Wiper Análise

IOB - Indicator of Behavior (773)

Curso de tempo

Idioma

en430
de198
fr104
it30
es8

País

us520
fr240
it6
cn2
ir2

Actores

Actividades

Interesse

Curso de tempo

Tipo

Fabricante

Produto

WordPress18
Microsoft Windows18
Mozilla Firefox6
Google Chrome6
PHP6

Vulnerabilidades

#VulnerabilidadeBaseTemp0dayHojeExpMasEPSSCTICVE
1Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash Divulgação de Informação5.35.2$5k-$25kCalculadoHighWorkaround0.020160.02CVE-2007-1192
2DZCP deV!L`z Clanportal config.php direitos alargados7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.009431.12CVE-2010-0966
3Woltlab Burning Board register.php Roteiro Cruzado de Sítios4.34.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.009570.00CVE-2007-1443
4Magic Photo Storage Website register.php direitos alargados5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.000000.02
5YaBB register.pl Excesso de tampão10.08.7$0-$5k$0-$5kUnprovenOfficial Fix0.173480.05CVE-2007-3208
6WordPress wp-register.php Roteiro Cruzado de Sítios4.34.2$5k-$25k$0-$5kHighUnavailable0.003220.00CVE-2007-5105
7Phpwebgallery register.php Roteiro Cruzado de Sítios4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.005730.03CVE-2007-1109
8Expinion.net News Manager Lite comment_add.asp Roteiro Cruzado de Sítios4.33.8$0-$5k$0-$5kUnprovenOfficial Fix0.006070.02CVE-2004-1845
9Phorum register.php Roteiro Cruzado de Sítios6.36.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.016010.02CVE-2007-0769
10SSReader Ultra Star Reader ActiveX Control pdg2.dll Register Excesso de tampão10.09.4$0-$5k$0-$5kProof-of-ConceptNot Defined0.070570.05CVE-2007-5892
11SSReader Ultra Star Reader ActiveX Control register Excesso de tampão7.37.3$0-$5k$0-$5kNot DefinedNot Defined0.036170.00CVE-2007-5807
12StoreSprite register.php Roteiro Cruzado de Sítios4.34.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.018500.02CVE-2007-4307
13AlstraSoft AskMe Pro register.php Roteiro Cruzado de Sítios3.53.5$0-$5k$0-$5kNot DefinedNot Defined0.000000.00
14Microsoft Register Server Negação de Serviço5.35.3$5k-$25k$0-$5kNot DefinedNot Defined0.003500.00CVE-2007-3658
15Scribe forum.php register direitos alargados7.36.6$0-$5k$0-$5kProof-of-ConceptUnavailable0.024340.00CVE-2007-5822
16WordPress wp-register.php Roteiro Cruzado de Sítios4.34.2$5k-$25k$0-$5kHighUnavailable0.005330.04CVE-2007-5106
17Andys Chat register.php Excesso de tampão10.010.0$0-$5k$0-$5kNot DefinedUnavailable0.031060.00CVE-2006-7036
18PBSite register.php Local Privilege Escalation5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.000000.05
19LushiWarPlaner register.php Injecção SQL7.37.3$0-$5k$0-$5kHighUnavailable0.008210.05CVE-2007-0864
20TeamCal register.php Directório Traversal3.33.3$0-$5k$0-$5kNot DefinedNot Defined0.000000.00

IOC - Indicator of Compromise (31)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDEndereço IPHostnameActorCampanhasIdentifiedTipoAceitação
12.230.110.1372-230-110-137.ip201.fastwebnet.itWiper20/05/2022verifiedAlto
224.199.247.222webmail.capefearclinic.orgWiper20/05/2022verifiedAlto
337.71.147.186186.147.71.37.rev.sfr.netWiper20/05/2022verifiedAlto
437.99.163.162mail.futuregrp.orgWiper20/05/2022verifiedAlto
550.255.126.6550-255-126-65-static.hfc.comcastbusiness.netWiper20/05/2022verifiedAlto
658.185.154.99Wiper01/01/2021verifiedAlto
770.62.153.174rrcs-70-62-153-174.central.biz.rr.comWiper20/05/2022verifiedAlto
8XX.XXX.XX.XXXxx-xxx-xx-xxx.xxxxxx.xxxx.xxXxxxx20/05/2022verifiedAlto
9XX.XX.XXX.XXXxxxxxxxx-xxx-x-xxx-xxx.xxx-xx.xxx.xxxxxxx.xxXxxxx20/05/2022verifiedAlto
10XX.XXX.XX.XXXxxxxxxxxx.xxxx.x-xxxxxxxxx.xxXxxxx20/05/2022verifiedAlto
11XX.XXX.XX.XXXXxxxx20/05/2022verifiedAlto
12XX.X.XXX.XXXxxxx.xxxxxx.xxx.xxXxxxx20/05/2022verifiedAlto
13XX.XXX.XX.XXXxxxxxxxx.xxxxxxx.xxxXxxxx20/05/2022verifiedAlto
14XX.XX.XXX.XXxx-xx-xxx-xx.xxxx.xxxxxxxx.xxXxxxx01/01/2021verifiedAlto
15XX.XX.XXX.XXXxxxxxxxxxxxxxx-xxx-x-xxx-xxx.xxx-xx.xxx.xxxxxxx.xxXxxxx20/05/2022verifiedAlto
16XX.XX.XXX.XXxx-xx-xxx-xx.xxxxx.xxxxxxxxxx.xxXxxxx20/05/2022verifiedAlto
17XX.XX.XX.XXXxx-xx-xx-xxx-xxxxxx.xxx.xxxxxxxxxxxxxxx.xxxXxxxx20/05/2022verifiedAlto
18XXX.XX.XXX.XXXxxx-xx-xxx-xxx.xxxxxx-xx.xxxxxxxxxxx.xxxXxxxx20/05/2022verifiedAlto
19XXX.XXX.XXX.XXXXxxxx20/05/2022verifiedAlto
20XXX.XXX.XX.XXXxx-xxx-xxx-xxx-xxx.xxxx.xxxxx.xxxxxxxx-xx.xxXxxxx20/05/2022verifiedAlto
21XXX.X.XXX.XXXxxx-x-xxx-xxx.xxxxx.xxxxxxxxxx.xxXxxxx20/05/2022verifiedAlto
22XXX.XX.XXX.XXXxxxx20/05/2022verifiedAlto
23XXX.XXX.XXX.XXXXxxxx20/05/2022verifiedAlto
24XXX.XXX.XX.XXXxxxxx-x.xxx-xxxxxxx.xxxXxxxx20/05/2022verifiedAlto
25XXX.XX.XXX.XXXXxxxx01/01/2021verifiedAlto
26XXX.XX.XX.XXxxxxx.xxx.xxxXxxxx20/05/2022verifiedAlto
27XXX.XXX.XXX.XXXXxxxx20/05/2022verifiedAlto
28XXX.XXX.XXX.XXxxxx-xxx-xxx-xxx-xx.xxxxxx.xxxxxxx.xxxXxxxx20/05/2022verifiedAlto
29XXX.XXX.XXX.XXXxxxxxxx.xxxxxxx.xxXxxxx20/05/2022verifiedAlto
30XXX.XX.XX.XXxxxx-xxx-xx-xx-xx.xxxxxxxx.xxxxxxxxxxxxx.xxXxxxx20/05/2022verifiedAlto
31XXX.XX.XX.XXXXxxxx01/01/2021verifiedAlto

TTP - Tactics, Techniques, Procedures (23)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueClassificaçãoVulnerabilidadesTipo de acessoTipoAceitação
1CAPEC-10CWE-20, CWE-59, CWE-61, CWE-74, CWE-93, CWE-119, CWE-120, CWE-121, CWE-122, CWE-125, CWE-134, CWE-189, CWE-190, CWE-191, CWE-266, CWE-285, CWE-286, CWE-287, CWE-302, CWE-305, CWE-345, CWE-346, CWE-347, CWE-352, CWE-362, CWE-367, CWE-369, CWE-377, CWE-399, CWE-400, CWE-401, CWE-404, CWE-415, CWE-416, CWE-444, CWE-476, CWE-502, CWE-693, CWE-707, CWE-770, CWE-787, CWE-833, CWE-835, CWE-843, CWE-862, CWE-863, CWE-918, CWE-942, CWE-1236Unknown VulnerabilitypredictiveAlto
2T1006CAPEC-126CWE-22, CWE-425Path TraversalpredictiveAlto
3T1055CAPEC-10CWE-74, CWE-707Improper Neutralization of Data within XPath ExpressionspredictiveAlto
4T1059CAPEC-10CWE-74, CWE-94, CWE-707Argument InjectionpredictiveAlto
5T1059.007CAPEC-10CWE-74, CWE-79, CWE-80, CWE-707Cross Site ScriptingpredictiveAlto
6TXXXXCAPEC-122CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveAlto
7TXXXX.XXXCAPEC-0CWE-XXX, CWE-XXXXxx Xx Xxxx-xxxxx XxxxxxxxpredictiveAlto
8TXXXX.XXXCAPEC-191CWE-XXX, CWE-XXX, CWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveAlto
9TXXXXCAPEC-10CWE-XX, CWE-XX, CWE-XX, CWE-XXXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveAlto
10TXXXX.XXXCAPEC-178CWE-XXXXxxx XxxxxxxxpredictiveAlto
11TXXXXCAPEC-10CWE-XX, CWE-XX, CWE-XXXXxx XxxxxxxxxpredictiveAlto
12TXXXX.XXXCAPEC-1CWE-XXX, CWE-XXXXxxxxxxx XxxxxxxxxxxxxpredictiveAlto
13TXXXXCAPEC-50CWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveAlto
14TXXXXCAPEC-37CWE-XXX, CWE-XXXXxxxxxxxx Xxxxxxx Xx Xxxxxxxxx XxxxxxxxxxxpredictiveAlto
15TXXXX.XXXCAPEC-154CWE-XXXXxxxxxxxxxxxpredictiveAlto
16TXXXXCAPEC-38CWE-XXXXxxxxxxxx Xxxxxx XxxxpredictiveAlto
17TXXXX.XXXCAPEC-38CWE-XXX, CWE-XXXXxxxxxxx Xxxxxx XxxxpredictiveAlto
18TXXXX.XXXCAPEC-114CWE-XXX, CWE-XXXXxxxxxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveAlto
19TXXXX.XXXCAPEC-133CWE-XXXXxxxxxxxpredictiveAlto
20TXXXXCAPEC-116CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveAlto
21TXXXX.XXXCAPEC-0CWE-XXXxxxxxxxxxxxxpredictiveAlto
22TXXXXCAPEC-157CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveAlto
23TXXXX.XXXCAPEC-19CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveAlto

IOA - Indicator of Attack (184)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorTipoAceitação
1File/cgi-bin/nobodypredictiveAlto
2File/doorgets/app/views/ajax/commentView.phppredictiveAlto
3File/etc/passwdpredictiveMédio
4File/GponForm/device_Form?script/predictiveAlto
5File/index.phppredictiveMédio
6File/index.php?controller=GzUser&action=edit&id=1predictiveAlto
7File/rom-0predictiveBaixo
8File/timeline2.phppredictiveAlto
9File/tmppredictiveBaixo
10File/uncpath/predictiveMédio
11File/user-utils/users/md5.jsonpredictiveAlto
12File/wp-admin/admin-ajax.phppredictiveAlto
13FileAbstractController.phppredictiveAlto
14FileActBar.ocxpredictiveMédio
15Fileadclick.phppredictiveMédio
16Fileadd_comment.phppredictiveAlto
17Fileadd_ons.phppredictiveMédio
18Fileadmin.comms.phppredictiveAlto
19Fileadmin.phppredictiveMédio
20Fileadmin/bad.phppredictiveAlto
21Fileadmin/users/newpredictiveAlto
22Fileadmincp.php?app=user&do=savepredictiveAlto
23Fileajax.php?type=../admin-panel/autoload&page=manage-userspredictiveAlto
24Fileapc.phppredictiveBaixo
25Filexxxxxxx.xxxpredictiveMédio
26Filexxxx_xxxxxxxxxxx.xxxpredictiveAlto
27Filexxx-xxx/predictiveMédio
28Filexxx/xxx.xpredictiveMédio
29Filexxxxxxx_xxx.xxxpredictiveAlto
30Filexxxxxxx.xpredictiveMédio
31Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveAlto
32Filexxxxxx_xxxxx.xpredictiveAlto
33Filexxxx/xxxxxxxx.xxxx.xxxxxxx.xxxpredictiveAlto
34Filexxxx_x.xpredictiveMédio
35Filexxxxxxx/xxxxx/xxxxxx.xpredictiveAlto
36Filexxxxxxx/xxx/xxxxx/xxx-xxxxx.xpredictiveAlto
37Filexxxxxxx/xxx/xxxxxxxx/xxxxxxxxx/xxxxxxx.xpredictiveAlto
38Filexxxxxxx.xpredictiveMédio
39Filexxxxx.xxxpredictiveMédio
40Filexxxxxxxxxxxxxx.xxpredictiveAlto
41Filexxxx.xxxpredictiveMédio
42Filexxx/xxxx/xxxx.xpredictiveAlto
43Filexxxx.xxxpredictiveMédio
44Filexxxxxxx/xxxx_xxxxxxxxx.xxxpredictiveAlto
45Filexxxxx.xxxpredictiveMédio
46Filexxxxxx/xxxxxx.xxxxpredictiveAlto
47Filexxxx.xxxpredictiveMédio
48Filexxxxxxxxx.xxxpredictiveAlto
49Filexx.xxpredictiveBaixo
50Filexxx/xxxxxx.xxxpredictiveAlto
51Filexxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxxpredictiveAlto
52Filexxxxxxx/xxxxxxx/xxxxxxxx_xxxxxxxx.xxx.xxxpredictiveAlto
53Filexxxxx.xxxpredictiveMédio
54Filexxxxxxxxx/xxx/xxxxxx.xpredictiveAlto
55Filexxxxxxxxx/xxx/xxxx.xpredictiveAlto
56Filexxxx.xxxpredictiveMédio
57Filexxx.xxxpredictiveBaixo
58Filexxx/xxx_xxxxxxx_xx.xpredictiveAlto
59Filexxxxxx/xxx/xxxxxxxx.xpredictiveAlto
60Filexxxxxxxxx/xxxx-xxxxxx.xpredictiveAlto
61Filexxxxx.xxx.xxxpredictiveAlto
62Filexxxxxxx.xxxpredictiveMédio
63Filexxxxx.xxpredictiveMédio
64Filexxxxx.xxxpredictiveMédio
65Filexxxxxx.xxx?x=xxxxxxx_xxx&xxpredictiveAlto
66Filexxxxxxxx.xxxpredictiveMédio
67Filexxx/xxx_xxx.xpredictiveAlto
68Filexx.xxxpredictiveBaixo
69Filexxxx.xxxxxx.xxpredictiveAlto
70Filexxxxx/xxx/xxxx_xxxxx.xpredictiveAlto
71Filexxxx.xxxpredictiveMédio
72Filexxxxx.xxpredictiveMédio
73Filexxxxx-xxx.xpredictiveMédio
74Filexxx-xxxx.xpredictiveMédio
75Filexxxxx.xxxpredictiveMédio
76Filexxxxx.xxxpredictiveMédio
77Filexxxxxxxx.xxxpredictiveMédio
78Filexxxxxxxx.xxxxpredictiveAlto
79Filexxxxxxxx.xxxpredictiveMédio
80Filexxxxxxxx.xxxpredictiveMédio
81Filexxxxxxxx.xxpredictiveMédio
82Filexxxxxxxx_xxxxxx.xxxpredictiveAlto
83FilexxxxxxxxxpredictiveMédio
84Filexxxxxxx_xxx_xxxxx_xxxxxx.xxxxpredictiveAlto
85Filexxxxxxxxxx/xxxxxxxxxx_xxxxxxxxxx.xxxpredictiveAlto
86Filexxxxxxxxxxxxxxxxxx.xxxxpredictiveAlto
87Filex.xxxpredictiveBaixo
88Filexxxxxx.xxxpredictiveMédio
89Filexxxxxx/xxxxxxxx.xxxpredictiveAlto
90Filexxxxxxx/xxxxx/xxxx-xxx/xxxxxx.xpredictiveAlto
91Filexxxxxxxx/xxxxxxxxxxx/xxxxx/predictiveAlto
92Filexxxxxx.xxxpredictiveMédio
93Filexxxxx.xpredictiveBaixo
94Filexxxx.xpredictiveBaixo
95Filexxxxxxx/xxxxxxxx.xxxpredictiveAlto
96Filexxxx.xxxpredictiveMédio
97Filexxxxxxxxxxx.xpredictiveAlto
98Filexxxxxxxxxxxxxxxx.xxxxpredictiveAlto
99Filexxxxx.xxpredictiveMédio
100Filexxxxxxxx.xpredictiveMédio
101Filexxxx-xxxxxxxx.xxxpredictiveAlto
102Filexxxxxxx.xxxpredictiveMédio
103Filexxxx/xxxxxxxx.xxxpredictiveAlto
104Filexxxxx/xxxxxxxx.xxxpredictiveAlto
105Filexxxx/xxxxxxxx.xxxpredictiveAlto
106Filexx-xxxxx/xxxxx-xxxx.xxx?xx-xxxxx-xxxxxx[]=xxxxxxxxpredictiveAlto
107Filexx-xxxxx.xxxpredictiveMédio
108Filexx-xxxxxxxx.xxxpredictiveAlto
109Filexxxxxx.xxxpredictiveMédio
110Libraryxxxxxxxx.xxxpredictiveMédio
111Libraryxxx/xxx/xxxxxx.xxpredictiveAlto
112Libraryxxx/xxx/xxxxx.xxxpredictiveAlto
113Libraryxxxxxxxx.xxxpredictiveMédio
114Libraryxxxxxxxx.xxxpredictiveMédio
115Libraryxxxx.xxxpredictiveMédio
116Libraryxxx/xxx/xxxx/xxx/xxxx.xxxpredictiveAlto
117ArgumentxxxxxxxpredictiveBaixo
118ArgumentxxxxxxpredictiveBaixo
119Argumentxxx_xxxpredictiveBaixo
120Argumentxxxx_xxxxpredictiveMédio
121ArgumentxxxxxxxxpredictiveMédio
122Argumentxxxx_xxpredictiveBaixo
123ArgumentxxxxxxxxxxxxxpredictiveAlto
124ArgumentxxxxxxxpredictiveBaixo
125ArgumentxxxxpredictiveBaixo
126ArgumentxxxxxxxpredictiveBaixo
127Argumentxxxxxxxxxxx/xxxx/xxxxxxxpredictiveAlto
128ArgumentxxxxpredictiveBaixo
129ArgumentxxxxxpredictiveBaixo
130ArgumentxxxxxpredictiveBaixo
131Argumentxxxxxxx=xxxxxxxxpredictiveAlto
132ArgumentxxxxpredictiveBaixo
133Argumentxxxx_xxxxxpredictiveMédio
134ArgumentxxxxxxxxpredictiveMédio
135ArgumentxxpredictiveBaixo
136Argumentxx_xxxxxxxxpredictiveMédio
137ArgumentxxxpredictiveBaixo
138Argumentxxxxxxx_xxxxpredictiveMédio
139Argumentxxxxxxxxx-xxxxxxx/xxxxxxxxx/xxxxxxxxxxpredictiveAlto
140ArgumentxxxxpredictiveBaixo
141ArgumentxxxxxxxxxxxxxpredictiveAlto
142Argumentxxxxxx?xxxxxxpredictiveAlto
143ArgumentxxxxxxxpredictiveBaixo
144ArgumentxxxxpredictiveBaixo
145Argumentxxxxxxxxx_xxxxxxxx_xxxxpredictiveAlto
146ArgumentxxxxpredictiveBaixo
147ArgumentxxxxpredictiveBaixo
148ArgumentxxxxpredictiveBaixo
149ArgumentxxxxxxxxpredictiveMédio
150Argumentxxxx_xxxxpredictiveMédio
151ArgumentxxxxxxxxxxxxpredictiveMédio
152ArgumentxxxxxxxxxpredictiveMédio
153Argumentxxxxxxxx/xxxx/xxxxxpredictiveAlto
154ArgumentxxxxxxxpredictiveBaixo
155Argumentxxx_xxxxpredictiveMédio
156ArgumentxxxxxxxxpredictiveMédio
157Argumentxxxx/xxxxpredictiveMédio
158ArgumentxxxxxxpredictiveBaixo
159ArgumentxxxxxxxxxxxxpredictiveMédio
160ArgumentxxxxxxpredictiveBaixo
161ArgumentxxxpredictiveBaixo
162ArgumentxxxxxxxxxxpredictiveMédio
163ArgumentxxxxpredictiveBaixo
164ArgumentxxxxxxxxpredictiveMédio
165ArgumentxxxxxpredictiveBaixo
166Argumentxxx/xxxxx_xxxxxxx.$predictiveAlto
167ArgumentxxxxpredictiveBaixo
168ArgumentxxxpredictiveBaixo
169ArgumentxxxxxpredictiveBaixo
170ArgumentxxxpredictiveBaixo
171ArgumentxxxxxxxxpredictiveMédio
172Argumentxxxx_xxxxxpredictiveMédio
173Argumentxxxx_xxxxxpredictiveMédio
174ArgumentxxxpredictiveBaixo
175Argument_xxxxxx[xxxx_xxxx]predictiveAlto
176Input ValuexxxxpredictiveBaixo
177Input Valuexxxxxxxxx' xxx 'x'='xpredictiveAlto
178Input ValuexxxxpredictiveBaixo
179Pattern|xx|xx|xx|predictiveMédio
180Pattern|xx|xxx|xx xx xx xx|predictiveAlto
181Network Portxxxx xxxxpredictiveMédio
182Network Portxxx/xxxx (xxx)predictiveAlto
183Network Portxxx/xxxxxpredictiveMédio
184Network Portxxx xxxxxx xxxxpredictiveAlto

Referências (4)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!