3CX Backdoor Análise

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (220)

Idioma

en	154
zh	30
pl	22
de	6
jp	2

País

us	166
cn	40
pl	6
ir	2

Actores

3CX Backdoor	8
Cobalt Strike	4
Mirai	1
ENT11	1
DCRat	1

Interesse

Tipo

Not Defined	62
Content Management System	10
Forum Software	10
Smartphone Operating System	8
Programming Language Software	4

Fabricante

Not Defined	54
Huawei	18
Apache	6
Oracle	4
Adobe	4

Produto

JForum	4
cURL	4
GeniXCMS	2
PHPGurukul User Registration Login and User Manage ...	2
Oracle Java SE	2

Vulnerabilidades

#	Vulnerabilidade	Base	Temp	0day	Hoje	Exp	Mas	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash Divulgação de Informação	5.3	5.2	$5k-$25k	Calculado	High	Workaround	0.02016	0.00	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php direitos alargados	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.57	CVE-2010-0966
3	TikiWiki tiki-register.php direitos alargados	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01075	7.68	CVE-2006-6168
4	Tiki Admin Password tiki-login.php Fraca autenticação	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	2.18	CVE-2020-15906
5	MGB OpenSource Guestbook email.php Injecção SQL	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.01302	0.68	CVE-2007-0354
6	OpenX adclick.php Redirect	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00440	0.23	CVE-2014-2230
7	Simple Machines Forum memberlist.php Injecção SQL	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01111	0.09	CVE-2005-4159
8	NotificationX Plugin SQL Statement Injecção SQL	5.6	5.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02414	0.04	CVE-2022-0349
9	DeDeCMS recommend.php Injecção SQL	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02488	0.00	CVE-2017-17731
10	Pligg cloud.php Injecção SQL	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	2.00
11	SAP ERP HCM Travel Management direitos alargados	5.9	5.9	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00065	0.00	CVE-2020-6301
12	Samsung Mobile Devices Exynos Chipset Excesso de tampão	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00173	0.00	CVE-2020-25279
13	Huawei P30 Negação de Serviço	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00058	0.00	CVE-2020-9104
14	JForum Login direitos alargados	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00157	0.06	CVE-2012-5338
15	DZCP deV!L`z Clanportal browser.php Divulgação de Informação	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02733	0.68	CVE-2007-1167
16	Microsoft Windows PostMessage direitos alargados	5.5	5.2	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00044	0.00	CVE-2010-1735
17	PHPWind goto.php Roteiro Cruzado de Sítios	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00254	0.04	CVE-2015-4135
18	Advisto Peel SHOPPING caddie_ajout.php Falsificação de Pedido Cross Site	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00118	0.04	CVE-2018-20848
19	Hibernate ORM JPA Criteria API Injecção SQL	6.4	6.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00104	0.00	CVE-2019-14900
20	JForum jforum.page Falsificação de Pedido Cross Site	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00173	0.02	CVE-2022-26173

IOC - Indicator of Compromise (23)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	Endereço IP	Hostname	Actor	Identified	Tipo	Aceitação
1	8.134.69.22		3CX Backdoor	06/04/2024	verified	Alto
2	20.205.173.250		3CX Backdoor	06/04/2024	verified	Alto
3	34.81.83.87	87.83.81.34.bc.googleusercontent.com	3CX Backdoor	06/04/2024	verified	Médio
4	38.6.218.204		3CX Backdoor	06/04/2024	verified	Alto
5	39.101.70.82		3CX Backdoor	06/04/2024	verified	Alto
6	XX.XXX.XXX.XXX		Xxx Xxxxxxxx	06/04/2024	verified	Alto
7	XX.XXX.XX.XXX		Xxx Xxxxxxxx	06/04/2024	verified	Alto
8	XXX.XX.XXX.XXX		Xxx Xxxxxxxx	06/04/2024	verified	Alto
9	XXX.XXX.XXX.XXX		Xxx Xxxxxxxx	06/04/2024	verified	Alto
10	XXX.XXX.XX.XXX		Xxx Xxxxxxxx	06/04/2024	verified	Alto
11	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx Xxxxxxxx	06/04/2024	verified	Alto
12	XXX.XXX.XX.XX	xxx-xxx-xx-xx-xxxx.xxxxxxxxxxxx.xxx	Xxx Xxxxxxxx	06/04/2024	verified	Alto
13	XXX.XX.XXX.XXX		Xxx Xxxxxxxx	06/04/2024	verified	Alto
14	XXX.XX.X.XX		Xxx Xxxxxxxx	06/04/2024	verified	Alto
15	XXX.XX.XX.XX		Xxx Xxxxxxxx	06/04/2024	verified	Alto
16	XXX.XX.X.XX		Xxx Xxxxxxxx	06/04/2024	verified	Alto
17	XXX.XX.XX.XXX		Xxx Xxxxxxxx	06/04/2024	verified	Alto
18	XXX.X.XXX.XXX	xxxxxxxxxxxx.xxxxxx.xxxxxxx.xxx	Xxx Xxxxxxxx	06/04/2024	verified	Alto
19	XXX.XX.XXX.XXX	xxx-xxx-xx-xxx-xxx.xxxxxxx.xxxxxxxx-xxx.xxx	Xxx Xxxxxxxx	06/04/2024	verified	Alto
20	XXX.XXX.XX.XXX	xxx-xx-xx-xxx-xxxxxxxxx.xxxxxxxx.xxx	Xxx Xxxxxxxx	06/04/2024	verified	Alto
21	XXX.XX.XX.XX		Xxx Xxxxxxxx	06/04/2024	verified	Alto
22	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx Xxxxxxxx	06/04/2024	verified	Alto
23	XXX.XX.XXX.XXX		Xxx Xxxxxxxx	06/04/2024	verified	Alto

TTP - Tactics, Techniques, Procedures (18)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classificação	Vulnerabilidades	Tipo de acesso	Tipo	Aceitação
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Alto
2	T1040	CAPEC-102	CWE-319	Authentication Bypass by Capture-replay	predictive	Alto
3	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
4	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Alto
5	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
6	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
7	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
8	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
9	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
10	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Alto
11	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Alto
12	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
13	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Alto
14	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
15	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
16	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
17	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto
18	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (71)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Tipo	Aceitação
1	File	/.htpasswd	predictive	Médio
2	File	/folder/list	predictive	Médio
3	File	/wp-admin/options.php	predictive	Alto
4	File	/WWW//app/admin/controller/admincontroller.php	predictive	Alto
5	File	adclick.php	predictive	Médio
6	File	add_comment.php	predictive	Alto
7	File	cloud.php	predictive	Médio
8	File	comment_add.asp	predictive	Alto
9	File	data/gbconfiguration.dat	predictive	Alto
10	File	xxxx/xxxxxxx.xxx	predictive	Alto
11	File	xxxxxxx/xxx/xxx/xxx_xxxxx.x	predictive	Alto
12	File	xxxxxxxx.xxx	predictive	Médio
13	File	xxxxx.xxx	predictive	Médio
14	File	xx/xxxxx/xxxxxx_xxxxx.xxx	predictive	Alto
15	File	xxxx.xxx	predictive	Médio
16	File	xxxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	Alto
17	File	xxxxxxx/xxxxxxx_xxxxxx/xxxx/xxxxx_xxxx/xxxx_xxxxxx.xxx	predictive	Alto
18	File	xxxx.xxx	predictive	Médio
19	File	xxxxxx/xxxx/xxxxxxxxxxxxxxxxx.xxx	predictive	Alto
20	File	xxx/xxxxxx.xxx	predictive	Alto
21	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	Alto
22	File	xxxxxxxx/xxx/xxx_xxxxxxx.xxx	predictive	Alto
23	File	xxxxx.xxx	predictive	Médio
24	File	xxxxxxx.x	predictive	Médio
25	File	xxxxxx.xxxx	predictive	Médio
26	File	xxxxxxxxx/xxxxxxx/xxxxx.xxx	predictive	Alto
27	File	xxxxx.xxx	predictive	Médio
28	File	xx-xxxxx/xxxx-xxxx.xxx	predictive	Alto
29	File	xxxxxxxxxx.xxx	predictive	Alto
30	File	xxx/xxx_xxx_xxxxxxx.x	predictive	Alto
31	File	xxx/xxxxxxxxx/x_xxxxxx.x	predictive	Alto
32	File	xxxx/xxxxxxxxx.xxx	predictive	Alto
33	File	xxxxxx/xxxxx.xxx/xxxxx/xxxx/xxxxx/xxx	predictive	Alto
34	File	xxxxxxxx-x.xx	predictive	Alto
35	File	xxxxxxxx.xxx	predictive	Médio
36	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	Alto
37	File	xxxxxxxx.xxx	predictive	Médio
38	File	xxxxxx.xxx	predictive	Médio
39	File	xxxx-xxxxx.xxx	predictive	Alto
40	File	xxxx-xxxxxxxx.xxx	predictive	Alto
41	File	xxxxxxx.xxx/xxxxxxx.xxxxxxxxxxxx/xxxxxxx/xxxxxxxxx/xxxxxxxxx.xxxx.xx	predictive	Alto
42	File	xxxxxx.xxx	predictive	Médio
43	File	xxxxxxx/xxxxxxxx-xxxx	predictive	Alto
44	File	xxx-xxx-xxxxx/xxx/xxxx/xxxx/xxx/xxx/xxx/xxxxx/xxxxxxxxxx/xxxxxxxxxxxxxx.xxxx	predictive	Alto
45	Library	xxxx.xxx	predictive	Médio
46	Argument	$_xxxxx	predictive	Baixo
47	Argument	xxxxxxxx	predictive	Médio
48	Argument	xxxxxxxxxx	predictive	Médio
49	Argument	xxxxxxxxxxxxx	predictive	Alto
50	Argument	xxxxxxxxxxxxx	predictive	Alto
51	Argument	xxxxxxxxx[x]	predictive	Médio
52	Argument	xxxx	predictive	Baixo
53	Argument	xxxxx_xxx	predictive	Médio
54	Argument	xxxxxxx=xxxxxxxx	predictive	Alto
55	Argument	xxxx	predictive	Baixo
56	Argument	xxxxx	predictive	Baixo
57	Argument	xxxxxx	predictive	Baixo
58	Argument	xx	predictive	Baixo
59	Argument	xxxx	predictive	Baixo
60	Argument	xx_xx	predictive	Baixo
61	Argument	xxxxxx	predictive	Baixo
62	Argument	xxxxxxxx	predictive	Médio
63	Argument	xxxxxxx	predictive	Baixo
64	Argument	xxxxxxxxxx	predictive	Médio
65	Argument	xxxxxxxxxx	predictive	Médio
66	Argument	xxx_xx	predictive	Baixo
67	Argument	xxxxxxxx	predictive	Médio
68	Argument	xxxxx	predictive	Baixo
69	Argument	xxx	predictive	Baixo
70	Argument	xxxxxxxx/xxxxxxxx	predictive	Alto
71	Input Value	xxxxxxxxxx:xxxxxxxxx	predictive	Alto

Referências (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ VoltarVisão GeralPróximo ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!