OrcaRAT Analiza

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (7)

Język

es	8

Kraj

es	6
za	2

Aktorzy

OrcaRAT	1

Wysiłek

Rodzaj

Router Operating System	2
WordPress Plugin	2
Web Server	2
Not Defined	2

Sprzedawca

MikroTik	2
ThemePunch	2
Apache	2
Juniper	2

Produkt

MikroTik RouterOS	2
ThemePunch Slider Revolution Plugin	2
Apache HTTP Server	2
Juniper Web Device Manager	2

Luki w zabezpieczeniach

#	Słaby punkt	Base	Temp	0day	Dzisiaj	Wyk	Prz	EPSS	CTI	CVE
1	ProFTPD mod_copy privilege escalation	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.94462	0.04	CVE-2019-12815
2	nginx ngx_http_mp4_module information disclosure	5.9	5.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00198	0.05	CVE-2018-16845
3	Apache HTTP Server mod_reqtimeout denial of service	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01696	0.04	CVE-2007-6750
4	Juniper Web Device Manager Authentication weak authentication	9.8	9.0	$5k-$25k	$0-$5k	Proof-of-Concept	Workaround	0.00000	0.00
5	ThemePunch Slider Revolution Plugin privilege escalation	7.3	7.3	$0-$5k	$0-$5k	High	Not Defined	0.95492	0.00	CVE-2014-9735
6	MikroTik RouterOS Winbox weak authentication	8.2	7.4	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.97496	0.02	CVE-2018-14847
7	Linux Directory Penguin Traceroute Script traceroute.pl privilege escalation	9.8	9.8	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.01891	0.02	CVE-2002-0488

IOC - Indicator of Compromise (15)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adres IP	Hostname	Aktor	Identified	Rodzaj	Pewność siebie
1	11.38.64.251		OrcaRAT	2021-01-01	verified	Wysoki
2	23.19.39.19		OrcaRAT	2021-01-01	verified	Wysoki
3	58.71.158.21		OrcaRAT	2021-01-01	verified	Wysoki
4	XX.XX.XXX.XXX	xxxxxxxxxx-xxx.xxx.xxx.xx	Xxxxxxx	2021-01-01	verified	Wysoki
5	XX.XXX.XX.XXX	xxxxxx-xx-xxx-xx-xxx.xxxxxx.xxxx.xxxxxxx.xxx	Xxxxxxx	2021-01-01	verified	Wysoki
6	XX.XXX.XXX.XX		Xxxxxxx	2021-01-01	verified	Wysoki
7	XX.XXX.XX.XX		Xxxxxxx	2021-01-01	verified	Wysoki
8	XXX.XXX.XX.XXX		Xxxxxxx	2021-01-01	verified	Wysoki
9	XXX.XXX.XXX.XX		Xxxxxxx	2021-01-01	verified	Wysoki
10	XXX.X.XXX.XX	xxxxxxx.xxxxxxxxx.xxx	Xxxxxxx	2021-01-01	verified	Wysoki
11	XXX.XX.XX.XXX		Xxxxxxx	2021-01-01	verified	Wysoki
12	XXX.XX.XX.XXX	xxxxx.xx-xxx-xx-xx.xx	Xxxxxxx	2021-01-01	verified	Wysoki
13	XXX.XX.XX.XXX	xxxxx.xx-xxx-xx-xx.xx	Xxxxxxx	2021-01-01	verified	Wysoki
14	XXX.XXX.XXX.XXX	xxxx-xxx.xxxxxxxxx.xxx	Xxxxxxx	2021-01-01	verified	Wysoki
15	XXX.XXX.XX.XXX		Xxxxxxx	2021-01-01	verified	Wysoki

TTP - Tactics, Techniques, Procedures (3)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Luki w zabezpieczeniach	Wektor dostępu	Rodzaj	Pewność siebie
1	T1068	CWE-264, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	Wysoki
2	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Wysoki
3	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Wysoki

IOA - Indicator of Attack (2)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasa	Indicator	Rodzaj	Pewność siebie
1	File	traceroute.pl	predictive	Wysoki
2	Argument	xxxx	predictive	Niski

Referencje (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PoprzedniPrzeglądKolejny ▸

Do you need the next level of professionalism?

Upgrade your account now!