KV-Botnet Análise

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (69)

Idioma

en	34
zh	28
es	4
de	2
fr	2

País

cn	50
us	12
ec	4
ru	2
hk	2

Actores

KV-Botnet	8
Cobalt Strike	2
Pikabot	1
Shuckworm	1

Interesse

Tipo

Not Defined	34
WordPress Plugin	4
Smartwatch Operating System	2
Operating System	2
Testing Software	2

Fabricante

Not Defined	22
Apple	4
Apache	4
Microsoft	2
SerComm	2

Produto

SaltStack Salt	4
Apple watchOS	2
cgit	2
FLDS	2
Microsoft Windows	2

Vulnerabilidades

#	Vulnerabilidade	Base	Temp	0day	Hoje	Exp	Mas	EPSS	CTI	CVE
1	xtemos WoodMart Theme Roteiro Cruzado de Sítios	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00045	0.00	CVE-2023-32239
2	PHPGurukul Nipah Virus Testing Management System manage-phlebotomist.php Falsificação de Pedido Cross Site	5.0	4.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00054	0.04	CVE-2023-6474
3	Pluto PortletV3AnnotatedDemo Divulgação de Informação	6.4	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.92403	0.00	CVE-2018-1306
4	vBulletin redirector.php Redirect	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00122	0.07	CVE-2018-6200
5	HGiga OAKlouds Mobile Portal Network Interface Card Setting Page direitos alargados	9.8	9.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00336	0.00	CVE-2021-37913
6	FLDS redir.php Injecção SQL	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00203	0.22	CVE-2008-5928
7	Vunet VU Web Visitor Analyst redir.asp Injecção SQL	7.3	7.1	$0-$5k	$0-$5k	High	Workaround	0.00119	0.35	CVE-2010-2338
8	ONLYOFFICE Document Server JWT upload Directório Traversal	8.0	7.2	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02823	0.02	CVE-2021-3199
9	No-margin-for-errors prettyPhoto setTimeout Roteiro Cruzado de Sítios	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00255	0.02	CVE-2013-6837
10	AVTECH Room Alert 3E Web Interface Fraca autenticação	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01129	0.02	CVE-2019-13379
11	Host RPC Portmapper Service direitos alargados	7.3	7.1	$0-$5k	$0-$5k	High	Workaround	0.19874	0.00	CVE-1999-0632
12	Microsoft Windows NTFS Divulgação de Informação	5.1	4.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00061	0.00	CVE-2022-26933
13	Adobe Flash Media Server 2 Excesso de tampão	10.0	9.0	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.03800	0.00	CVE-2007-6431
14	Oracle Tuxedo OpenSSL Excesso de tampão	9.8	9.7	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.28939	0.00	CVE-2016-6303
15	Classcms TXT File Upload classupload direitos alargados	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00075	0.04	CVE-2022-25581
16	ThinkPHP Adapter.php direitos alargados	7.6	7.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00389	0.04	CVE-2021-36564
17	Adobe Flash Player SharedObject Excesso de tampão	7.3	7.0	$25k-$100k	$0-$5k	High	Official Fix	0.97164	0.17	CVE-2011-0611
18	Auerswald COMfortel 1400 IP/COMfortel 2600 IP Fraca autenticação	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.19673	0.00	CVE-2021-40856
19	Microsoft Exchange Server Divulgação de Informação	5.4	4.7	$5k-$25k	$0-$5k	Unproven	Official Fix	0.96172	0.04	CVE-2021-41349
20	GNU Emacs Email enriched.el direitos alargados	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03127	0.00	CVE-2017-14482

IOC - Indicator of Compromise (9)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	Endereço IP	Hostname	Actor	Identified	Tipo	Aceitação
1	45.11.92.176		KV-Botnet	14/12/2023	verified	Alto
2	45.32.88.250	45.32.88.250.vultrusercontent.com	KV-Botnet	14/12/2023	verified	Alto
3	XX.XX.XXX.XXX	xx.xx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xx-xxxxxx	08/02/2024	verified	Alto
4	XX.XXX.XXX.XXX		Xx-xxxxxx	08/02/2024	verified	Alto
5	XXX.XX.XXX.XX	xxx.xx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xx-xxxxxx	14/12/2023	verified	Alto
6	XXX.XX.XXX.XXX	xxxxxxx.xx	Xx-xxxxxx	08/02/2024	verified	Alto
7	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xx-xxxxxx	14/12/2023	verified	Alto
8	XXX.XXX.XXX.XX		Xx-xxxxxx	08/02/2024	verified	Alto
9	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xx-xxxxxx	14/12/2023	verified	Alto

TTP - Tactics, Techniques, Procedures (12)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classificação	Vulnerabilidades	Tipo de acesso	Tipo	Aceitação
1	T1006	CAPEC-126	CWE-21, CWE-22, CWE-23	Path Traversal	predictive	Alto
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Alto
4	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
6	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
7	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
8	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Alto
9	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
10	TXXXX	CAPEC-38	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	Alto
11	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
12	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (32)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Tipo	Aceitação
1	File	/about/../	predictive	Médio
2	File	/out.php	predictive	Médio
3	File	/upload	predictive	Baixo
4	File	books.php	predictive	Médio
5	File	x:\xxxxx\	predictive	Médio
6	File	xxxx/xxxx.xxx/xxx/xxxxxxx/	predictive	Alto
7	File	xxx.xxx?xxxxxx=xxxxxxxxxxxxx&xxx=xx	predictive	Alto
8	File	xxx.xx	predictive	Baixo
9	File	xxxx/xxxxxxxxx/xxxxxxxx.xx	predictive	Alto
10	File	xxxxxx-xxxxxxxxxxxx.xxx	predictive	Alto
11	File	xxxxx.xxx	predictive	Médio
12	File	xxxxx.xxx	predictive	Médio
13	File	xxxxxxxxxx.xxx	predictive	Alto
14	File	xxx/xxx/xxxxxx.xxx	predictive	Alto
15	File	xxxxxx\xxxxxx\xxxxxxxxx-xxxxxx-xxxxxxx\xxx\xxxxxxx\xxxxxxx.xxx	predictive	Alto
16	File	\xxxxx\xxxxxxxxxxx	predictive	Alto
17	Argument	xxxxxx	predictive	Baixo
18	Argument	xxxxxxx-xxxxxxxxxxx	predictive	Alto
19	Argument	xxxxxxxxxx	predictive	Médio
20	Argument	xx	predictive	Baixo
21	Argument	xxxx xxxxxxx	predictive	Médio
22	Argument	xx	predictive	Baixo
23	Argument	xxxxxxxx	predictive	Médio
24	Argument	xxxx	predictive	Baixo
25	Argument	xxx	predictive	Baixo
26	Argument	xxxxxxx_xxxxxx[]	predictive	Alto
27	Argument	xxxxxxx_xxx	predictive	Médio
28	Argument	xxxxxx	predictive	Baixo
29	Argument	xxx	predictive	Baixo
30	Argument	xxxxx	predictive	Baixo
31	Input Value	../	predictive	Baixo
32	Network Port	xxx/xxxx	predictive	Médio

Referências (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ VoltarVisão GeralPróximo ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!