RATicate Análise

IOB - Indicator of Behavior (52)

Curso de tempo

Idioma

en34
de10
fr4
es4

País

us44
gb4
fr2

Actores

Actividades

Interesse

Curso de tempo

Tipo

Fabricante

Produto

Microsoft IIS4
Gallarific PHP Photo Gallery script2
thttpd2
nginx2
Popup Maker Plugin2

Vulnerabilidades

#VulnerabilidadeBaseTemp0dayHojeExpMasEPSSCTICVE
1All Enthusiast Inc Reviewpost Php Pro showproduct.php Injecção SQL7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.005010.00CVE-2004-2175
2PhotoPost PHP Pro showproduct.php Injecção SQL9.89.4$0-$5k$0-$5kNot DefinedOfficial Fix0.002760.04CVE-2004-0250
3OpenSSH Authentication Username Divulgação de Informação5.34.8$5k-$25k$0-$5kHighOfficial Fix0.107370.23CVE-2016-6210
4BitTorrent uTorrent Bencoding Parser direitos alargados6.46.4$0-$5k$0-$5kNot DefinedNot Defined0.008670.02CVE-2020-8437
5MDaemon Webmail Roteiro Cruzado de Sítios5.45.3$0-$5k$0-$5kNot DefinedOfficial Fix0.000700.02CVE-2019-8983
6Synology DiskStation Manager Change Password direitos alargados7.17.0$0-$5k$0-$5kNot DefinedOfficial Fix0.000680.03CVE-2018-8916
7Microsoft IIS Roteiro Cruzado de Sítios5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.005480.07CVE-2017-0055
8Todd Miller sudo sudoedit sudoers direitos alargados7.87.0$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.000610.00CVE-2015-5602
9Tim Kosse FileZilla Format String7.37.0$25k-$100k$0-$5kNot DefinedOfficial Fix0.033390.04CVE-2007-2318
10BusyBox Terminal lineedit.c add_match direitos alargados7.57.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.005220.07CVE-2017-16544
11Microsoft Office Equation Editor Excesso de tampão7.57.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.916200.02CVE-2018-0798
12Citrix ADC/Gateway/NetScaler Gateway/SD-WAN WANOP SSL VPN Web Portal Roteiro Cruzado de Sítios3.53.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000780.00CVE-2020-8245
13Gallarific PHP Photo Gallery script gallery.php Injecção SQL7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.001120.04CVE-2011-0519
14Gempar Script Toko Online shop_display_products.php Injecção SQL7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.001000.02CVE-2009-0296
15K5n WebCalendar send_reminders.php direitos alargados7.36.4$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.056030.02CVE-2008-2836
16Microsoft IIS direitos alargados9.99.9$25k-$100k$5k-$25kNot DefinedNot Defined0.088750.02CVE-2010-1256
17Python urllib.request.AbstractBasicAuthHandler direitos alargados6.46.4$0-$5k$0-$5kNot DefinedOfficial Fix0.008370.07CVE-2020-8492
18nginx URI String direitos alargados6.56.2$0-$5k$0-$5kNot DefinedOfficial Fix0.954330.00CVE-2013-4547
19Microsoft Windows Remote Desktop direitos alargados7.57.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.046620.00CVE-2019-1333
20Mozilla Firefox/Firefox ESR IFRAME PDF.js direitos alargados8.68.2$25k-$100k$0-$5kNot DefinedOfficial Fix0.011460.00CVE-2013-5598

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDEndereço IPHostnameActorCampanhasIdentifiedTipoAceitação
179.134.225.11RATicate31/05/2021verifiedAlto
2XX.XXX.XXX.XXXxxxxxxx31/05/2021verifiedAlto

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilidadesTipo de acessoTipoAceitação
1T1059CWE-94Argument InjectionpredictiveAlto
2T1059.007CWE-79, CWE-80Cross Site ScriptingpredictiveAlto
3TXXXXCWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveAlto
4TXXXXCWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveAlto
5TXXXXCWE-XXXxx XxxxxxxxxpredictiveAlto
6TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveAlto
7TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveAlto
8TXXXXCWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveAlto

IOA - Indicator of Attack (21)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorTipoAceitação
1File/etc/sudoerspredictiveMédio
2File/uncpath/predictiveMédio
3Filecat.phppredictiveBaixo
4Filexxxxxx.xxxpredictiveMédio
5Filexxxxxxxxxxx/xxxxx.xxxpredictiveAlto
6Filexxxxxxx.xxxpredictiveMédio
7Filexxxxx/xxxxxxxx.xpredictiveAlto
8Filexxx.xxpredictiveBaixo
9Filexxxxxxx_xxx_xxxxx_xxxxxx.xxxxpredictiveAlto
10Filexxxx_xxxxxxxxx.xxxpredictiveAlto
11Filexxxx_xxxxxxx_xxxxxxxx.xxxpredictiveAlto
12Filexxxxxxxxxxx.xxxpredictiveAlto
13Filexxxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxxpredictiveAlto
14ArgumentxxxpredictiveBaixo
15ArgumentxxxxxpredictiveBaixo
16Argumentxxx_xxpredictiveBaixo
17ArgumentxxxxxxxxpredictiveMédio
18ArgumentxxpredictiveBaixo
19Argumentxxxx_xxpredictiveBaixo
20ArgumentxxxxxpredictiveBaixo
21ArgumentxxxxxxxxpredictiveMédio

Referências (2)

The following list contains external sources which discuss the actor and the associated activities:

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!