TeleBots 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (159)

言語

en	136
de	12
es	6
it	2
fr	2

国・地域

us	60
ch	52
ru	10
nl	6
pl	4

アクター

TeleBots	4
RTM	1
APT10	1
APT28	1
Bandook	1

関心

タイプ

Not Defined	46
Content Management System	14
Web Server	12
Operating System	10
Forum Software	6

ベンダー

Not Defined	62
Apache	8
GNU	6
Linux	6
Apple	4

製品

WordPress	8
Apache HTTP Server	8
Linux Kernel	6
phpBB	4
NVIDIA Windows GPU Display Driver	4

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	CTI	EPSS	CVE
1	Backdoor.Win32.Tiny.c Service Port 7778 特権昇格	7.3	6.4	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.04	0.00000
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash 情報の漏洩	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02	0.02016	CVE-2007-1192
3	Linux Kernel NILFS File System inode.c security_inode_alloc メモリ破損	8.3	8.1	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.02	0.00042	CVE-2022-2978
4	Crow HTTP Pipelining メモリ破損	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	0.00416	CVE-2022-38667
5	mySCADA myPRO 特権昇格	9.2	9.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00105	CVE-2022-2234
6	GNU Bash Environment Variable variables.c Shellshock 特権昇格	9.8	9.3	$100k 以上	$0-$5k	High	Official Fix	0.09	0.97564	CVE-2014-6271
7	Microsoft Visual Studio XML External Entity	6.3	5.5	$5k-$25k	$0-$5k	Proof-of-Concept	Unavailable	0.00	0.00000
8	ProFTPD mod_copy 特権昇格	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.94462	CVE-2019-12815
9	OpenSSH Authentication Username 情報の漏洩	5.3	4.8	$5k-$25k	$0-$5k	High	Official Fix	0.04	0.10737	CVE-2016-6210
10	Zeus Zeus Web Server メモリ破損	10.0	9.0	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.11877	CVE-2010-0359
11	WordPress WP_Query class-wp-query.php SQLインジェクション	8.5	8.4	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.00318	CVE-2017-5611
12	Git Plugin Build 特権昇格	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.05	0.01156	CVE-2022-36883
13	FreeBSD Ping pr_pack メモリ破損	7.3	7.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.00043	CVE-2022-23093
14	Red Hat OpenShift server_priv.pem 特権昇格	4.5	4.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00	0.00042	CVE-2013-4281
15	Linux Kernel NTFS3 Subsystem Privilege Escalation	7.0	7.0	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.03	0.00042	CVE-2022-3238
16	SQLite ALTER TABLE メモリ破損	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00221	CVE-2020-35527
17	md2roff Markdown File メモリ破損	7.6	7.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.00208	CVE-2022-41220
18	Nissan/Kia/Hyundai Vehicle Remote Keyless Entry RollBack 弱い認証	6.4	6.4	$5k-$25k	$5k-$25k	Proof-of-Concept	Not Defined	0.02	0.00333	CVE-2022-37418
19	Citrix Gateway Plug-in 特権昇格	8.8	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00044	CVE-2022-21827
20	Splunk Enterprise Command-Line Interface 弱い認証	6.2	6.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00178	CVE-2022-32156

キャンペーン (1)

These are the campaigns that can be associated with the actor:

Ukraine

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	キャンペーン	Identified	タイプ	信頼度
1	5.39.218.152		TeleBots	Ukraine	2022年03月27日	verified	高
2	46.28.200.132	hosted-by.solarcom.ch	TeleBots	Ukraine	2022年03月27日	verified	高
3	XX.XXX.XXX.XXX	xxxxxxxxxxx.xxx	Xxxxxxxx		2021年05月31日	verified	高
4	XX.XXX.XX.XX		Xxxxxxxx	Xxxxxxx	2022年03月27日	verified	高
5	XX.XXX.XXX.XXX	xx-xxx-xxx-xxx.xxxxxx-xx-xxxxxxxxxxx.xxx	Xxxxxxxx		2021年05月31日	verified	高
6	XX.XXX.XX.X	xxxxxx-x.xx.xxx.xx.xxxxxx.xxx	Xxxxxxxx		2021年05月31日	verified	高
7	XXX.XX.XXX.XX	xx-xxxxxx-xxx-xx-xxx-xx.xxxxxx.xx	Xxxxxxxx	Xxxxxxx	2022年03月27日	verified	高
8	XXX.XX.XX.X	xxxxxxxxxxx.xxxxxxxxxxx.xxx	Xxxxxxxx	Xxxxxxx	2022年03月27日	verified	高

TTP - Tactics, Techniques, Procedures (16)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CWE-22	Path Traversal	predictive	高
2	T1059	CWE-94	Argument Injection	predictive	高
3	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	高
4	T1068	CWE-264, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	高
5	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	高
6	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
7	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
8	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	高
9	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	高
10	TXXXX	CWE-XXX	Xxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx Xxxxx	predictive	高
11	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	高
12	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
13	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	高
14	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
15	TXXXX.XXX	CWE-XX	Xxxxxxxxxxxxx	predictive	高
16	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高

IOA - Indicator of Attack (121)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	.htaccess	predictive	中
2	File	/cgi-bin/supervisor/PwdGrp.cgi	predictive	高
3	File	/CMD_SELECT_USERS	predictive	高
4	File	/configs/application.ini	predictive	高
5	File	/dashboard/updatelogo.php	predictive	高
6	File	/etc/openshift/server_priv.pem	predictive	高
7	File	/index.php	predictive	中
8	File	/mkshop/Men/profile.php	predictive	高
9	File	/Noxen-master/users.php	predictive	高
10	File	/phppath/php	predictive	中
11	File	/uncpath/	predictive	中
12	File	admin-ajax.php	predictive	高
13	File	admin/google_search_console/class-gsc-table.php	predictive	高
14	File	admin/menus/edit.php	predictive	高
15	File	album_portal.php	predictive	高
16	File	xxxx/xxx/xxxxxx/xxxxx-xxxxx_xxxx.x	predictive	高
17	File	xxxxxxxx.xxx	predictive	中
18	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	高
19	File	xxxx\xx_xx.xxx	predictive	高
20	File	xxxxxxx.xxx	predictive	中
21	File	xx.x	predictive	低
22	File	xxxxx.xxx	predictive	中
23	File	xxxxxxxxxxxxxxxxxxx	predictive	高
24	File	xxxxxxxxxx/xxxxxxxxxx/xxxxxxxxx.xxx	predictive	高
25	File	xxxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxx	predictive	高
26	File	xxxxxxxx/xxxxxxx.xxx	predictive	高
27	File	xxxxxxxx/xxx/xxx_xx_xxxxxxx.xxx	predictive	高
28	File	xxxxx.xxx	predictive	中
29	File	xxxxx.x	predictive	低
30	File	xxxxxxxxxx.xxx	predictive	高
31	File	xxxx_xxxx.xxx	predictive	高
32	File	xxxxxx.x	predictive	中
33	File	xx.xxx	predictive	低
34	File	xxxx.xxx	predictive	中
35	File	xxxxx/x/xxx/xxxx.xxx	predictive	高
36	File	xxxxxxxx.xxxxx.xxx	predictive	高
37	File	xxxx.xxx	predictive	中
38	File	xxxxxxxxxxxxx.xxx	predictive	高
39	File	xxxxxxxxxxxxxx.xxx	predictive	高
40	File	xxxxxxx_xxxx.xxx	predictive	高
41	File	xxxxxxx.xxx	predictive	中
42	File	xxxxx_xxxxxxx.xxx	predictive	高
43	File	xxxxxx.xxx	predictive	中
44	File	xxxxxx.xxx	predictive	中
45	File	xxx/xxx_xxx	predictive	中
46	File	xxxx.xxx	predictive	中
47	File	xxxxxx.x	predictive	中
48	File	xxxx.xxx	predictive	中
49	File	xxxx_xxxx.xxx	predictive	高
50	File	xxxxxxxxxxxxxxxx.xx	predictive	高
51	File	xxxxxx-xxxxx-xxxxxx.xxx	predictive	高
52	File	xxxxxxxx/xxx	predictive	中
53	File	xxxxxx.xxx	predictive	中
54	File	xxxxxx.xxx	predictive	中
55	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	高
56	File	xxxxxxxxx.x	predictive	中
57	File	xxxxxxx.xxx	predictive	中
58	File	xxxxxxx.xxx	predictive	中
59	File	xxxx_xxx.xxx	predictive	中
60	File	xxx/xxxxxx/xxxxxxxxxxxxx.xxx	predictive	高
61	File	xx-xxxxxxx.xxx	predictive	高
62	File	xx-xxxxxxxx/xxxxx-xx-xxxxxxxxx-xxxxxxx.xxx	predictive	高
63	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	高
64	File	xx-xxxxxxxx/xxxx.xxx	predictive	高
65	File	xx-xxxxxxxx.xxx	predictive	高
66	File	xxxxxxxxxxxx.xxx	predictive	高
67	Library	xxx.xxx	predictive	低
68	Library	xxxxxxxx.xxx	predictive	中
69	Argument	xxxx	predictive	低
70	Argument	xxxxxxxxx	predictive	中
71	Argument	xxxx_xxx	predictive	中
72	Argument	xxx	predictive	低
73	Argument	xxxx_xx	predictive	低
74	Argument	xxxxx	predictive	低
75	Argument	xxx	predictive	低
76	Argument	xxxx_xx	predictive	低
77	Argument	xxxxxxx	predictive	低
78	Argument	xxxxxxxxxxx	predictive	中
79	Argument	xxxxxx	predictive	低
80	Argument	xxxxxx_xxxx_xxxxxxxx	predictive	高
81	Argument	xxxxxxxx	predictive	中
82	Argument	xxx_xxxx/xxx_xxxxxxx	predictive	高
83	Argument	xxxxxxxxxxx	predictive	中
84	Argument	xxxx/xxxx_xx	predictive	中
85	Argument	xxxxxxxxx	predictive	中
86	Argument	xxxx_xxxxxxx	predictive	中
87	Argument	xx	predictive	低
88	Argument	xxxxxxxxxx	predictive	中
89	Argument	xxx	predictive	低
90	Argument	xxxx	predictive	低
91	Argument	xxxxxxxx	predictive	中
92	Argument	xxxxxxxxxxxxx_xx	predictive	高
93	Argument	xxx_xx	predictive	低
94	Argument	xxxxxx	predictive	低
95	Argument	xxxxxx	predictive	低
96	Argument	xxxxxx_xxxx	predictive	中
97	Argument	xxxxxxxx	predictive	中
98	Argument	xxxxx_xxxx_xxxx	predictive	高
99	Argument	xxxxxxxxx	predictive	中
100	Argument	xxxxxxxxx	predictive	中
101	Argument	xxxxxxxxx	predictive	中
102	Argument	xxxxxxxx_xx	predictive	中
103	Argument	xxxxxxx_xx	predictive	中
104	Argument	xxxxxx	predictive	低
105	Argument	xxxxxxx	predictive	低
106	Argument	xxxxxx	predictive	低
107	Argument	xxxxxx	predictive	低
108	Argument	xxxxxxxxx	predictive	中
109	Argument	xxxxx_xx	predictive	中
110	Argument	xxxx_xx	predictive	低
111	Argument	xxxx_xxxxx	predictive	中
112	Argument	x_xxx	predictive	低
113	Argument	x-xxxx-xxxxx	predictive	中
114	Argument	xxxxx/xxxxx	predictive	中
115	Input Value	"><xxxxxx>xxxxx(/xxx/)</xxxxxx>	predictive	高
116	Input Value	..	predictive	低
117	Input Value	x" xxxxxxxxxxx=xxxxxx(xxxxxx) xxx="	predictive	高
118	Input Value	xxxxx' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx) xxx 'xxxx'='xxxx&xxxxxxxx=xxxxxxxxxx	predictive	高
119	Input Value	xxx_xxx_xxxx_xxxx'"><xxxxxx>xxxxx(/xxxxx.xx/)</xxxxxx>	predictive	高
120	Pattern	() {	predictive	低
121	Network Port	xxx/xxxx	predictive	中

参考 (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Do you need the next level of professionalism?

Upgrade your account now!