DarkHydrus 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (155)

言語

en	140
es	6
de	4
zh	4
fr	2

国・地域

us	148

アクター

DarkHydrus	1
APT33	1
DarkHydrus (.iqy)	1

関心

タイプ

Not Defined	36
Content Management System	12
Forum Software	8
Programming Language Software	4
Operating System	4

ベンダー

Not Defined	32
Apple	4
EnergyScripts	2
Smartisoft	2
Bitrix	2

製品

Apple Mac OS X Server	4
PhotoPost PHP	2
TikiWiki	2
EnergyScripts Simple Download	2
Phorum	2

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash 情報の漏洩	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.23	CVE-2010-0966
3	Tiki Admin Password tiki-login.php 弱い認証	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	3.28	CVE-2020-15906
4	PHP phpinfo クロスサイトスクリプティング	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02101	0.04	CVE-2007-1287
5	TikiWiki tiki-register.php 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01009	1.38	CVE-2006-6168
6	jforum User 特権昇格	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00289	0.06	CVE-2019-7550
7	JForum jforum.page 未知の脆弱性	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00173	0.02	CVE-2022-26173
8	Responsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit クロスサイトスクリプティング	3.2	3.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00073	0.04	CVE-2018-25085
9	Tiki Wiki CMS Groupware tiki-edit_wiki_section.php クロスサイトスクリプティング	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00110	0.00	CVE-2010-4240
10	PHP Link Directory Administration Page index.html クロスサイトスクリプティング	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00374	0.32	CVE-2007-0529
11	Smartisoft phpBazar classified_right.php 特権昇格	6.5	6.2	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00933	0.03	CVE-2006-2528
12	JForum Login 特権昇格	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00151	0.06	CVE-2012-5338
13	cpCommerce register.php クロスサイトスクリプティング	4.3	4.2	$0-$5k	$0-$5k	High	Unavailable	0.00641	0.03	CVE-2007-2968
14	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	4.04
15	Pligg cloud.php SQLインジェクション	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.40
16	PHPWind goto.php Redirect	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00348	0.04	CVE-2015-4134
17	Advisto Peel SHOPPING caddie_ajout.php 未知の脆弱性	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00118	0.07	CVE-2018-20848
18	Lars Ellingsen Guestserver guestbook.cgi クロスサイトスクリプティング	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00169	0.16	CVE-2005-4222
19	Serendipity exit.php 特権昇格	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.55
20	Bitrix Site Manager redirect.php 特権昇格	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00113	0.03	CVE-2008-2052

キャンペーン (1)

These are the campaigns that can be associated with the actor:

DarkHydrus

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	キャンペーン	Identified	タイプ	信頼度
1	94.130.88.9	cm16.debounce.io	DarkHydrus		2020年12月22日	verified	高
2	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxxxxxxxx		2021年08月29日	verified	高
3	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxxxxxxxx		2020年12月16日	verified	高
4	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx.xxx.xxxxxxxxxxxx.xx	Xxxxxxxxxx		2020年12月16日	verified	高
5	XXX.XX.XXX.XXX	xxxxxxxx-xx-xxxx.xxxxx.xxx	Xxxxxxxxxx	Xxxxxxxxxx	2020年12月22日	verified	高

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CWE-22	Path Traversal	predictive	高
2	T1059	CWE-94	Argument Injection	predictive	高
3	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	高
4	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
5	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
6	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	高
7	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
8	TXXXX.XXX	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	高

IOA - Indicator of Attack (76)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	/etc/sudoers	predictive	中
2	File	/forum/away.php	predictive	高
3	File	/obs/book.php	predictive	高
4	File	/opt/IBM/es/lib/libffq.cryptionjni.so	predictive	高
5	File	/register.do	predictive	中
6	File	4.3.0.CP04	predictive	中
7	File	adclick.php	predictive	中
8	File	addentry.php	predictive	中
9	File	add_comment.php	predictive	高
10	File	book.php	predictive	中
11	File	xxxxxxxxxx_xxxxx.xxx	predictive	高
12	File	xxxxx.xxx	predictive	中
13	File	xxxxxx/xxx.x	predictive	中
14	File	xxxxxxx_xxx.xxx	predictive	高
15	File	xxxxxx.xxx	predictive	中
16	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	高
17	File	xxxxxxxx.xxx	predictive	中
18	File	xxxxx.xxx	predictive	中
19	File	xx/xxxxx/xxxxxx_xxxxx.xxx	predictive	高
20	File	xxxx.xxx	predictive	中
21	File	xxxx.xxx	predictive	中
22	File	xxxxxxxxx.xxx	predictive	高
23	File	xx/xxxxxxx/xxxxxx_xxx.x	predictive	高
24	File	xxx/xxxxxx.xxx	predictive	高
25	File	xxxxx.xxxx	predictive	中
26	File	xxxxx.xxx	predictive	中
27	File	xxxxxx.xxxx	predictive	中
28	File	xxx/xxxx/xxx.x	predictive	高
29	File	xxxxxxxxx.x	predictive	中
30	File	xxxx.xxx	predictive	中
31	File	xxxxx.xxx	predictive	中
32	File	xxxxxxxx.xxx	predictive	中
33	File	xxxxxxxx.xxx	predictive	中
34	File	xxxxxxxx.xx	predictive	中
35	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	高
36	File	xxxxxxxx_xxxxxx.xxx	predictive	高
37	File	xxxxxxxxxx_xxxxx.xxxxxx	predictive	高
38	File	xxxxxxxxxxxxxx.xxx	predictive	高
39	File	xxxxxx-xxxx/xxx/xxxx/xxxx/xxx/xxxxxx/xxxxxxxxxxxx.xxxx	predictive	高
40	File	xxxx-xxxxxxxx.xxx	predictive	高
41	File	xxxx-xxxx_xxxx_xxxxxxx.xxx	predictive	高
42	File	xxxx-xxxxx.xxx	predictive	高
43	File	xxxx-xxxxxxxx.xxx	predictive	高
44	File	xxxx/xxxxxxxx.xxx	predictive	高
45	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	高
46	File	xx-xxxxx.xxx	predictive	中
47	File	xx-xxxxxxxx.xxx	predictive	高
48	Library	xxxx/xxx/xxxxxx/xx-xxxx-xxxxxx.xxx	predictive	高
49	Library	xxx/xxx/xx/xxx/xxxxxx.xxxxxxxxxxx.xx	predictive	高
50	Argument	$xxxx	predictive	低
51	Argument	xxxxxxxxxx	predictive	中
52	Argument	xxxxxxxx	predictive	中
53	Argument	xxxxxxxx	predictive	中
54	Argument	xxxxxxxx	predictive	中
55	Argument	xxxx_xxxx	predictive	中
56	Argument	xxxxxxxxxx	predictive	中
57	Argument	xxxxxx	predictive	低
58	Argument	xxxxxxxxx[x]	predictive	中
59	Argument	xx_xx_xxxx_xxxx	predictive	高
60	Argument	xxxx	predictive	低
61	Argument	xxxx	predictive	低
62	Argument	xxxxxx/xxxxx	predictive	中
63	Argument	xx	predictive	低
64	Argument	xxxxxxxx_xxx	predictive	中
65	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	高
66	Argument	xxxx	predictive	低
67	Argument	xxxxxxxxxxxxxxx	predictive	高
68	Argument	xxxxx	predictive	低
69	Argument	xx_xxxx	predictive	低
70	Argument	xxxxxxxxxx	predictive	中
71	Argument	xx	predictive	低
72	Argument	xxx	predictive	低
73	Argument	xxxx	predictive	低
74	Argument	xxx	predictive	低
75	Argument	xxxxxxxx/xxxxxxxx	predictive	高
76	Argument	xxxx_xxxxx	predictive	中

参考 (5)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!