Dkvn Análise

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (63)

Idioma

en	56
de	4
sv	2
it	2

País

us	58
au	2

Actores

Dkvn	3
Zbot	1
Emotet	1

Interesse

Tipo

Not Defined	14
Content Management System	4
Forum Software	2
E-Commerce Management Software	2
Office Suite Software	2

Fabricante

Not Defined	12
Jadu Limited	2
DZCP	2
Thomas R. Pasawicz	2
Ecommerce Online	2

Produto

Jadu Limited Jadu CMS	2
DZCP deV!L`z Clanportal	2
Thomas R. Pasawicz HyperBook Guestbook	2
jforum	2
Ecommerce Online Store Kit	2

Vulnerabilidades

#	Vulnerabilidade	Base	Temp	0day	Hoje	Exp	Mas	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash Divulgação de Informação	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php direitos alargados	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.74	CVE-2010-0966
3	magmi ajax_gettime.php Roteiro Cruzado de Sítios	5.2	5.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00195	0.00	CVE-2017-7391
4	Audacity DLL Loader avformat-55.dll direitos alargados	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00110	0.00	CVE-2017-1000010
5	Ashley Brown iWeb Server Encoded URL Directório Traversal	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01582	0.00	CVE-2003-0475
6	Cisco IOS Point-to-Point Tunneling Protocol Server Memory Divulgação de Informação	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00264	0.02	CVE-2016-6398
7	Magento GraphQL API Falsificação de Pedido Cross Site	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00070	0.06	CVE-2021-21027
8	Cloudera HUE LdapBackend Fraca autenticação	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00081	0.00	CVE-2019-7319
9	Microsoft Windows CredSSP Fraca autenticação	6.2	5.6	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.70801	0.02	CVE-2018-0886
10	Splunk Enterprise splunk-launch.conf direitos alargados	7.4	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00042	0.00	CVE-2017-18348
11	Spidersales viewCart.asp Injecção SQL	9.8	9.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00219	0.04	CVE-2004-0348
12	jforum User direitos alargados	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00289	0.05	CVE-2019-7550
13	Active Web Softwares Active Business Directory default.asp Injecção SQL	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00064	0.00	CVE-2008-5972
14	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	2.19
15	Maran PHP Shop prod.php Injecção SQL	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00137	0.03	CVE-2008-4879
16	X-CMS PHP member_news.php Injecção SQL	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00153	0.00	CVE-2018-18887
17	Ecommerce Online Store Kit shop.php Injecção SQL	9.8	9.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03763	0.04	CVE-2004-0300
18	StashCat Backend Database Stored Remote Code Execution	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00060	0.00	CVE-2017-11136
19	PHPWind goto.php Redirect	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00348	0.22	CVE-2015-4134
20	BXCP index.php Injecção SQL	7.3	7.0	$0-$5k	$0-$5k	High	Official Fix	0.00307	0.00	CVE-2006-0821

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	Endereço IP	Hostname	Actor	Identified	Tipo	Aceitação
1	45.40.183.1	ip-45-40-183-1.ip.secureserver.net	Dkvn	12/04/2022	verified	Alto
2	XX.XXX.XXX.X	xxxxx.xxxxxxx.xxx	Xxxx	12/04/2022	verified	Alto
3	XXX.XX.XXX.XXX	xx.xxxxxxx.xxx.xx	Xxxx	12/04/2022	verified	Alto
4	XXX.XXX.XXX.XXX	xx-xxx-xxx-xxx-xxx.xx.xxxxxxxxxxxx.xxx	Xxxx	12/04/2022	verified	Alto
5	XXX.XXX.XXX.XXX	xxxxxx.xxx	Xxxx	12/04/2022	verified	Alto

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classificação	Vulnerabilidades	Tipo de acesso	Tipo	Aceitação
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Alto
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Alto
3	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
5	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
7	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
8	TXXXX.XXX	CAPEC-0	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Alto

IOA - Indicator of Attack (31)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Tipo	Aceitação
1	File	$SPLUNK_HOME/etc/splunk-launch.conf	predictive	Alto
2	File	/etc/master.passwd	predictive	Alto
3	File	/etc/passwd	predictive	Médio
4	File	/forum/away.php	predictive	Alto
5	File	xxxxxx_xx.x	predictive	Médio
6	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Alto
7	File	xxxxxxx.xxx	predictive	Médio
8	File	xxxxxxxx.xxx	predictive	Médio
9	File	xxxx.xxx	predictive	Médio
10	File	xxx/xxxxxx.xxx	predictive	Alto
11	File	xxxxx.xxx	predictive	Médio
12	File	xxxxx-xxx-xxxxxx/xxxxx/xxx/xxxx_xxxxxxx.xxx	predictive	Alto
13	File	xxxxxx/xxxxxx_xxxx.xxx	predictive	Alto
14	File	xxxx.xxx	predictive	Médio
15	File	xxxxxxxx.xxx	predictive	Médio
16	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	Alto
17	File	xxxx.xxx	predictive	Médio
18	File	xxxxxxxx.xxx	predictive	Médio
19	File	xxxxxxxx.xxx	predictive	Médio
20	Library	xxxxxxxx-xx.xxx	predictive	Alto
21	Argument	xxxxxx	predictive	Baixo
22	Argument	xxxxxxxx	predictive	Médio
23	Argument	xxx	predictive	Baixo
24	Argument	xxxxx	predictive	Baixo
25	Argument	xx	predictive	Baixo
26	Argument	xxxxxx	predictive	Baixo
27	Argument	xxx	predictive	Baixo
28	Argument	xxxx	predictive	Baixo
29	Argument	xxx	predictive	Baixo
30	Argument	xxxxxx	predictive	Baixo
31	Input Value	%xx%xx%xx	predictive	Médio

Referências (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ VoltarVisão GeralPróximo ▸

Do you know our Splunk app?

Download it now for free!