RATicate Analiza

IOB - Indicator of Behavior (52)

Oś czasu

Język

en34
de12
pl4
es2

Kraj

Aktorzy

Zajęcia

Wysiłek

Oś czasu

Rodzaj

Sprzedawca

Produkt

Tim Kosse FileZilla2
PHPChain2
Microsoft IIS2
Google Android2
Todd Miller sudo2

Luki w zabezpieczeniach

#Słaby punktBaseTemp0dayDzisiajWykPrzEPSSCTICVE
1All Enthusiast Inc Reviewpost Php Pro showproduct.php sql injection7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.005010.00CVE-2004-2175
2PhotoPost PHP Pro showproduct.php sql injection9.89.4$0-$5k$0-$5kNot DefinedOfficial Fix0.002760.04CVE-2004-0250
3OpenSSH Authentication Username information disclosure5.34.8$5k-$25k$0-$5kHighOfficial Fix0.107370.18CVE-2016-6210
4BitTorrent uTorrent Bencoding Parser privilege escalation6.46.4$0-$5k$0-$5kNot DefinedNot Defined0.008670.04CVE-2020-8437
5MDaemon Webmail cross site scripting5.45.3$0-$5k$0-$5kNot DefinedOfficial Fix0.000700.02CVE-2019-8983
6Synology DiskStation Manager Change Password privilege escalation7.17.0$0-$5k$0-$5kNot DefinedOfficial Fix0.000680.03CVE-2018-8916
7Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.005480.33CVE-2017-0055
8Todd Miller sudo sudoedit sudoers privilege escalation7.87.0$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.000610.00CVE-2015-5602
9Tim Kosse FileZilla Format String7.37.0$25k-$100k$0-$5kNot DefinedOfficial Fix0.033390.04CVE-2007-2318
10BusyBox Terminal lineedit.c add_match privilege escalation7.57.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.005220.07CVE-2017-16544
11Microsoft Office Equation Editor memory corruption7.57.4$5k-$25k$0-$5kHighOfficial Fix0.916200.03CVE-2018-0798
12Citrix ADC/Gateway/NetScaler Gateway/SD-WAN WANOP SSL VPN Web Portal cross site scripting3.53.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000780.00CVE-2020-8245
13Gallarific PHP Photo Gallery script gallery.php sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.001120.04CVE-2011-0519
14Gempar Script Toko Online shop_display_products.php sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.001000.02CVE-2009-0296
15K5n WebCalendar send_reminders.php privilege escalation7.36.4$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.051780.02CVE-2008-2836
16Microsoft IIS privilege escalation9.99.9$25k-$100k$5k-$25kNot DefinedNot Defined0.088750.04CVE-2010-1256
17Python urllib.request.AbstractBasicAuthHandler privilege escalation6.46.4$0-$5k$0-$5kNot DefinedOfficial Fix0.008370.07CVE-2020-8492
18nginx URI String privilege escalation6.56.2$0-$5k$0-$5kNot DefinedOfficial Fix0.954330.04CVE-2013-4547
19Microsoft Windows Remote Desktop privilege escalation7.57.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.046620.00CVE-2019-1333
20Mozilla Firefox/Firefox ESR IFRAME PDF.js privilege escalation8.68.2$25k-$100k$0-$5kNot DefinedOfficial Fix0.011460.00CVE-2013-5598

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDadres IPHostnameAktorKampanieIdentifiedRodzajPewność siebie
179.134.225.11RATicate2021-05-31verifiedWysoki
2XX.XXX.XXX.XXXxxxxxxx2021-05-31verifiedWysoki

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueKlasaLuki w zabezpieczeniachWektor dostępuRodzajPewność siebie
1T1059CAPEC-242CWE-94Argument InjectionpredictiveWysoki
2T1059.007CAPEC-209CWE-79, CWE-80Cross Site ScriptingpredictiveWysoki
3TXXXXCAPEC-19CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveWysoki
4TXXXXCAPEC-0CWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveWysoki
5TXXXXCAPEC-108CWE-XXXxx XxxxxxxxxpredictiveWysoki
6TXXXXCAPEC-50CWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveWysoki
7TXXXXCAPEC-116CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveWysoki
8TXXXXCAPEC-0CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveWysoki

IOA - Indicator of Attack (21)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlasaIndicatorRodzajPewność siebie
1File/etc/sudoerspredictiveMedium
2File/uncpath/predictiveMedium
3Filecat.phppredictiveNiski
4Filexxxxxx.xxxpredictiveMedium
5Filexxxxxxxxxxx/xxxxx.xxxpredictiveWysoki
6Filexxxxxxx.xxxpredictiveMedium
7Filexxxxx/xxxxxxxx.xpredictiveWysoki
8Filexxx.xxpredictiveNiski
9Filexxxxxxx_xxx_xxxxx_xxxxxx.xxxxpredictiveWysoki
10Filexxxx_xxxxxxxxx.xxxpredictiveWysoki
11Filexxxx_xxxxxxx_xxxxxxxx.xxxpredictiveWysoki
12Filexxxxxxxxxxx.xxxpredictiveWysoki
13Filexxxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxxpredictiveWysoki
14ArgumentxxxpredictiveNiski
15ArgumentxxxxxpredictiveNiski
16Argumentxxx_xxpredictiveNiski
17ArgumentxxxxxxxxpredictiveMedium
18ArgumentxxpredictiveNiski
19Argumentxxxx_xxpredictiveNiski
20ArgumentxxxxxpredictiveNiski
21ArgumentxxxxxxxxpredictiveMedium

Referencje (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!