WarZoneRAT Analiza

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (83)

Język

en	60
zh	16
de	6
it	2

Kraj

cn	18
us	16
de	6
it	6
es	4

Aktorzy

Remcos	2
Nanocore RAT	2
Ave Maria	2
AsyncRAT	2
BitRAT	2

Wysiłek

Rodzaj

Not Defined	32
Log Management Software	6
Operating System	6
Network Management Software	4
Content Management System	4

Sprzedawca

Not Defined	20
Microsoft	10
Cisco	4
HPE	4
B&R	4

Produkt

Microsoft Windows	6
HPE Intelligent Management Center	4
B&R GateManager 4260	4
B&R GateManager 9250	4
Cisco IoT Field Network Director	2

Luki w zabezpieczeniach

#	Słaby punkt	Base	Temp	0day	Dzisiaj	Wyk	Prz	CTI	EPSS	CVE
1	Apache HTTP Server mod_proxy privilege escalation	7.3	7.3	$25k-$100k	$25k-$100k	Not Defined	Not Defined	0.00	0.97406	CVE-2021-40438
2	Microsoft Excel memory corruption	7.0	6.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.01492	CVE-2020-0650
3	VMware Spring Boot HTTP Request denial of service	5.7	5.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.05	0.00043	CVE-2023-34055
4	bouncycastle Self-Signed Certificate X509LDAPCertStoreSpi.java privilege escalation	3.9	3.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00051	CVE-2023-33201
5	Nagios XI POST Request banner_message-ajaxhelper.php sql injection	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.15	0.00085	CVE-2023-40931
6	Taokeyun HTTP POST Request Drs.php index sql injection	8.1	7.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.06	0.00063	CVE-2024-0480
7	Apache ShardingSphere ElasticJob-UI information disclosure	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.12656	CVE-2022-22733
8	phpMyAdmin SQL File cross site scripting	4.4	4.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.00053	CVE-2023-25727
9	ZoneMinder HostController.php daemonControl privilege escalation	7.4	7.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05	0.00119	CVE-2023-26039
10	Zoho ManageEngine Recovery Manager Plus Proxy Setting Privilege Escalation	5.7	5.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	0.00507	CVE-2023-48646
11	jeecgboot JimuReport image directory traversal	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.20	0.00062	CVE-2023-6307
12	WP Shortcodes Plugin privilege escalation	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.04	0.00050	CVE-2023-6226
13	QDocs Smart School HTTP POST Request sql injection	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.34	0.00077	CVE-2023-5495
14	MongoDB privilege escalation	6.6	6.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00109	CVE-2019-2386
15	MongoDB Message Decompressor denial of service	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00087	CVE-2019-20925
16	MongoDB SysV Init Script Kill privilege escalation	4.2	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	0.00044	CVE-2019-2389
17	Job Configuration History Plugin directory traversal	3.9	3.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.05	0.00046	CVE-2023-41930
18	TEL-STER TelWin SCADA WebInterface information disclosure	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00076	CVE-2023-0956
19	Tongda OA delete_seal.php sql injection	6.9	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.05	0.00066	CVE-2023-4165
20	Autodesk AutoCAD STP File Parser denial of service	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00045	CVE-2023-41139

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adres IP	Hostname	Aktor	Kampanie	Identified	Rodzaj	Pewność siebie
1	185.19.85.163		WarZoneRAT		2022-07-12	verified	Wysoki
2	XXX.XXX.XX.XXX		Xxxxxxxxxx		2022-07-12	verified	Wysoki

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Luki w zabezpieczeniach	Wektor dostępu	Rodzaj	Pewność siebie
1	T1006	CWE-22, CWE-23	Path Traversal	predictive	Wysoki
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Wysoki
3	T1059	CWE-94	Argument Injection	predictive	Wysoki
4	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Wysoki
5	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
6	TXXXX	CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	predictive	Wysoki
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Wysoki
8	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Wysoki
9	TXXXX	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	Wysoki
10	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Wysoki
11	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	Wysoki
12	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
13	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Wysoki

IOA - Indicator of Attack (37)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasa	Indicator	Rodzaj	Pewność siebie
1	File	/admin/syslog	predictive	Wysoki
2	File	/course/filterRecords/	predictive	Wysoki
3	File	/download/image	predictive	Wysoki
4	File	/nagiosxi/admin/banner_message-ajaxhelper.php	predictive	Wysoki
5	File	/see_more_details.php	predictive	Wysoki
6	File	/xxx/xxx/xxx/xxxxxxxxxx/xxxxxxxxxxxxxx.xxx	predictive	Wysoki
7	File	xxxxx/xxxxx_xxxxx.xxx	predictive	Wysoki
8	File	xxxxx/xxxxxxxxxxxxx.xxx	predictive	Wysoki
9	File	xxxxxxxxxxx/xxxxx/xxxxxxxxxx/x/xxx.xxx	predictive	Wysoki
10	File	xxxxx.xxx	predictive	Medium
11	File	xxx.xxx	predictive	Niski
12	File	xxxxxx/xxx.x	predictive	Medium
13	File	xxxxxxx.xxx	predictive	Medium
14	File	xxxxxxx/xxxxxx/xxxx_xxxxxx/xxxxxxxxxx/xxxxxx_xxxx.xxx	predictive	Wysoki
15	File	xxxxx.xxx/xxxx/xxxxx/xxxx/xxxx.xxx	predictive	Wysoki
16	File	xxxx_xxxxxxx.xxx	predictive	Wysoki
17	File	xxxxx_xxx.xxx	predictive	Wysoki
18	File	xxxxxxxx.xxx	predictive	Medium
19	File	xxxx.xxx	predictive	Medium
20	File	xxxx-xxxxxx.x	predictive	Wysoki
21	File	xxxxx.xxx	predictive	Medium
22	File	xxxxxxxxxxxxxxxxxxxx.xxxx	predictive	Wysoki
23	Library	xxxxxx.xxx	predictive	Medium
24	Argument	xxxxxx	predictive	Niski
25	Argument	xxx	predictive	Niski
26	Argument	xxx	predictive	Niski
27	Argument	xxxxxx_xxx	predictive	Medium
28	Argument	xxxxx	predictive	Niski
29	Argument	xx	predictive	Niski
30	Argument	xx	predictive	Niski
31	Argument	xxxxxxxx	predictive	Medium
32	Argument	xxxx	predictive	Niski
33	Argument	xxxxxxxxxx[x][xxxxx]/xxxxxxxxxx[x][xxxxxxxxxxx]/xxxxxxxxxx[x][xxxxxxxxxxx]	predictive	Wysoki
34	Argument	xxxxxxxx	predictive	Medium
35	Argument	xxx	predictive	Niski
36	Argument	xxxx	predictive	Niski
37	Pattern	\|xx xx xx\|	predictive	Medium

Referencje (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PoprzedniPrzeglądKolejny ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!