Sodinokibi Analiza

IOB - Indicator of Behavior (92)

Oś czasu

Język

en84
pt2
fr2
es2
ru2

Kraj

Aktorzy

Zajęcia

Wysiłek

Oś czasu

Rodzaj

Sprzedawca

Produkt

Oracle Java SE6
Microsoft Windows6
Linux Kernel4
njs4
Google Chrome4

Luki w zabezpieczeniach

#Słaby punktBaseTemp0dayDzisiajWykPrzEPSSCTICVE
1FLDS redir.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.002030.15CVE-2008-5928
2Debian fuse Package cuse privilege escalation7.87.5$5k-$25k$0-$5kNot DefinedOfficial Fix0.000420.00CVE-2016-1233
3OpenEMR sl_eob_search.php privilege escalation7.57.2$0-$5k$0-$5kNot DefinedOfficial Fix0.001810.00CVE-2018-15154
4Pandao editor.md Markdown cross site scripting4.84.8$0-$5k$0-$5kNot DefinedNot Defined0.000550.06CVE-2023-29641
5LogicBoard CMS away.php Redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable0.000002.16
6OpenX adclick.php Redirect5.34.7$0-$5k$0-$5kUnprovenUnavailable0.004400.51CVE-2014-2230
7Apple Mac OS X Server Wiki Server sql injection5.34.6$5k-$25k$0-$5kUnprovenOfficial Fix0.003391.21CVE-2015-5911
8SAP 3D Visual Enterprise Viewer GIF File denial of service3.83.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.000610.00CVE-2021-27593
9Apple macOS IOMobileFrameBuffer memory corruption7.87.5$5k-$25k$0-$5kHighOfficial Fix0.002630.15CVE-2022-22587
10Apple iOS/iPadOS IOMobileFrameBuffer memory corruption7.87.5$25k-$100k$5k-$25kHighOfficial Fix0.002630.04CVE-2022-22587
11Apple Safari WebKit denial of service7.37.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.008560.00CVE-2014-4452
12HPE Ezmeral Data Fabric TEZ MapR Ecosystem privilege escalation6.36.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.001970.00CVE-2021-29215
13nginx ngx_http_mp4_module information disclosure5.95.8$0-$5k$0-$5kNot DefinedOfficial Fix0.001980.05CVE-2018-16845
14SonarQube values weak encryption5.95.9$0-$5k$0-$5kNot DefinedNot Defined0.368800.01CVE-2020-27986
15Bitnami Docker Container .env weak encryption3.53.4$0-$5k$0-$5kNot DefinedOfficial Fix0.001170.02CVE-2021-21979
16Google Android System privilege escalation7.06.3$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.003060.07CVE-2017-13209
17PHP addcslashe Remote Code Execution8.58.1$5k-$25k$0-$5kUnprovenOfficial Fix0.005390.00CVE-2016-4344
18Sophos XG Firewall HTTPS Bookmark memory corruption8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.007730.00CVE-2020-15069
19Marvin Minsky Universal Turing Machine privilege escalation4.64.4$0-$5k$0-$5kProof-of-ConceptNot Defined0.000480.00CVE-2021-32471
20Sophos Cyberoam Firewall SSL VPN Console privilege escalation8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.006420.03CVE-2019-17059

IOC - Indicator of Compromise (28)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDadres IPHostnameAktorKampanieIdentifiedRodzajPewność siebie
145.55.211.79Sodinokibi2019-05-02verifiedWysoki
246.30.215.77webcluster1.webpod6-cph3.one.comSodinokibi2022-04-14verifiedWysoki
346.45.134.70server-46.45.134.70.as42926.netSodinokibi2022-04-14verifiedWysoki
450.116.71.86box6146.bluehost.comSodinokibi2022-04-14verifiedWysoki
552.9.200.151www.drvoip.comSodinokibi2022-04-14verifiedWysoki
652.28.116.69ec2-52-28-116-69.eu-central-1.compute.amazonaws.comSodinokibi2022-04-14verifiedMedium
7XX.XXX.XX.XXxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
8XX.XXX.X.XXxxx-xx-xxx-x-xx.xxxxxxx.xxxx-xxxxxxx-xxxxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
9XX.XXX.XX.XXXXxxxxxxxxx2022-04-14verifiedWysoki
10XX.XX.XXX.XXXxxxxxxxxxx.xxxxxxx.xxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
11XXX.XXX.XX.XXxx-xxx-xxx-xx-xx.xx.xxxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
12XXX.XX.XXX.XXXxx-xxx-xx-xxx-xxx.xxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
13XXX.XXX.XXX.XXxxxxxx.xxxx.xxXxxxxxxxxx2022-04-14verifiedWysoki
14XXX.XX.XX.XXXXxxxxxxxxx2019-05-02verifiedWysoki
15XXX.XXX.XXX.XXXxxxx.xxxxxxxxxxxxxxxx.xxXxxxxxxxxx2022-04-14verifiedWysoki
16XXX.XXX.XX.XXxxxxxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
17XXX.XX.X.XXXxxx.xxxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
18XXX.XXX.XX.XXXxxxxxx.xxxxxxxxxxxx.xxXxxxxxxxxx2022-04-14verifiedWysoki
19XXX.XXX.XXX.XXxx-xxx-xxx-xxx-xx.xxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
20XXX.XXX.XX.XXXxxxxxxxxxx.xxxxxxx.xxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
21XXX.XXX.XX.XXXXxxxxxxxxx2019-05-02verifiedWysoki
22XXX.XXX.XX.XXXxxxx.xxxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
23XXX.XX.XXX.XXxxxx.xxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
24XXX.XXX.XXX.XXxxxxx-xx.xxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
25XXX.XX.XXX.XXXxx-xxx-xx-xxx-xxx.xx.xxxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
26XXX.XX.XXX.XXXxxx-xx-xxx-xxx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
27XXX.XXX.XX.Xxxxxxxxxxx.xxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki
28XXX.XXX.XX.XXxxxxxxxxxx.xxx.xxxXxxxxxxxxx2022-04-14verifiedWysoki

TTP - Tactics, Techniques, Procedures (16)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueKlasaLuki w zabezpieczeniachWektor dostępuRodzajPewność siebie
1T1006CAPEC-126CWE-22Path TraversalpredictiveWysoki
2T1040CAPEC-102CWE-294, CWE-319Authentication Bypass by Capture-replaypredictiveWysoki
3T1055CAPEC-10CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveWysoki
4T1059CAPEC-242CWE-94Argument InjectionpredictiveWysoki
5TXXXX.XXXCAPEC-209CWE-XX, CWE-XXXxxxx Xxxx XxxxxxxxxpredictiveWysoki
6TXXXXCAPEC-122CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveWysoki
7TXXXXCAPEC-136CWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveWysoki
8TXXXX.XXXCAPEC-178CWE-XXXXxxx XxxxxxxxpredictiveWysoki
9TXXXXCAPEC-0CWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveWysoki
10TXXXXCAPEC-1CWE-XXX, CWE-XXXXxxxxxxxxx XxxxxxpredictiveWysoki
11TXXXXCAPEC-108CWE-XXXxx XxxxxxxxxpredictiveWysoki
12TXXXXCAPEC-112CWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveWysoki
13TXXXX.XXXCAPEC-459CWE-XXXXxxxxxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveWysoki
14TXXXXCAPEC-116CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveWysoki
15TXXXXCAPEC-157CWE-XXX, CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveWysoki
16TXXXX.XXXCAPEC-112CWE-XXXXxx Xxxxxxxxxx XxxxxpredictiveWysoki

IOA - Indicator of Attack (34)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlasaIndicatorRodzajPewność siebie
1File/dev/cusepredictiveMedium
2File/dev/snd/seqpredictiveMedium
3File/forum/away.phppredictiveWysoki
4File/tmp/app/.envpredictiveWysoki
5File/xxx/xxxxx/xxxxxxxxxxxxxxxxxxxx/xxx/predictiveWysoki
6Filexxxxxxx.xxxpredictiveMedium
7Filexxxxx/xxxxxxxx.xxxpredictiveWysoki
8Filexxx/xxxxxxxx/xxxxxxpredictiveWysoki
9Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveWysoki
10Filexxxxxxx.xxxpredictiveMedium
11Filexxxxxxx.xxxxpredictiveMedium
12Filexx/xxxxx.xpredictiveMedium
13Filexxxxxxx.xpredictiveMedium
14Filexxxxx.xxpredictiveMedium
15Filexxxxxxxxx/xxxxxxx/xx_xxx_xxxxxx.xxxpredictiveWysoki
16Filexxxxxxx_xxxxxxxxxxxx.xpredictiveWysoki
17Filexxxx.xpredictiveNiski
18Filexxx_xxxxx.xpredictiveMedium
19Filexxx_xxxx.xpredictiveMedium
20Filexxx_xxxxx.xpredictiveMedium
21Filexxxxxx/xxxxxxxxxxxxxxxxx.xxpredictiveWysoki
22Filexxxxx.xxxpredictiveMedium
23Filexxxx-xxxxxx.xpredictiveWysoki
24Filexxxxxxxxx_xxxpredictiveWysoki
25Filexxxx/xxx/xxxx-xxxxx.xxxpredictiveWysoki
26Argumentxxx_xxxpredictiveNiski
27ArgumentxxxxpredictiveNiski
28ArgumentxxpredictiveNiski
29ArgumentxxxxxxxxxxxxxxpredictiveWysoki
30Argumentxxxxx_xxxxxxxpredictiveWysoki
31ArgumentxxxxxxpredictiveNiski
32ArgumentxxxxxxxxxpredictiveMedium
33Input Value.%xx.../.%xx.../predictiveWysoki
34Input Valuexxxxx/xxxxxxxxpredictiveWysoki

Referencje (3)

The following list contains external sources which discuss the actor and the associated activities:

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!