CVE-2006-0996
4	vBulletin redirector.php Redirect	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00122	0.13	CVE-2018-6200
5	Cisco ASA Versione rivelazione di un 'informazione	5.3	4.6	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00288	0.04	CVE-2014-3398
6	Apache HTTP Server mod_ssl ap_hook_process_connection denial of service	7.5	7.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01166	0.00	CVE-2017-3169
7	PHP phpinfo cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02101	0.04	CVE-2007-1287
8	Serendipity exit.php escalazione di privilegi	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.32
9	WoltLab Burning Book addentry.php sql injection	7.3	6.8	$0-$5k	$0-$5k	Functional	Unavailable	0.00804	0.02	CVE-2006-5509
10	Linux Foundation Xen EFLAGS Register SYSENTER escalazione di privilegi	6.2	5.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00062	0.02	CVE-2013-1917
11	AXIS 2110 Network Camera editcgi.cgi directory traversal	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01492	0.02	CVE-2004-2426
12	Synology DiskStation Manager SliceUpload imageSelector.cgi escalazione di privilegi	6.5	6.2	$0-$5k	$0-$5k	High	Official Fix	0.97296	0.05	CVE-2013-6955
13	Hestia Control Panel Domain Name Privilege Escalation	5.9	5.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00139	0.00	CVE-2021-27231
14	Bitrix Site Manager redirect.php escalazione di privilegi	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00113	0.03	CVE-2008-2052
15	PHP Link Directory Administration Page index.html cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00374	0.38	CVE-2007-0529
16	Moodle escalazione di privilegi	6.5	6.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00060	0.03	CVE-2023-35133
17	Extreme Networks ExtremeWireless Aerohive HiveOS/IQ Engine NetConfig UI Administrative Interface escalazione di privilegi	8.8	8.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.85139	0.02	CVE-2020-16152
18	Advance B2B Script tradeshow-list-detail.php sql injection	8.5	8.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00242	0.00	CVE-2017-17602
19	Asus NAS-M25 Cookie escalazione di privilegi	9.8	9.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.91647	0.04	CVE-2022-4221
20	Apache Log4j Socket Server escalazione di privilegi	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.81948	0.02	CVE-2017-5645

Campagne (1)

These are the campaigns that can be associated with the actor:

G20 Nations

IOC - Indicator of Compromise (14)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	indirizzo IP	Hostname	Attore	Campagne	Identified	Genere	Fiducia
1	13.236.189.80	ec2-13-236-189-80.ap-southeast-2.compute.amazonaws.com	SharpPanda	G20 Nations	02/06/2023	verified	Media
2	45.76.190.210	45.76.190.210.vultrusercontent.com	SharpPanda		10/03/2023	verified	Alto
3	45.91.225.139		SharpPanda		10/02/2022	verified	Alto
4	XX.XXX.XXX.XX	xxxxxxx-xxxxxxxx.xxxxxxxx.xxx	Xxxxxxxxxx		10/02/2022	verified	Alto
5	XX.XXX.XXX.XX		Xxxxxxxxxx		10/03/2023	verified	Alto
6	XX.XXX.XXX.XX		Xxxxxxxxxx		10/03/2023	verified	Alto
7	XXX.XX.XXX.XX		Xxxxxxxxxx		10/03/2023	verified	Alto
8	XXX.XXX.XXX.XX		Xxxxxxxxxx		10/03/2023	verified	Alto
9	XXX.XXX.XXX.XXX		Xxxxxxxxxx		10/03/2023	verified	Alto
10	XXX.XXX.XXX.XX		Xxxxxxxxxx		10/03/2023	verified	Alto
11	XXX.XXX.XXX.XXX	xxxxx.xxxxxxx.xxx	Xxxxxxxxxx		10/02/2022	verified	Alto
12	XXX.XXX.XXX.XX	xxx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx		10/03/2023	verified	Alto
13	XXX.XXX.XXX.XX	xxx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx		10/03/2023	verified	Alto
14	XXX.XX.XXX.XX		Xxxxxxxxxx		10/03/2023	verified	Alto

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classe	Vulnerabilità	Accesso al vettore	Genere	Fiducia
1	T1006	CAPEC-126	CWE-22, CWE-23	Path Traversal	predictive	Alto
2	T1040	CAPEC-102	CWE-294	Authentication Bypass by Capture-replay	predictive	Alto
3	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
4	TXXXX	CAPEC-137	CWE-XX, CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	Alto
5	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
6	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
7	TXXXX.XXX	CAPEC-0	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	Alto
8	TXXXX	CAPEC-150	CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	predictive	Alto
9	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
10	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
11	TXXXX	CAPEC-0	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Alto
12	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
13	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
14	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
15	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto

IOA - Indicator of Attack (60)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Genere	Fiducia
1	File	/cgi-bin/system_mgr.cgi	predictive	Alto
2	File	/data/config.ftp.php	predictive	Alto
3	File	/forum/away.php	predictive	Alto
4	File	/modules/profile/index.php	predictive	Alto
5	File	/out.php	predictive	Media
6	File	/tmp	predictive	Basso
7	File	/uncpath/	predictive	Media
8	File	xxxxxxx.xxx	predictive	Media
9	File	xxxxxxxx.xxx	predictive	Media
10	File	xxxxx_xxxxx.xxx	predictive	Alto
11	File	xxxx-xxxxxxx.x	predictive	Alto
12	File	xxxxxxxxxxxx.xxx/xxxxxxxxxxx.xxx/xxxxxxxxxxx.xxx/xxxxxxxxxxx.xxx	predictive	Alto
13	File	xxx-xxx/xxxxxx.xxx	predictive	Alto
14	File	xxxxxxx.xxx	predictive	Media
15	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Alto
16	File	xxxxxxx.xxxxx.xxx	predictive	Alto
17	File	xxxxxxx.xxx	predictive	Media
18	File	xxxx.xxx	predictive	Media
19	File	xxx_xxxx.x	predictive	Media
20	File	xxxx.xxx	predictive	Media
21	File	xxxx_xxxxx.x	predictive	Media
22	File	xxx/xxxxxx.xxx	predictive	Alto
23	File	xxxxx.xxxx	predictive	Media
24	File	xxxxx.xxx	predictive	Media
25	File	xxx-xxx.xxxx.xx	predictive	Alto
26	File	xxxxx.xxx	predictive	Media
27	File	xxxxxxxx.xxx	predictive	Media
28	File	xxxxxxxxxx.xxx	predictive	Alto
29	File	xxxxxxxxx-xxxx-xxxxxx.xxx	predictive	Alto
30	File	xxx.xxx	predictive	Basso
31	File	xxxxxx/xxxxxxxxxxxxx.xxx	predictive	Alto
32	Library	xxxxxxxx.xxx	predictive	Media
33	Library	xxxxxxxx/xxxxxxx/xxxxx/xxx.xxx	predictive	Alto
34	Library	xxxxxxxxxxx.xxx	predictive	Alto
35	Argument	--xxxxxx/--xxxxxxxx	predictive	Alto
36	Argument	xxxxxx	predictive	Basso
37	Argument	xxxxxx/xxxx/xxxx/xxxxx/xxxxxx/x_xxxxxxx/x_xxxxxxxx/x_xxxxxxx/x_xxxxx	predictive	Alto
38	Argument	xxxxxx/xxxxxxxx/xxxxxxxxxxxxxx	predictive	Alto
39	Argument	xxxxxxxxxxx	predictive	Media
40	Argument	xxx_xxxxx_xxxx	predictive	Alto
41	Argument	xxxxxxxx	predictive	Media
42	Argument	xxxxxxx	predictive	Basso
43	Argument	xxxxxx	predictive	Basso
44	Argument	xxxx	predictive	Basso
45	Argument	xxxx	predictive	Basso
46	Argument	xxxxxxxx	predictive	Media
47	Argument	xx	predictive	Basso
48	Argument	xx	predictive	Basso
49	Argument	xxxxxx	predictive	Basso
50	Argument	xxxxxxxx	predictive	Media
51	Argument	xxxx	predictive	Basso
52	Argument	xxxxxxx	predictive	Basso
53	Argument	xxxx_xx	predictive	Basso
54	Argument	xxx	predictive	Basso
55	Argument	xxx	predictive	Basso
56	Argument	xxxxxxxx	predictive	Media
57	Argument	xxxxxxxx/xxxxxxxx	predictive	Alto
58	Input Value	../	predictive	Basso
59	Input Value	x' xx x=x--	predictive	Media
60	Network Port	xxx xxxxxx xxxx	predictive	Alto

Referenze (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrecedenteVisione D'insiemeIl prossimo ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!