Camaro Dragon Análise

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (198)

Idioma

en	98
zh	96
pl	2
es	2

País

cn	132
us	56
gb	8

Actores

Cobalt Strike	3
Mustang Panda	2
Patchwork	1
DanaBot	1
Camaro Dragon	1

Interesse

Tipo

Not Defined	94
Web Server	10
Router Operating System	8
Content Management System	8
Cloud Software	8

Fabricante

Not Defined	72
QNAP	10
Microsoft	8
Apache	6
D-Link	6

Produto

Microsoft Windows	6
Apache HTTP Server	6
Envoy	6
QNAP Photo Station	4
QNAP QTS	4

Vulnerabilidades

#	Vulnerabilidade	Base	Temp	0day	Hoje	Exp	Mas	EPSS	CTI	CVE
1	Kibana TSVB Prototype direitos alargados	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00092	0.00	CVE-2020-7013
2	jforum User direitos alargados	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00289	0.04	CVE-2019-7550
3	Kubernetes kubelet pprof Divulgação de Informação	7.3	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.55625	0.00	CVE-2019-11248
4	Hughes HX200/HX90/HX50L/HN9460/HN7000S Roteiro Cruzado de Sítios	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00113	0.00	CVE-2023-22971
5	Git Plugin Build direitos alargados	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01156	0.09	CVE-2022-36883
6	Apache HTTP Server HTTP/2 Request direitos alargados	6.4	6.4	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00606	0.04	CVE-2020-9490
7	Laravel FileCookieJar.php direitos alargados	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00049	0.04	CVE-2022-30779
8	Ghost CMS direitos alargados	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00813	0.00	CVE-2022-28397
9	TP-Link WRD4300 Web Interface Divulgação de Informação	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.16811	0.00	CVE-2020-35575
10	Next.js Directório Traversal	5.0	4.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00213	0.04	CVE-2020-5284
11	QNAP Photo Station Roteiro Cruzado de Sítios	5.2	4.9	$0-$5k	Calculado	Not Defined	Official Fix	0.00115	0.00	CVE-2018-19954
12	QNAP Video Station direitos alargados	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00136	0.00	CVE-2021-28812
13	QNAP QTS Photo Station Roteiro Cruzado de Sítios	4.8	4.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00115	0.00	CVE-2020-2491
14	Linksys WVC54GCA/WVC80N snapshot.cgi sub_AE64 Divulgação de Informação	9.8	9.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.04
15	Kibana TSVB Visualization Stored Roteiro Cruzado de Sítios	4.4	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00054	0.00	CVE-2020-7015
16	Hestia Control Panel Domain Name Privilege Escalation	5.9	5.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00139	0.00	CVE-2021-27231
17	codeprojects Farmacia index.php Injecção SQL	6.7	6.5	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00064	0.06	CVE-2023-5471
18	phpMyAdmin Error Reporting Page File direitos alargados	5.3	4.6	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00159	0.00	CVE-2014-8961
19	Apache Struts ParametersInterceptor getClass Negação de Serviço	5.3	4.6	$5k-$25k	$0-$5k	High	Official Fix	0.97093	0.00	CVE-2014-0094
20	ThinkPHP direitos alargados	7.6	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00177	0.00	CVE-2022-45982

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	Endereço IP	Hostname	Actor	Identified	Tipo	Aceitação
1	5.188.33.190	helenacarlson.lp	Camaro Dragon	02/06/2023	verified	Alto
2	XX.XXX.XXX.XX		Xxxxxx Xxxxxx	02/06/2023	verified	Alto
3	XXX.XXX.XXX.XX		Xxxxxx Xxxxxx	02/06/2023	verified	Alto
4	XXX.XXX.XX.XXX		Xxxxxx Xxxxxx	02/06/2023	verified	Alto

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classificação	Vulnerabilidades	Tipo de acesso	Tipo	Aceitação
1	T1006	CAPEC-126	CWE-22, CWE-23	Path Traversal	predictive	Alto
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Alto
4	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
6	TXXXX.XXX	CAPEC-	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	Alto
7	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
8	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
9	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
10	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
11	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Alto
12	TXXXX	CAPEC-55	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
13	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
14	TXXXX	CAPEC-157	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto
15	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (79)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Tipo	Aceitação
1	File	/app1/admin#foo	predictive	Alto
2	File	/cgi-bin/go	predictive	Médio
3	File	/config/server.xml	predictive	Alto
4	File	/coreframe/app/guestbook/myissue.php	predictive	Alto
5	File	/data/config.ftp.php	predictive	Alto
6	File	/debug/pprof	predictive	Médio
7	File	/include/helpers/upload.helper.php	predictive	Alto
8	File	/info.xml	predictive	Médio
9	File	/Items/*/RemoteImages/Download	predictive	Alto
10	File	/xxx	predictive	Baixo
11	File	/xxxxxx/xxxxxxx/	predictive	Alto
12	File	/xxxx/xxx/x/xxxx/xxxxxx	predictive	Alto
13	File	/xxx-x	predictive	Baixo
14	File	/xxxxxxx/	predictive	Médio
15	File	/xxxxxx	predictive	Baixo
16	File	/xxx-xxx/xxx.xxx	predictive	Alto
17	File	/xxxxxxxx/xxx	predictive	Alto
18	File	xx/../../xxxxxxx/xxxx/xxxxxx/xxxxxx_#.xxx	predictive	Alto
19	File	xxxxxxxxxxxx.xxx/xxxxxxxxxxx.xxx/xxxxxxxxxxx.xxx/xxxxxxxxxxx.xxx	predictive	Alto
20	File	xxxxxxxx_xxxx.xxx	predictive	Alto
21	File	xxx-xxx/xxxx_xxx.xxx	predictive	Alto
22	File	xxxxxxx.xxx	predictive	Médio
23	File	xxxx_xxxxx.xxx	predictive	Alto
24	File	xxx/xxxxxxxx/xxxx.x	predictive	Alto
25	File	xxxxxx/xxxxxxxxxxx	predictive	Alto
26	File	xx_xxxx.xxx	predictive	Médio
27	File	xxxxxxxxxx\xxxxxx\xxxxxxxxxxxxx.xxx	predictive	Alto
28	File	xx_xxxxxxx.x	predictive	Médio
29	File	xxx/xxxxxxxx.xxx	predictive	Alto
30	File	xxx/xxxxxx.xxx	predictive	Alto
31	File	xxxxx.xxx	predictive	Médio
32	File	xxxxxxxxx.xx	predictive	Médio
33	File	xxxxxxxxx/xxxxxxx/xxxxxxx/xxxxxxxxxxx.xxx	predictive	Alto
34	File	xxxxxxxxx/xxxxxxx/xxxxxx/xxxxxxxxxx.xxx	predictive	Alto
35	File	xxxxxxxxx/xxxxxxxxx/xxxxxxxx.xxx	predictive	Alto
36	File	xxxxxx.xxx	predictive	Médio
37	File	xxxxxx/xxxx_xxxxxxxxxxx.xxx	predictive	Alto
38	File	xxxxx_xxxxxx_xxx.xxx	predictive	Alto
39	File	xxxx.xxx	predictive	Médio
40	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	Alto
41	File	xxx/xxxxxxx/xxxxxx/xxxx/xxxxx/xxxxxxx/xxxxxx/xxxxx/xxx%xxxxxxxxxxxxx.xx.xxx	predictive	Alto
42	File	xxxxxxx.xxx	predictive	Médio
43	File	xxxxxx\xxxxxxxx\xx_xxxxx_xxxxxxx.xxx	predictive	Alto
44	File	xxxxxxx/	predictive	Médio
45	File	xxxxxxxxx.xxx	predictive	Alto
46	File	xx-xxxxxxxxxxx.xxx	predictive	Alto
47	File	xxxxxxxx.x	predictive	Médio
48	File	xxxx.xx	predictive	Baixo
49	Argument	$xxxxxx	predictive	Baixo
50	Argument	xxxxxx	predictive	Baixo
51	Argument	xxxxxxxxxx_xxxxx=x%xx	predictive	Alto
52	Argument	xxxx_xxxx	predictive	Médio
53	Argument	xxxxxxx	predictive	Baixo
54	Argument	xxxxxxxx	predictive	Médio
55	Argument	xx	predictive	Baixo
56	Argument	xxxxx	predictive	Baixo
57	Argument	xxxxx	predictive	Baixo
58	Argument	xxxxxx	predictive	Baixo
59	Argument	xxxxxxxx	predictive	Médio
60	Argument	xx	predictive	Baixo
61	Argument	xxxxx	predictive	Baixo
62	Argument	xxxxxx	predictive	Baixo
63	Argument	xxxxxxxxxx	predictive	Médio
64	Argument	xxxxxxxxxxxx	predictive	Médio
65	Argument	xx_xxxx_xxxx	predictive	Médio
66	Argument	xxxxx_xx	predictive	Médio
67	Argument	xxx_xxx	predictive	Baixo
68	Argument	xxxxxxxx	predictive	Médio
69	Argument	xxxx_xx	predictive	Baixo
70	Argument	xxxx	predictive	Baixo
71	Argument	xxxx	predictive	Baixo
72	Argument	xxxxxxxxx_xxx	predictive	Alto
73	Argument	xxx	predictive	Baixo
74	Argument	xxxxx	predictive	Baixo
75	Argument	xxxxxx/xxxxx	predictive	Médio
76	Argument	xxxxxxxx	predictive	Médio
77	Input Value	x%xx	predictive	Baixo
78	Network Port	xxx/xxxx (xx-xxx-xxxxxxx)	predictive	Alto
79	Network Port	xxx xxxxxx xxxx	predictive	Alto

Referências (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ VoltarVisão GeralPróximo ▸

Interested in the pricing of exploits?

See the underground prices here!