Koobface Analiza

IOB - Indicator of Behavior (156)

Oś czasu

Język

en140
es6
it2
zh2
sv2

Kraj

il58
us56
gr10
se8
hr6

Aktorzy

Zajęcia

Wysiłek

Oś czasu

Rodzaj

Sprzedawca

Produkt

Apache HTTP Server10
OpenSSH6
WordPress4
CS-Cart4
Oracle Database4

Luki w zabezpieczeniach

#Słaby punktBaseTemp0dayDzisiajWykPrzEPSSCTICVE
1Joomla CMS com_easyblog sql injection6.36.1$5k-$25k$5k-$25kNot DefinedNot Defined0.000000.44
2Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.005480.33CVE-2017-0055
3OpenBB read.php sql injection7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.002480.04CVE-2005-1612
4DZCP deV!L`z Clanportal config.php privilege escalation7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.009430.44CVE-2010-0966
5SPIP spip.php cross site scripting3.53.4$0-$5k$0-$5kNot DefinedOfficial Fix0.001320.55CVE-2022-28959
6TikiWiki tiki-register.php privilege escalation7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.010090.99CVE-2006-6168
7Francisco Burzi PHP-Nuke File case.filemanager.php privilege escalation5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.005750.00CVE-2001-0854
8lighttpd Log File http_auth.c privilege escalation7.57.1$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.011230.04CVE-2015-3200
9OpenSSH Authentication Username information disclosure5.34.8$5k-$25k$0-$5kHighOfficial Fix0.107370.22CVE-2016-6210
10Signal App RTLO privilege escalation6.36.0$0-$5k$0-$5kNot DefinedOfficial Fix0.003060.03CVE-2022-28345
11Cryptshare Server Delete Personal Data Page cross site scripting4.84.6$0-$5k$0-$5kNot DefinedOfficial Fix0.000840.00CVE-2021-3150
12Dell EMC iDRAC7/iDRAC8 privilege escalation8.58.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.018750.04CVE-2018-1207
13Linux Kernel do_open_permission privilege escalation5.95.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.000440.00CVE-2009-3286
14nginx Log File privilege escalation7.87.4$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.000920.04CVE-2016-1247
15Apache Xerces-C XMLReader.cpp memory corruption9.89.6$25k-$100k$0-$5kNot DefinedOfficial Fix0.030640.00CVE-2016-0729
16Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25k$0-$5kHighWorkaround0.020160.02CVE-2007-1192
17Fortinet FortiOS/FortiProxy FortiGate SSL-VPN memory corruption9.89.6$25k-$100k$25k-$100kNot DefinedOfficial Fix0.154070.07CVE-2023-27997
18ZIPFoundation ZIP File directory traversal7.06.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.000510.00CVE-2023-39138
19pkp ojs cross site scripting2.92.9$0-$5k$0-$5kNot DefinedOfficial Fix0.000450.06CVE-2023-5894
20Fortinet FortiVoice HTTP Request directory traversal5.45.3$0-$5k$0-$5kNot DefinedOfficial Fix0.000680.04CVE-2023-37932

IOC - Indicator of Compromise (86)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDadres IPHostnameAktorKampanieIdentifiedRodzajPewność siebie
141.214.183.130Koobface2022-07-09verifiedWysoki
258.241.255.37Koobface2022-07-09verifiedWysoki
362.0.134.79HFA62-0-134-79.bb.netvision.net.ilKoobface2022-07-09verifiedWysoki
467.225.102.10567-225-102-105.prna.hsdb.sasknet.sk.caKoobface2022-07-09verifiedWysoki
577.70.108.163Koobface2022-07-09verifiedWysoki
677.78.197.176cable-77-78-197-176.static.telemach.baKoobface2022-07-09verifiedWysoki
777.127.81.103Koobface2022-07-09verifiedWysoki
877.239.21.34cable-77-239-0-34.dynamic.telemach.baKoobface2022-07-09verifiedWysoki
978.1.251.2678-1-251-26.adsl.net.t-com.hrKoobface2022-07-09verifiedWysoki
1078.3.42.9978-3-42-99.adsl.net.t-com.hrKoobface2022-07-09verifiedWysoki
1178.90.85.7Koobface2022-07-09verifiedWysoki
1278.183.143.18878.183.143.188.dynamic.ttnet.com.trKoobface2022-07-09verifiedWysoki
1379.113.8.10779-113-8-107.rdsnet.roKoobface2022-07-09verifiedWysoki
1479.130.252.204athedsl-4426972.home.otenet.grKoobface2022-07-09verifiedWysoki
1579.131.26.192athedsl-377538.home.otenet.grKoobface2022-07-09verifiedWysoki
1679.138.184.25379.138.184.253.bredband.tre.seKoobface2022-07-09verifiedWysoki
1779.173.242.22479.173.x.224.go.com.joKoobface2022-07-09verifiedWysoki
1879.175.101.2879-175-101-28.adsl-a-1.sezampro.rsKoobface2022-07-09verifiedWysoki
19XX.XXX.XXX.XXxxx-xx-xxx-xxx-xx.xxx.xxxxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
20XX.XXX.XXX.XXXxxx-xx-xxx-xxx-xxx.xxx.xxxxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
21XX.XXX.XXX.XXXxxx-xxx-xxx-xx-xx.xxxxx.xxx.xxxxxxxxx.xxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
22XX.XX.XX.Xxxx-xx-x.xxxx.xxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
23XX.XX.XX.XXXxxx-xx-xx-xx-xxx.xxx.xxxxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
24XX.XX.XXX.XXxxx-xx-xx-xxx-xx.xxx.xxxxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
25XX.XX.XX.XXXxxxx-xxx-xxx-xxx-xxx.xxx.xxx.xxxxx.xxxxxxxx-xx.xxXxxxxxxx2022-07-09verifiedWysoki
26XX.XXX.X.XXxxx-xx-xxx-x-xx.xxx.xxxxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
27XX.XXX.XXX.XXXxxx-xx-xxx-xxx-xxx.xxxxxx.xxxxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
28XX.XXX.XXX.XXxxx-xx-xxx-xxx-xx.xxx.xxxxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
29XX.XXX.XXX.XXXxxx-xx-xxx-xxx-xxx.xxxxxx.xxxxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
30XX.XXX.XX.XXXxxxx-xxx.xx.xxx.xx.xxxxxx.xxXxxxxxxx2022-07-09verifiedWysoki
31XX.XX.XXX.XXXxxxx-xxxx-xxxxx.xxxxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
32XX.XXX.XXX.XXXxx.xxx.xxx.xxx.xxxxxxx.xxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
33XX.XXX.XXX.XXXxx.xxx.xxx.xxx.xxxxxxx.xxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
34XX.XXX.XXX.XXXxxxxxxxxxxxxxxxxxx.xxxxxx.xxXxxxxxxx2022-07-09verifiedWysoki
35XX.XXX.XXX.XXxx-xxx-xxx-xx.xx.xxxxxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
36XX.XX.XX.XXxx.xx.xx.xx.xxxxx.xxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
37XX.XXX.XXX.XXxxxxxxx-xxxxx.xxxx.xxxxxx.xxXxxxxxxx2022-07-09verifiedWysoki
38XX.XXX.XXX.XXXXxxxxxxx2022-07-09verifiedWysoki
39XX.XXX.XX.XXXxx-xxx-xx-xxx.xx.xxxxxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
40XX.XXX.XXX.XXXxx-xxx-xxx-xxx.xx.xxxxxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
41XX.XXX.XXX.XXxx-xxx-xxx-xx.xx.xxxxxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
42XX.XXX.XXX.XXxx-xxx-xxx-xx.xx.xxxxxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
43XX.XXX.XX.XXxx-xxx-xx-xx.xx.xxxxxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
44XX.XXX.XXX.XXXxxx-xxx-xxx-xxx.xxxxxxx.xxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
45XX.XXX.XX.XXxxx-xxx-xx-xx.xxxxxxx.xxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
46XX.XXX.XXX.XXXxxx-xx-xxx-xxx-xxx.xxxxxxx.xxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
47XX.XXX.XXX.XXXXxxxxxxx2022-07-09verifiedWysoki
48XX.XXX.XXX.XXXxx-xxx-xxx-xxx.xxxx.xxxx.xxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
49XX.XXX.XX.XXXxxx-xxx-xx-xxx.xxxxxxxx.xxXxxxxxxx2022-07-09verifiedWysoki
50XX.XX.XXX.XXXxxxxxxx2022-07-09verifiedWysoki
51XX.XX.XX.XXXxx.xx.xx.xxx.xxxxxxxx.xx.xxXxxxxxxx2022-07-09verifiedWysoki
52XX.XXX.XXX.XXxx-xxx-xxx-xx.xxxxx.xxx.xxxxxxxxx.xxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
53XX.XXX.XXX.XXXxxx-xxx-xxx-xx.xxxxx.xxx.xxxxxxxxx.xxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
54XX.XXX.XX.XXXxx-xxx-xx-xxx.xxxx.xxx.x-xxx.xxXxxxxxxx2022-07-09verifiedWysoki
55XX.XX.XXX.XXXxxx-xx-xx-xxx-xxx.xxxx.xxxxxx.xxXxxxxxxx2022-07-09verifiedWysoki
56XX.XX.X.XXXxxxxxx-xx.xx.x.xxx.xxxx.xxXxxxxxxx2022-07-09verifiedWysoki
57XX.XXX.XXX.XXXxxxxx-xx-xxx-xxx-xxx.xxxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
58XX.XXX.XXX.XXxxxxx-xx-xxx-xxx-xx.xxxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
59XX.XXX.XXX.XXXxx.xxx.xxx.xxx.xxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
60XXX.XXX.XXX.XXXxxx-xxx-xxx-xxx.xxxxxxx-xx.xxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
61XXX.XX.XXX.XXXxxx.xx.xxx.xxx.xxxxxx.xxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
62XXX.XXX.X.XXXXxxxxxxx2022-07-09verifiedWysoki
63XXX.XXX.XX.XXXxxxxxxxxx-xxxxxxx-xxx-xxx-xx-xxx.xxxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
64XXX.XX.XXX.XXxxx.xx.xxx.xx.xxxxxx.xxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
65XXX.XXX.XXX.XXxxxx-xxxxx-xxxxxxx-xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxx.xxXxxxxxxx2022-07-09verifiedWysoki
66XXX.XXX.XXX.XXXXxxxxxxx2022-07-09verifiedWysoki
67XXX.XXX.XX.XXXxxxxxxx2022-07-09verifiedWysoki
68XXX.XX.XX.XXxxx-xx-xx-xx.xxxxxx.xxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
69XXX.XX.XX.XXXxxx-xx-xx-xxx.xxx.xxxxxxxx.xxXxxxxxxx2022-07-09verifiedWysoki
70XXX.XX.XX.XXXxx-xxx-xx-xx-xxx.xx.xxx.xxxXxxxxxxx2022-07-09verifiedWysoki
71XXX.XXX.XXX.XXXxxxx-xxx-xxx-xxx.xxxxxxxx.xxxxxx.xxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
72XXX.XXX.X.XXXxxxxxxx2022-07-09verifiedWysoki
73XXX.XXX.XX.XXXxxx.xxx-xxx-xx.xxx.xxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
74XXX.XXX.XXX.XXXxxxxxxx-xx-xxxxxxxxxxxx.xxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
75XXX.XXX.XXX.XXXxxx-xxx-xxx-xxx.xxx.xxx.xxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
76XXX.XXX.XXX.XXxxxxxx.xxx-xxx-xxx.xxxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
77XXX.XXX.XXX.XXXXxxxxxxx2022-07-09verifiedWysoki
78XXX.XX.XX.XXxxxxxxx-xxxxxxx-xx.xxx-xx-xx.xxxxxxx.xxXxxxxxxx2022-07-09verifiedWysoki
79XXX.XXX.XX.XXXxxxx-xxx-xxx-xx-xxx.xx.xxxxxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
80XXX.XX.XX.XXXxxxxxxxx-xxxx-xx-xxx.xxxxxxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
81XXX.XXX.XXX.XXxxx-xxx-xxx-xxxxxxxx-xxxxxxx.xxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
82XXX.XXX.XX.XXxxxxxx-xxx-xxx-xx-xx.xxxxxx.xxx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki
83XXX.X.XXX.XXXxxx.xxx.x.xxx.-xxx.xxxxxxxxxxx.xxxXxxxxxxx2022-07-09verifiedWysoki
84XXX.XXX.XX.XXXxxxxxxx2022-07-09verifiedWysoki
85XXX.XXX.XXX.XXxx-xxx-xxx-xxx-xx.xxxxxxxx.xxXxxxxxxx2022-07-09verifiedWysoki
86XXX.XX.XXX.Xxxx-xxx-x.xx.xxx.xxXxxxxxxx2022-07-09verifiedWysoki

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (65)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlasaIndicatorRodzajPewność siebie
1File.htaccesspredictiveMedium
2File/api/baskets/{name}predictiveWysoki
3File/spip.phppredictiveMedium
4File/tmppredictiveNiski
5File/uncpath/predictiveMedium
6File/var/log/nginxpredictiveWysoki
7Fileauth-gss2.cpredictiveMedium
8Filecase.filemanager.phppredictiveWysoki
9Filexxxxx.xx_xxxxxxxxx.xxxpredictiveWysoki
10Filexxxxxx/xxx.xpredictiveMedium
11Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveWysoki
12Filexxxx_xxx.xxxpredictiveMedium
13Filexxxxxxx/xxxx/xxxxxxx/xxxxx.xpredictiveWysoki
14Filexxxxx.xxxpredictiveMedium
15Filexxx/xxxxxxxx/xxxx_xxxxx_xxxxxxx.xpredictiveWysoki
16Filexxxxxxxxxxxx.xxxpredictiveWysoki
17Filexxxxxxx.xxxpredictiveMedium
18Filexxxxxx/xxxxxxxxx?xx=xxx_xxx.xxxpredictiveWysoki
19Filexxxx_xxxx.xpredictiveMedium
20Filexxx/xxxxxx.xxxpredictiveWysoki
21Filexxxxxxx/xxxxxxxxxx/xxxxxx/xxxxxxxx/xxx/xxxxxxxxxxxxxxxxxxxx.xxxpredictiveWysoki
22Filexxxxxxxx/xxxx/xxxxx-xxxxxxxxxx.xxxpredictiveWysoki
23Filexxxxx.xxxpredictiveMedium
24Filexxxxxxx.xxxpredictiveMedium
25Filexxxxxxxx/xxxxxxxx_xxxxxxx_xxxxxx/xxxxx.xxxpredictiveWysoki
26Filexxxxxxxx/xxxxxxxxx.xxxpredictiveWysoki
27Filexxxxxxxxxx/xxxxxxx.xpredictiveWysoki
28Filexxx_xxxxx_xxxxx.xpredictiveWysoki
29Filexxx_xxx_xxx.xxpredictiveWysoki
30Filexxxx.xxxpredictiveMedium
31Filexxx.xxxpredictiveNiski
32Filexxx.xpredictiveNiski
33Filexxxxxxxx.xxxpredictiveMedium
34Filexxx_xxxx.xxpredictiveMedium
35Filexxxxxxxxx.xxxpredictiveWysoki
36Filexxxx-xxxxxxxx.xxxpredictiveWysoki
37Filexxxx/xxxxxxxx/xxxxxxxx.xxxxpredictiveWysoki
38Filexxx/xxx/xxx-xxx/xxxx.xxxpredictiveWysoki
39Filexxxxxxxx.xxxpredictiveMedium
40Filexx-xxxxxxxx/xxxxxx-xxxxxx.xxxpredictiveWysoki
41Filexxx/xxxxxx.xxxpredictiveWysoki
42Library/xxxxx/xxxxxxxx/xxxxxxx.xxxpredictiveWysoki
43Libraryxxxxxxxx.xxxpredictiveMedium
44Libraryxxxxxx_xxx.xxx.xxxpredictiveWysoki
45Libraryxxxxxxxxxx.xxxpredictiveWysoki
46Argument$xxx_xxxxpredictiveMedium
47ArgumentxxxxxxxxxxxxxxpredictiveWysoki
48ArgumentxxxxxxxxpredictiveMedium
49ArgumentxxxxxxxxxxpredictiveMedium
50Argumentxxxxxxx_xxxpredictiveMedium
51ArgumentxxxxxxxxxxxpredictiveMedium
52ArgumentxxxxxxxxpredictiveMedium
53ArgumentxxxxxpredictiveNiski
54ArgumentxxpredictiveNiski
55Argumentxxxxxxx_xxxpredictiveMedium
56Argumentxxxxxx_xxxxpredictiveMedium
57ArgumentxxxxpredictiveNiski
58ArgumentxxxxxxxxpredictiveMedium
59ArgumentxxxxpredictiveNiski
60Argumentxxxxxx_xxxxpredictiveMedium
61Argumentxxx_xxpredictiveNiski
62ArgumentxxxpredictiveNiski
63ArgumentxxxpredictiveNiski
64ArgumentxxxxxxxxpredictiveMedium
65Input Valuexxxxx.xxxpredictiveMedium

Referencje (2)

The following list contains external sources which discuss the actor and the associated activities:

Want to stay up to date on a daily basis?

Enable the mail alert feature now!