Stolen Pencil 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (178)

言語

en	146
de	12
sv	6
es	4
fr	4

国・地域

us	118
sv	6
ir	6
fr	4
de	4

アクター

Stolen Pencil	6
Bashlite	1
Ave Maria	1
AsyncRAT	1
Vjw0rm	1

関心

タイプ

Not Defined	72
Content Management System	12
Programming Language Software	6
Enterprise Resource Planning Software	6
Application Server Software	4

ベンダー

Not Defined	48
Oracle	8
DZCP	4
Cisco	4
Microsoft	4

製品

DZCP deV!L`z Clanportal	4
Dolibarr	4
PHP	4
parsec	2
Gentoo logstash-bin	2

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash 情報の漏洩	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.94	CVE-2010-0966
3	Revive Adserver lg.php Redirect	5.8	5.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00922	0.04	CVE-2021-22873
4	DZCP deV!L`z Clanportal browser.php 情報の漏洩	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02733	0.49	CVE-2007-1167
5	Wuzhicms group.php SQLインジェクション	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00172	0.02	CVE-2022-27431
6	phpPgAds/phpAdsNew lib-sessions.inc.php SQLインジェクション	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00
7	LionWiki index.php 特権昇格	6.9	6.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01572	0.00	CVE-2020-27191
8	E-theni URL aff_liste_langue.php 特権昇格	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03405	0.00	CVE-2003-1256
9	PHPSurveyor dumplabel.php SQLインジェクション	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00
10	PHP-Nuke Kleinanzeigen module modules.php SQLインジェクション	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00100	0.00	CVE-2008-3512
11	ZeeBuddy editadgroup.php SQLインジェクション	8.5	8.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00285	0.00	CVE-2017-15976
12	DCP-Portal golink.php SQLインジェクション	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
13	baigo CMS opt_base.inc.php 特権昇格	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01293	0.00	CVE-2019-9227
14	SourceCodester Online Boat Reservation System POST Parameter login.php クロスサイトスクリプティング	4.4	4.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00131	0.04	CVE-2023-1030
15	Xoops userinfo.php SQLインジェクション	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00316	0.00	CVE-2002-0216
16	VMware ESXi VMX 特権昇格	7.2	6.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00044	0.03	CVE-2021-22042
17	Apache Log4j Lookup サービス拒否	6.4	6.1	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.96625	0.04	CVE-2021-45105
18	Fast C++ CSV Parser csv.h trim_chars メモリ破損	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00659	0.00	CVE-2018-13421
19	October CMS 未知の脆弱性	6.5	6.3	$0-$5k	$0-$5k	Functional	Official Fix	0.00196	0.00	CVE-2017-16244
20	automad FileController.php import 特権昇格	7.1	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00061	0.04	CVE-2023-7037

IOC - Indicator of Compromise (11)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	Identified	タイプ	信頼度
1	1.3.4.1		Stolen Pencil	2018年12月09日	verified	高
2	2.2.6.5		Stolen Pencil	2018年12月09日	verified	高
3	5.196.169.223	ip223.ip-5-196-169.eu	Stolen Pencil	2020年12月20日	verified	高
4	XX.XXX.XXX.XXX	xxxxxxxxxxxxxxxxxxxxx.xxx	Xxxxxx Xxxxxx	2020年12月20日	verified	高
5	XX.XXX.XXX.X		Xxxxxx Xxxxxx	2020年12月20日	verified	高
6	XXX.XXX.XXX.XX	xxxxxxxxxxxxxxxxxxxxxx.xx	Xxxxxx Xxxxxx	2020年12月20日	verified	高
7	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxxxx Xxxxxx	2020年12月20日	verified	高
8	XXX.XXX.XXX.XXX	xx-xxx-xxx-xxx-xxx.xx.xxxxxxxxxxxx.xxx	Xxxxxx Xxxxxx	2020年12月20日	verified	高
9	XXX.XX.XX.XXX		Xxxxxx Xxxxxx	2020年12月20日	verified	高
10	XXX.XX.XXX.XXX	xx-xxx-xx-xxx-xxx.xxxx.xxxxxxxxx.xxx	Xxxxxx Xxxxxx	2020年12月20日	verified	高
11	XXX.XXX.XXX.XXX		Xxxxxx Xxxxxx	2020年12月20日	verified	高

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CWE-22	Path Traversal	predictive	高
2	T1059	CWE-94	Argument Injection	predictive	高
3	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	高
4	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
5	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
6	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
7	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	高
8	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	高
9	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	高
10	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
11	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
12	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	高
13	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxx	predictive	高

IOA - Indicator of Attack (135)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	/admin/api/admin/articles/	predictive	高
2	File	/admin/photo.php	predictive	高
3	File	/admin/transactions/track_shipment.php	predictive	高
4	File	/api/browserextension/UpdatePassword/	predictive	高
5	File	/boat/login.php	predictive	高
6	File	/book-services.php	predictive	高
7	File	/coreframe/app/member/admin/group.php	predictive	高
8	File	/forum/away.php	predictive	高
9	File	/home/courses	predictive	高
10	File	/horde/util/go.php	predictive	高
11	File	/owa/auth/logon.aspx	predictive	高
12	File	/secure/EditSubscription.jspa	predictive	高
13	File	/systemrw/	predictive	中
14	File	/tmp/supp_log	predictive	高
15	File	?r=recruit/bgchecks/export&checkids=x	predictive	高
16	File	account.php	predictive	中
17	File	ActivityStarter.java	predictive	高
18	File	admin/content.php	predictive	高
19	File	xxxxx/xxxxxxxxxxx.xxx	predictive	高
20	File	xxxxx/xxxxx.xxx	predictive	高
21	File	xxxxx/xxxx.xxx	predictive	高
22	File	xxxxx\xxxxxxx\xxxxx.xxx#xxxx_xxxx	predictive	高
23	File	xxxxxxxx_xxx_xxxxxxx.xxx	predictive	高
24	File	xxxxxxxx_xxxxxx_xxxxxxx.xxx	predictive	高
25	File	xxx_xxxxx_xxxxxx.xxx	predictive	高
26	File	xxx-xxxxx/xxxxxxxx-xxx	predictive	高
27	File	xx_xxxxxxxxxx.xxx	predictive	高
28	File	xxxxxxx.xxx	predictive	中
29	File	xxx/xxx.xxx	predictive	中
30	File	xxxxxxxx.xxx	predictive	中
31	File	xxxxx.xxx	predictive	中
32	File	xxxxxx.xxx	predictive	中
33	File	xxxxx_xxxxxx.xxx	predictive	高
34	File	xxxxxxx_xxx.xxx	predictive	高
35	File	xxx.x	predictive	低
36	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	高
37	File	xxxxx.xxx	predictive	中
38	File	xxxxxx.xxx	predictive	中
39	File	xxxxxx.xxx	predictive	中
40	File	xxxxxx.xxx	predictive	中
41	File	xxxxxxx.xxx	predictive	中
42	File	xxxxxxxxxxxxxxx.xxx	predictive	高
43	File	xxxxxxxxx.xxx	predictive	高
44	File	xxxxxxxxxxxxxx.xxx	predictive	高
45	File	xxxx.xxx	predictive	中
46	File	xxxxxx.xxx	predictive	中
47	File	xxx/xxxxxx.xxx	predictive	高
48	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	高
49	File	xxxxx.xxx	predictive	中
50	File	xxx/xxx_xxx_xx.xxxx	predictive	高
51	File	xxxxxxxxx/xxxxxxx/xxxxx.xxx	predictive	高
52	File	xxxxx.xxx	predictive	中
53	File	xxxxx/xxx/xxxxx/xxxxxxxxxxxxxx/xxxxxxx/xxxxxx	predictive	高
54	File	xxxxx.xxx	predictive	中
55	File	xx.xxx	predictive	低
56	File	xxxxxx.xxx	predictive	中
57	File	xxxx/xxxx_x_xxxxxx/xxxx.xxx	predictive	高
58	File	xxxxxxx.xxx	predictive	中
59	File	xxxxxxx/xxxxxxx/xxxxx/xxxxxxx.xxx	predictive	高
60	File	xxx_xxxx.xxx	predictive	中
61	File	xxx_xxxx.xxx.xxx	predictive	高
62	File	xxx-xxx/xxxxxxxxx.xxx	predictive	高
63	File	xxxxx.xxx	predictive	中
64	File	xxxxxxx/xxxx.xxx	predictive	高
65	File	xxxxxxxx.xxx	predictive	中
66	File	xxxxxxx_xxxxxxx.xxx	predictive	高
67	File	xxxxxxxxxxxxx.xxx	predictive	高
68	File	xxxxxxxx.xxx	predictive	中
69	File	xxxxxxxxxx.xxx	predictive	高
70	File	xxxxxxx-xxxxxxx.xxx	predictive	高
71	File	xxx/xxxx/xxxxxxxxxxx/xxxxx/xxxxx.xxx	predictive	高
72	File	xxxx/xxxx.xxx	predictive	高
73	File	xxxxxxxx.xxx	predictive	中
74	File	xxxx_xxxx_xxxxxxx.xxx	predictive	高
75	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	高
76	File	xxx.xxx	predictive	低
77	File	xxxxxxxxxxx-xxxxxx/xxx/xxxxxxxxxx/xxxx.xxx	predictive	高
78	File	xxxxxxxx/xxxxxxx.xxxx	predictive	高
79	File	xx-xxxxx/xxxxx.xxx	predictive	高
80	File	xxxxxxx.xxxx	predictive	中
81	Library	xxxxx.xxx	predictive	中
82	Library	xxx-xxxxxxxx.xxx.xxx	predictive	高
83	Argument	/xxx/xxxxxxxxxxx/xxxxxx/xx_xxxxxxxxxx.xxx?xxx=<xxxxx-xxx>/xxxxxxxx=x/xxxxxxx	predictive	高
84	Argument	xxxxxx:/xxxxxxxx:/xxxxxxxxxxxxxx:	predictive	高
85	Argument	xxxxxxxx	predictive	中
86	Argument	xxxxxxxxx	predictive	中
87	Argument	xx_xxxxx	predictive	中
88	Argument	xx_xxxx_xxxx	predictive	中
89	Argument	xxxxx_xxx	predictive	中
90	Argument	xxxxxxxx	predictive	中
91	Argument	xxxxxxx	predictive	低
92	Argument	xxxx	predictive	低
93	Argument	xxxxxxxxxxxx	predictive	中
94	Argument	xxxx/xxxxxx/xxx	predictive	高
95	Argument	xxxxxxx	predictive	低
96	Argument	xxxxxxx xxxx	predictive	中
97	Argument	xxxxxxxx	predictive	中
98	Argument	xxxxx_xx	predictive	中
99	Argument	xx	predictive	低
100	Argument	xxxx	predictive	低
101	Argument	xx_xx	predictive	低
102	Argument	xx	predictive	低
103	Argument	xxxxxxx	predictive	低
104	Argument	xxxxxxx	predictive	低
105	Argument	xx	predictive	低
106	Argument	xx	predictive	低
107	Argument	xxxxxxxxx	predictive	中
108	Argument	xxxx_xxxx	predictive	中
109	Argument	xxxxxx	predictive	低
110	Argument	xxx_xxxx_x/xxx_xxxx_x	predictive	高
111	Argument	xxx	predictive	低
112	Argument	xx_xxxx	predictive	低
113	Argument	xxxxxxx	predictive	低
114	Argument	xxx_xx	predictive	低
115	Argument	xxxxx[x][xxx]	predictive	高
116	Argument	xxx	predictive	低
117	Argument	xxxxxx	predictive	低
118	Argument	xxxxxxxxxx	predictive	中
119	Argument	xxxxxxxxx	predictive	中
120	Argument	xxx	predictive	低
121	Argument	xxx_xxxx	predictive	中
122	Argument	xxx_xxxxxxx	predictive	中
123	Argument	xxxxxxxxx	predictive	中
124	Argument	xxx	predictive	低
125	Argument	xxxxx	predictive	低
126	Argument	xxxx_xx	predictive	低
127	Argument	xxxxxx_xx	predictive	中
128	Argument	xxxxx	predictive	低
129	Argument	xxxxx	predictive	低
130	Argument	xxx	predictive	低
131	Argument	xx	predictive	低
132	Argument	xxx	predictive	低
133	Argument	xxxxxxxx	predictive	中
134	Argument	_xxxxxxx	predictive	中
135	Input Value	%xx	predictive	低

参考 (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Do you know our Splunk app?

Download it now for free!