CetaRAT 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (1000)

言語

en	890
zh	44
ar	14
ru	14
fr	14

国・地域

nl	958
us	42

アクター

RedLine Stealer	6
Dorkbot	4
Domestic Kitten	3
Charming Kitten	2
Mylobot	2

関心

タイプ

Not Defined	224
Operating System	130
Content Management System	42
Firewall Software	40
WordPress Plugin	30

ベンダー

Not Defined	222
Microsoft	132
Apache	30
Cisco	30
Oracle	24

製品

Microsoft Windows	98
Linux Kernel	20
WordPress	18
Apache HTTP Server	14
Google Android	14

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	jforum User 特権昇格	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00289	0.05	CVE-2019-7550
2	nginx 特権昇格	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	3.14	CVE-2020-12440
3	Huawei ACXXXX/SXXXX SSH Packet 特権昇格	7.5	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00246	0.07	CVE-2014-8572
4	Microsoft Windows WPAD 特権昇格	8.0	7.9	$25k-$100k	$0-$5k	High	Official Fix	0.90962	0.03	CVE-2016-3213
5	Microsoft Windows Graphics Remote Code Execution	7.0	6.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.03523	0.00	CVE-2021-34530
6	Microsoft Windows Event Tracing Privilege Escalation	7.3	6.3	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00043	0.00	CVE-2021-34487
7	Microsoft IIS クロスサイトスクリプティング	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.13	CVE-2017-0055
8	Cisco Secure Email and Web Manager Web-based Management Interface 弱い認証	9.8	9.6	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00337	0.02	CVE-2022-20798
9	nginx Log File 特権昇格	7.8	7.4	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00092	0.04	CVE-2016-1247
10	Apache HTTP Server mod_rewrite Redirect	6.7	6.7	$25k-$100k	$5k-$25k	Not Defined	Not Defined	0.00258	0.04	CVE-2020-1927
11	Microsoft .NET Core/Visual Studio サービス拒否	6.4	5.5	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00195	0.09	CVE-2021-26423
12	Microsoft Windows TCP/IP Stack Privilege Escalation	9.9	8.6	$100k 以上	$5k-$25k	Unproven	Official Fix	0.02183	0.04	CVE-2021-26424
13	Microsoft Windows Event Tracing Privilege Escalation	8.3	7.3	$100k 以上	$5k-$25k	Unproven	Official Fix	0.00044	0.00	CVE-2021-26425
14	Microsoft Windows Bluetooth Driver Privilege Escalation	8.3	7.3	$100k 以上	$5k-$25k	Unproven	Official Fix	0.00043	0.00	CVE-2021-34537
15	Microsoft Dynamics 365 Privilege Escalation	8.5	7.4	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00736	0.00	CVE-2021-34524
16	Microsoft Windows Storage Spaces Controller Local Privilege Escalation	7.8	6.8	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00043	0.04	CVE-2021-34536
17	Microsoft Windows Graphics Remote Code Execution	7.0	6.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.03523	0.03	CVE-2021-34533
18	Microsoft Windows Services for NFS ONCRPC XDR Driver 情報の漏洩	6.4	5.5	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.01108	0.03	CVE-2021-36926
19	Microsoft ASP.NET Core/Visual Studio 情報の漏洩	4.9	4.3	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00043	0.00	CVE-2021-34532
20	Microsoft Windows Services for NFS ONCRPC XDR Driver 情報の漏洩	6.4	5.5	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.01108	0.00	CVE-2021-36933

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	Identified	タイプ	信頼度
1	109.236.85.152	customer.worldstream.nl	CetaRAT	2021年09月07日	verified	高
2	XXX.XX.XXX.XX	xxxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxx	2021年09月07日	verified	高
3	XXX.XX.XXX.XXX	xxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxx	2021年09月07日	verified	高
4	XXX.XX.XX.XXX	xxxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxx	2021年09月07日	verified	高
5	XXX.XXX.XX.XXX	xxxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxx	2021年09月07日	verified	高

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	クラス	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CAPEC-126	CWE-21, CWE-22, CWE-23	Path Traversal	predictive	高
2	T1040	CAPEC-102	CWE-294	Authentication Bypass by Capture-replay	predictive	高
3	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	高
4	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	高
5	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	高
6	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
7	TXXXX.XXX	CAPEC-16	CWE-XXX, CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	高
8	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
9	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
10	TXXXX	CAPEC-0	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	高
11	TXXXX	CAPEC-0	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	高
12	TXXXX	CAPEC-184	CWE-XXX	Xxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx Xxxxx	predictive	高
13	TXXXX	CAPEC-108	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	高
14	TXXXX	CAPEC-102	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
15	TXXXX	CAPEC-38	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	高
16	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
17	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
18	TXXXX.XXX	CAPEC-0	CWE-XX	Xxxxxxxxxxxxx	predictive	高
19	TXXXX	CAPEC-157	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	高
20	TXXXX.XXX	CAPEC-112	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	高
21	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高

IOA - Indicator of Attack (224)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	.travis.yml	predictive	中
2	File	/.env	predictive	低
3	File	/admin.php	predictive	中
4	File	/admin/subnets/ripe-query.php	predictive	高
5	File	/apply.cgi	predictive	中
6	File	/core/conditions/AbstractWrapper.java	predictive	高
7	File	/debug/pprof	predictive	中
8	File	/export	predictive	低
9	File	/file?action=download&file	predictive	高
10	File	/hardware	predictive	中
11	File	/librarian/bookdetails.php	predictive	高
12	File	/medical/inventories.php	predictive	高
13	File	/monitoring	predictive	中
14	File	/opt/zimbra/jetty/webapps/zimbra/public	predictive	高
15	File	/plugin/LiveChat/getChat.json.php	predictive	高
16	File	/plugins/servlet/audit/resource	predictive	高
17	File	/plugins/servlet/project-config/PROJECT/roles	predictive	高
18	File	/replication	predictive	中
19	File	/RestAPI	predictive	中
20	File	/tmp/speedtest_urls.xml	predictive	高
21	File	/tmp/zarafa-vacation-*	predictive	高
22	File	/uncpath/	predictive	中
23	File	/upload	predictive	低
24	File	/user/loader.php?api=1	predictive	高
25	File	/var/log/nginx	predictive	高
26	File	/xxx/xxx/xxxxxxxx.xxx	predictive	高
27	File	/xxxxxx/xxxxxx.xxxx	predictive	高
28	File	/xx-xxxx/xxxxxx/x.x/xxxxx?xxx	predictive	高
29	File	xxxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	高
30	File	xxxxxxx.xxx	predictive	中
31	File	xxxxx-xxxx.xxx?xxxxxx=xxx_xxxxxxx xxxxx[x][xxx]	predictive	高
32	File	xxxxxxx.xxx	predictive	中
33	File	xxxxxxx.xxx	predictive	中
34	File	xxx/xxx/xxxx-xxx	predictive	高
35	File	xxx/xx/xxxxxx	predictive	高
36	File	xxxxx.xxx	predictive	中
37	File	xxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	高
38	File	xxxx/xxxxxxx/xxx/xxxxxx_xxxx.x	predictive	高
39	File	xxxx-xxxx.x	predictive	中
40	File	xxxx/xxxxxxx.xxx	predictive	高
41	File	x:\xxxxxxx xxxxx\xxxxxx xxxxx\xxx\xxxxxxx.xxx	predictive	高
42	File	x:\xxxxxxx\xxxxxxxx\xxxxxx\xxx	predictive	高
43	File	xxx-xxx/xx.xxx	predictive	高
44	File	xxx/xxxxxxx.xx	predictive	高
45	File	xxxxx.xxx	predictive	中
46	File	xxxxxx.xxx	predictive	中
47	File	xxx_xxxxxx.xxx	predictive	高
48	File	xxx.xxx	predictive	低
49	File	xxxxxx.xxx	predictive	中
50	File	xxxxxxxx.xx	predictive	中
51	File	xxxxxxxxxx/xxxxxx/xxxxxxxxx.xxxx/xxxx.xxx/	predictive	高
52	File	x_xxxxxx	predictive	中
53	File	xxxxxx.xxx	predictive	中
54	File	xxxxxxx.xxx	predictive	中
55	File	xxxxxxx/xxxxx/xxxxxx.x	predictive	高
56	File	xxxxxxx/xxx/xxxxxxx/xxxx.x	predictive	高
57	File	xxxxxxx/xxxx/xxxx_xxxxxxxxx_xxxxx.x	predictive	高
58	File	xxxx_xxxxx.xxx	predictive	高
59	File	xxxx.xxx	predictive	中
60	File	xxx/xxxxxxxx/xxx_xxxxxxxxxxxx.x	predictive	高
61	File	xxxxxxxx.x	predictive	中
62	File	xx/xxxxxxxxx.x	predictive	高
63	File	xx/xxxxx.x	predictive	中
64	File	xx/xxxxx/xxxxxxx.x	predictive	高
65	File	xxxxx.xxx	predictive	中
66	File	xxxxxxxxxx.xx	predictive	高
67	File	xxxx/xxxxxxxxxxxxxxxxxxxxxxxx.xx	predictive	高
68	File	xxxxxxxxxxxxxxxxxxxxx.xxx	predictive	高
69	File	xxxxx-xxxxx.x	predictive	高
70	File	xxxxxx_xxxxx_xxxxxxx.x	predictive	高
71	File	xxxxx-xxxxxxxxxx.x	predictive	高
72	File	xxxxxxx/xxxx.xxx	predictive	高
73	File	xxxxx.xxx	predictive	中
74	File	xxxxx.xxx?xx=xxxxxxxx.xxxxxx	predictive	高
75	File	xxxxx:/xxxxxxxx/xxxxxxxxxxxx.xxxx	predictive	高
76	File	xxxxx/xxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxx	predictive	高
77	File	xxxx_xxxxxx.xx	predictive	高
78	File	xxxxxx/xxx/xxxxxxxx.x	predictive	高
79	File	xxxxxx/xxxxx/xxxxx_xxxxxx_xxxxxx.x	predictive	高
80	File	xxxxxxx/xx_xxx.x	predictive	高
81	File	xxxxxxxxx/xxxxxxx/xxxxxx/xxxxxxxxxx.xxx	predictive	高
82	File	xxxx.xxx	predictive	中
83	File	xxxxx.xxx	predictive	中
84	File	xxxxx.xxx	predictive	中
85	File	xxxxxxxxxx/xxx.x	predictive	高
86	File	xxxx.x	predictive	低
87	File	xxxx.xxx	predictive	中
88	File	xxxxxx_xxxxx_xxxxxxx.x	predictive	高
89	File	xxxxxxxxxxxxxxxx.x	predictive	高
90	File	xxx/xxxxxxxxx/xx_xxxxxx_xxx.x	predictive	高
91	File	xxx/xxxxxxxxx/x_xxxxxx.x	predictive	高
92	File	xxxx.xxx	predictive	中
93	File	xxx_xxxxxxx.x	predictive	高
94	File	xxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	高
95	File	xxx_xx.x	predictive	中
96	File	xxxxxxxxxxxxxxxxx.xxx	predictive	高
97	File	xxxxxxxxx.xxx.xxx	predictive	高
98	File	xxxxxxx.xxx	predictive	中
99	File	xxxxxxxx.xxxx	predictive	高
100	File	xxxxxxxxxxxxx.xxxx	predictive	高
101	File	xxxxxx.x	predictive	中
102	File	xxxxx.xxx	predictive	中
103	File	xxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]	predictive	高
104	File	xxxxxxxx.xxx	predictive	中
105	File	xxxxxxx.x	predictive	中
106	File	xxxxxxx.xxx	predictive	中
107	File	xxxxx.xxx	predictive	中
108	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	高
109	File	xxxxxxx.x	predictive	中
110	File	xxxxxxxxxx_xxxxx.xxxxxx	predictive	高
111	File	xxxx_xxx_xx.x	predictive	高
112	File	xx_xxx.x	predictive	中
113	File	xxx.x	predictive	低
114	File	xxxxxx.x	predictive	中
115	File	xxxxx.xxx	predictive	中
116	File	xxxx-xxxxxx.x	predictive	高
117	File	xxxxxxx.x	predictive	中
118	File	xxx/xxx_xxxxx.x	predictive	高
119	File	xxxxxxx.xxx.xx.xxxxxxxxxxx.xxx	predictive	高
120	File	xxxxxx.xxx	predictive	中
121	File	xxxxxxx/xxxxxxx/xxxxxx/xxxxxx_xxxx.xxx	predictive	高
122	File	xxxx.xxxxxxxxx.xxx	predictive	高
123	File	xxxx_xxxx.xxx	predictive	高
124	File	xxxxxx.xxx	predictive	中
125	File	xxx.xxx	predictive	低
126	File	xxxxxx/xx/xxxx.xxx	predictive	高
127	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	高
128	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	高
129	File	xx-xxxxxxxx/xxxxxxx-xxxxxxxx.xxx	predictive	高
130	File	xx-xxxxxxxx/xxxx.xxx	predictive	高
131	File	xx/xx/xxxxx	predictive	中
132	File	xx_xxxxxxx.x	predictive	中
133	File	_xxxxxxxx/xxxxxxxx.xxx	predictive	高
134	File	~/xxxx/xxx/xxxxxxx/xxxxxxxxxx/xxxxxx.xxx	predictive	高
135	Library	xxxxx/xxxxxxxxx/xxxx.xxxxxxxxx.xxx	predictive	高
136	Library	xxxxxxxx.xxx	predictive	中
137	Library	xxxxxxxxxx/xxxxxxxx.x	predictive	高
138	Library	xxxxxxxx.xxx	predictive	中
139	Library	xxxxxxxxx.xxx	predictive	高
140	Library	xxxxxxxx.xxx	predictive	中
141	Library	xxxxxx.xxx.xxx.xxx	predictive	高
142	Library	xxxxxxxx.xxx	predictive	中
143	Library	xxxxxxxx.xxx	predictive	中
144	Argument	-x	predictive	低
145	Argument	xxxxxx_xxxx	predictive	中
146	Argument	xxx	predictive	低
147	Argument	xxxxx	predictive	低
148	Argument	xxx_xx	predictive	低
149	Argument	xxxxxxxxxxxxxxx	predictive	高
150	Argument	xxxxxx	predictive	低
151	Argument	xxxxxxx xxxx	predictive	中
152	Argument	xxxxxxxxxx	predictive	中
153	Argument	xxxxxxx	predictive	低
154	Argument	xxxxxxx_xxxx->xxx($xxxxxxxx)	predictive	高
155	Argument	xxxx	predictive	低
156	Argument	xxxxxxxxxxx	predictive	中
157	Argument	xxxxxx_xxxx	predictive	中
158	Argument	xxxx	predictive	低
159	Argument	xx	predictive	低
160	Argument	xx	predictive	低
161	Argument	xxxxxxxxxxxxxx	predictive	高
162	Argument	xxxxxxx	predictive	低
163	Argument	xxxxx[xxxxx][xx]	predictive	高
164	Argument	xxxx_xxxxxx_xxxx	predictive	高
165	Argument	xxxx x xxxx	predictive	中
166	Argument	xxxxxxxxx/xxxxxxxxx	predictive	高
167	Argument	xxx	predictive	低
168	Argument	xx_xxxx	predictive	低
169	Argument	xxxx	predictive	低
170	Argument	xxxxxxxxxxxxxxxxxxxx	predictive	高
171	Argument	xx	predictive	低
172	Argument	xxxxxxx/xxxx/xxxxxxxx	predictive	高
173	Argument	xxxxx	predictive	低
174	Argument	xxxxx/xxxxxx	predictive	中
175	Argument	xxxx	predictive	低
176	Argument	xxxx_xxxx	predictive	中
177	Argument	xxxxxxxx	predictive	中
178	Argument	xxxxxxxx	predictive	中
179	Argument	xxxxxxxx	predictive	中
180	Argument	xxxxxxxxx	predictive	中
181	Argument	xxx_xxx	predictive	低
182	Argument	xxxxxx	predictive	低
183	Argument	xxxxxx	predictive	低
184	Argument	xx_xxxxxxx_xxxxxxx	predictive	高
185	Argument	xxxxxxxxxxxxx	predictive	高
186	Argument	xxxxx	predictive	低
187	Argument	xxxxxxx_xxx	predictive	中
188	Argument	xxxx	predictive	低
189	Argument	xxxxxxx	predictive	低
190	Argument	xxxxxx	predictive	低
191	Argument	xxxxxxxx_xxxxx	predictive	高
192	Argument	xxx	predictive	低
193	Argument	xxxxxxxxxxxx	predictive	中
194	Argument	xxxxxx	predictive	低
195	Argument	xxxxxxxxx	predictive	中
196	Argument	xxx	predictive	低
197	Argument	xxxxxx	predictive	低
198	Argument	xxx	predictive	低
199	Argument	xxxxxxxx-xxxxxxxx	predictive	高
200	Argument	xxx	predictive	低
201	Argument	xxxx	predictive	低
202	Argument	xxxxxxxx	predictive	中
203	Argument	xxxxxxx	predictive	低
204	Argument	xxxx->xxxxxxx	predictive	高
205	Argument	x-xxxxxxxxx-xxx	predictive	高
206	Argument	xxx	predictive	低
207	Argument	\xxxxxx\	predictive	中
208	Argument	_xxx_xxxxxxx_xxxxxxx_xxxxxxxxxxxxx_xxx_xxx_xxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_xxxxxxxxxxxxxxx	predictive	高
209	Argument	_xxx_xxxxxxxxxxx_	predictive	高
210	Input Value	' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)-- xxxx	predictive	高
211	Input Value	.%xx.../.%xx.../	predictive	高
212	Input Value	//	predictive	低
213	Input Value	xxx xxxxxxxx	predictive	中
214	Input Value	xxxxxxxx	predictive	中
215	Input Value	xxxxxxxxx' xxx 'x'='x	predictive	高
216	Input Value	xxxxx	predictive	低
217	Input Value	xxxxxxx_xxxxx.xxxxxxx_xxxxxxx	predictive	高
218	Input Value	\x	predictive	低
219	Input Value	….//	predictive	低
220	Pattern	\|xx\|	predictive	低
221	Network Port	xxxxx	predictive	低
222	Network Port	xx xxxxxxx xxx.xx.xx.xx	predictive	高
223	Network Port	xxx/xx (xxxxxx)	predictive	高
224	Network Port	xxx xxxxxx xxxx	predictive	高

参考 (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Do you need the next level of professionalism?

Upgrade your account now!