Oto Gonderici Analiza

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (70)

Język

en	60
fr	6
de	2
ar	2

Kraj

us	22
fr	4
cn	2
ir	2
cz	2

Aktorzy

Oto Gonderici	4
Havoc	1
Xtreme RAT	1
Alien	1

Wysiłek

Rodzaj

Not Defined	28
Programming Language Software	6
Router Operating System	6
Smartphone Operating System	6
Remote Access Software	6

Sprzedawca

Not Defined	16
Samsung	6
Dell EMC	4
Microsoft	4
FiberHome	2

Produkt

PHP	4
Dell EMC iDRAC9	4
FiberHome HG6245D	2
OLIMPOKS	2
NexusPHP	2

Luki w zabezpieczeniach

#	Słaby punkt	Base	Temp	0day	Dzisiaj	Wyk	Prz	EPSS	CTI	CVE
1	ABUS TVIP 20000-21150 Metacharacter wireless_mft privilege escalation	6.7	6.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01034	0.05	CVE-2023-26609
2	Free5gc NAS Message denial of service	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00063	0.00	CVE-2022-38871
3	Qualcomm Snapdragon Consumer IOT Meta Image memory corruption	4.6	4.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00058	0.00	CVE-2021-1899
4	Qualcomm Snapdragon Auto Display memory corruption	7.8	7.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00044	0.00	CVE-2021-1900
5	IBM Cognos Analytics cross site request forgery	4.3	4.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00153	0.00	CVE-2021-38886
6	Huawei ACXXXX/SXXXX SSH Packet privilege escalation	7.5	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00246	0.02	CVE-2014-8572
7	Mambo CMS thumbs.php Path directory traversal	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00120	0.02	CVE-2013-2565
8	Mutare Voice getfile.asp privilege escalation	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00616	0.00	CVE-2021-27236
9	Dell EMC Unity/UnityVSA/Unity XT Upgrade Readiness Utility weak encryption	1.9	1.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.02	CVE-2021-21547
10	Parallels Desktop Toolgate memory corruption	7.8	7.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00050	0.00	CVE-2021-31420
11	Dell EMC iDRAC9 Configuration memory corruption	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00158	0.00	CVE-2021-21540
12	Samsung SmartThings Port denial of service	3.3	3.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00104	0.00	CVE-2021-25378
13	Cisco Small Business RV Series Router Link Layer Discovery Protocol memory corruption	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00070	0.00	CVE-2021-1251
14	Kagemai cross site scripting	4.8	4.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00115	0.00	CVE-2021-20685
15	Qualcomm Snapdragon Auto RTCP Packet denial of service	7.5	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00103	0.00	CVE-2020-11255
16	RTA 499ES EtherNet-IP Adaptor Source Code memory corruption	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00489	0.00	CVE-2020-25159
17	Apple iOS/iPadOS CoreText information disclosure	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.01679	0.00	CVE-2021-1792
18	Apple iOS/iPadOS denial of service	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00062	0.00	CVE-2021-1773
19	arenavec Crate default denial of service	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00162	0.00	CVE-2021-29930
20	Synology DiskStation Manager SYNO.Core.Network.PPPoE privilege escalation	7.2	6.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00072	0.02	CVE-2021-29083

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adres IP	Hostname	Aktor	Identified	Rodzaj	Pewność siebie
1	51.15.225.63	63-225-15-51.instances.scw.cloud	Oto Gonderici	2021-05-31	verified	Wysoki
2	XX.XXX.XXX.XX	xx-xxx-xxx-xx.xxxxxxxxx.xxx.xxxxx	Xxx Xxxxxxxxx	2021-05-31	verified	Wysoki
3	XX.XX.XXX.XXX	xxxxx.xx-xx-xx-xxx.xx	Xxx Xxxxxxxxx	2021-05-31	verified	Wysoki
4	XX.XX.XXX.XXX	xxxxx.xx-xx-xx-xxx.xx	Xxx Xxxxxxxxx	2021-05-31	verified	Wysoki

TTP - Tactics, Techniques, Procedures (14)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Luki w zabezpieczeniach	Wektor dostępu	Rodzaj	Pewność siebie
1	T1006	CWE-22	Path Traversal	predictive	Wysoki
2	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Wysoki
3	T1068	CWE-269	Execution with Unnecessary Privileges	predictive	Wysoki
4	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Wysoki
5	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Wysoki
6	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Wysoki
7	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Wysoki
8	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Wysoki
9	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
10	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	Wysoki
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
12	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Wysoki
13	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Wysoki
14	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxx	predictive	Wysoki

IOA - Indicator of Attack (25)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasa	Indicator	Rodzaj	Pewność siebie
1	File	/cgi-bin/mft/wireless_mft	predictive	Wysoki
2	File	/usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php	predictive	Wysoki
3	File	audiohd.exe	predictive	Medium
4	File	C:\Windupdt	predictive	Medium
5	File	x:\x_xxxxxxx	predictive	Medium
6	File	xxx-xxx/xxxxxxx	predictive	Wysoki
7	File	xxxxxxxx.xxx/xxxxxxx_xxxxxx.xxx	predictive	Wysoki
8	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Wysoki
9	File	xxx/xxxxxxxx/xxxx_xxxxx.x	predictive	Wysoki
10	File	xxxxxxx.xxx	predictive	Medium
11	File	xxxxxx	predictive	Niski
12	File	xxxxxx.xxx	predictive	Medium
13	File	xxx.x	predictive	Niski
14	Library	xxxxxxxxx.xxx	predictive	Wysoki
15	Library	xxxxxxxxxx.xxx	predictive	Wysoki
16	Argument	xx	predictive	Niski
17	Argument	xx	predictive	Niski
18	Argument	xxxxxxx	predictive	Niski
19	Argument	xxxx_xxxx	predictive	Medium
20	Argument	xxxxxxxx	predictive	Medium
21	Argument	xxxxxx	predictive	Niski
22	Input Value	%xxx%xxxxxxxxx%xxxxxxx(x)>%xx	predictive	Wysoki
23	Input Value	.x./	predictive	Niski
24	Input Value	::$xxxxx_xxxxxxxxxx	predictive	Wysoki
25	Network Port	xxx xxxxxx xxxx	predictive	Wysoki

Referencje (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PoprzedniPrzeglądKolejny ▸

Do you need the next level of professionalism?

Upgrade your account now!