ObliqueRAT Análise

IOB - Indicator of Behavior (546)

Curso de tempo

Idioma

en518
es14
it6
fr4
ru2

País

us506
ru30
cn10

Actores

Actividades

Interesse

Curso de tempo

Tipo

Fabricante

Produto

Drupal8
https-proxy-agent4
WordPress4
Squid Proxy4
ProFTPD2

Vulnerabilidades

#VulnerabilidadeBaseTemp0dayHojeExpMasEPSSCTICVE
1Apache HTTP Server mod_proxy_balancer.c balancer_handler Roteiro Cruzado de Sítios4.34.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.217820.00CVE-2012-4558
2Google Android Proxy Auto-Config ic.cc UpdateLoadElement Excesso de tampão8.58.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.001020.00CVE-2019-2047
3Telegram Desktop Proxy direitos alargados8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.002190.00CVE-2018-17613
4https-proxy-agent JSON Excesso de tampão7.26.9$0-$5k$0-$5kNot DefinedOfficial Fix0.006590.03CVE-2018-3739
5Apache HTTP Server mod_proxy_fcgi.c handle_headers Excesso de tampão5.35.1$25k-$100k$0-$5kNot DefinedOfficial Fix0.009530.04CVE-2014-3583
6Apple iOS Proxy Authentication direitos alargados6.66.4$100k e mais$5k-$25kNot DefinedOfficial Fix0.001820.04CVE-2016-4642
7YoungZSoft CCProxy Proxy Service Excesso de tampão7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.114870.00CVE-2004-2685
8CNCF Envoy Proxy Negação de Serviço6.46.4$0-$5k$0-$5kNot DefinedNot Defined0.003410.00CVE-2020-8659
9Blue Coat ProxySG SGOS Divulgação de Informação5.35.1$0-$5k$0-$5kNot DefinedOfficial Fix0.001390.02CVE-2015-4334
10Juniper WLC Proxy ARP/No Broadcast Feature direitos alargados5.35.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.007120.00CVE-2014-6381
11Symantec ASG/ProxySG FTP Proxy WebFTP Mode Stored Roteiro Cruzado de Sítios5.75.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.001150.00CVE-2018-18370
12Palo Alto PAN-OS DNS Proxy direitos alargados8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.067160.03CVE-2017-8390
13QNAP Proxy Server Setting Fraca autenticação6.36.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000700.02CVE-2017-7639
14Squid Web Proxy cachemgr.cgi direitos alargados6.15.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.002670.00CVE-2019-18860
15Bluecoat SGOS Management Console Roteiro Cruzado de Sítios4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.002650.02CVE-2010-5192
16Artica Proxy fw.progrss.details.php Directório Traversal7.47.1$0-$5k$0-$5kNot DefinedOfficial Fix0.967910.00CVE-2020-13158
17Artica Proxy settings.inc direitos alargados4.94.9$0-$5k$0-$5kNot DefinedNot Defined0.001300.02CVE-2019-7300
18Sarg Squid Analysis Report Generator Proxy Server useragent.c useragent Excesso de tampão10.09.0$0-$5kCalculadoProof-of-ConceptOfficial Fix0.445600.00CVE-2008-1167
19Google Android Proxy Configuration hydrogen-alias-analysis.h HAliasAnalyzer.Query direitos alargados8.58.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.001020.04CVE-2019-2097
20Check point Firewall-1/VPN-1 IKE Aggressive Mode Encriptação fraca5.35.1$0-$5k$0-$5kNot DefinedOfficial Fix0.004090.03CVE-2002-1623

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDEndereço IPHostnameActorCampanhasIdentifiedTipoAceitação
1185.117.73.222ObliqueRAT31/03/2022verifiedAlto
2XXX.XXX.XX.XXXXxxxxxxxxx10/08/2022verifiedAlto

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilidadesTipo de acessoTipoAceitação
1T1006CWE-22Path TraversalpredictiveAlto
2T1055CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveAlto
3T1059CWE-94Argument InjectionpredictiveAlto
4TXXXX.XXXCWE-XXXxxxx Xxxx XxxxxxxxxpredictiveAlto
5TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveAlto
6TXXXXCWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveAlto
7TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveAlto
8TXXXXCWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveAlto
9TXXXXCWE-XXXxx XxxxxxxxxpredictiveAlto
10TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveAlto
11TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveAlto
12TXXXXCWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveAlto
13TXXXX.XXXCWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveAlto

IOA - Indicator of Attack (33)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorTipoAceitação
1File/assets/php/upload.phppredictiveAlto
2Fileadmin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/listpredictiveAlto
3Filecachemgr.cgipredictiveMédio
4Filecgi-bin/cmh/webcam.shpredictiveAlto
5Filexxxxxx.xpredictiveMédio
6Filexx.xxxxxxx.xxxxxxx.xxxpredictiveAlto
7Filexxxxxxxx-xxxxx-xxxxxxxx.xpredictiveAlto
8Filexx.xxpredictiveBaixo
9Filexxxxxx.xxxpredictiveMédio
10Filexxxxx.xxxpredictiveMédio
11Filexxxxxx.xpredictiveMédio
12Filexxxxx.xxxpredictiveMédio
13Filexxx_xxxxx_xxxxxxxx.xpredictiveAlto
14Filexxx_xxxxx_xxxx.xpredictiveAlto
15Filexxxxxxxx_xxxxxx.xxxpredictiveAlto
16Filexxxxxxxxxx/xxxxxxxx.xxxpredictiveAlto
17Filexxxxxxxxx.xpredictiveMédio
18Filexxxxx/xxxxx.xxpredictiveAlto
19Filexxxxxxxxxxxxx.xxxxpredictiveAlto
20Libraryxxxxxxxxx/xxxxxx_xxxxxxxxxxx.xxx.xxxpredictiveAlto
21ArgumentxxxxpredictiveBaixo
22ArgumentxxxxxxxxxxxxxpredictiveAlto
23ArgumentxxxxxxxxxxxxpredictiveMédio
24ArgumentxxxxxxxxpredictiveMédio
25Argumentxx_xxxxxxxxpredictiveMédio
26ArgumentxxxxxxxxxpredictiveMédio
27Argumentxxxx_xxxxx/xxxx_xxxxxxxxpredictiveAlto
28Argumentxxxxxxx.xxx_xxxxxxxxxxpredictiveAlto
29ArgumentxxxxxpredictiveBaixo
30ArgumentxxxpredictiveBaixo
31ArgumentxxxxxxxxpredictiveMédio
32Argumentxxxx xxxxpredictiveMédio
33Input Value%xx%xx%xxpredictiveMédio

Referências (3)

The following list contains external sources which discuss the actor and the associated activities:

Might our Artificial Intelligence support you?

Check our Alexa App!