APT38 Анализ

IOB - Indicator of Behavior (37)

Временная шкала

Язык

en38

Страна

us32
kr6

Акторы

Деятельность

Интерес

Временная шкала

Тип

Поставщик

Продукт

Google Chrome10
Microsoft Windows6
Microsoft Office2
Oracle HTTP Server2
Zakkis Technology Php Excel Parser2

Уязвимости

#УязвимостиBaseTemp0dayСегодняЭ�RemCTIEPSSCVE
1Microsoft Windows DNSAPI DNSAPI.dll эскалация привилегий8.37.9$25k-$100k$5k-$25kNot DefinedOfficial Fix0.000.44912CVE-2017-11779
2Microsoft Windows DNSAPI DNSAPI.dll эскалация привилегий8.18.0$25k-$100k$5k-$25kNot DefinedOfficial Fix0.020.22403CVE-2018-8225
3Google Chrome IPC/Gamepad API/V8 Remote Code Execution7.36.4$25k-$100k$0-$5kUnprovenOfficial Fix0.000.06270CVE-2015-1233
4Google Chrome Blink doSerialize эскалация привилегий7.36.4$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.000.00000
5Google Chrome v8 json-stringifier.h SerializeJSArray повреждение памяти7.37.0$25k-$100k$5k-$25kNot DefinedOfficial Fix0.000.02092CVE-2015-6764
6nginx эскалация привилегий6.96.9$0-$5k$0-$5kNot DefinedNot Defined0.360.00241CVE-2020-12440
7Microsoft Word повреждение памяти7.06.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.01384CVE-2019-1201
8Microsoft Edge AppContainer Sandbox эскалация привилегий6.56.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.000.00703CVE-2019-0938
9WordPress Thumbnail эскалация привилегий7.57.5$5k-$25k$5k-$25kNot DefinedNot Defined0.030.00990CVE-2018-1000773
10Google Chrome Catalog Service эскалация привилегий8.07.9$25k-$100k$5k-$25kNot DefinedOfficial Fix0.020.00491CVE-2018-6055
11Sir GNUboard sql-инъекция6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.000.00112CVE-2014-2339
12Zakkis Technology Php Excel Parser эскалация привилегий7.36.4$0-$5k$0-$5kProof-of-ConceptUnavailable0.000.10026CVE-2007-2857
13Microsoft Windows DNSAPI DNSAPI.dll отказ в обслуживании5.25.1$25k-$100k$0-$5kNot DefinedOfficial Fix0.020.00425CVE-2018-8304
14Oracle HTTP Server Web Listener повреждение памяти5.35.1$5k-$25k$0-$5kHighOfficial Fix0.020.97274CVE-2010-0425
15Kingsoft WPS Office Free WpsCloudSvr эскалация привилегий6.16.1$0-$5k$0-$5kNot DefinedNot Defined0.000.00042CVE-2018-6400
16Kingsoft WPS Office kso.dll _alloc_iostr_data эскалация привилегий4.44.4$0-$5k$0-$5kNot DefinedNot Defined0.050.00152CVE-2018-6217
17Google Chrome Sandbox повреждение памяти5.34.6$25k-$100k$5k-$25kUnprovenOfficial Fix0.040.02369CVE-2015-1252
18Microsoft Office повреждение памяти7.57.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.15768CVE-2018-0795
19OpenSSH Authentication Username раскрытие информации5.34.8$5k-$25k$0-$5kHighOfficial Fix0.040.10737CVE-2016-6210
20Dell EMC Avamar Server/Integrated Data Protection Appliance Installation Manager эскалация привилегий8.58.2$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.030.79377CVE-2018-1217

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP-адресHostnameАкторКампанииIdentifiedТипУверенность
1175.45.176.APT3812.12.2020verifiedВысокий
2XXX.XX.XXX.Xxxxx12.12.2020verifiedВысокий
3XXX.XX.XXX.Xxxxx12.12.2020verifiedВысокий
4XXX.XX.XXX.Xxxxx12.12.2020verifiedВысокий
5XXX.XX.XXX.Xxxxx12.12.2020verifiedВысокий

TTP - Tactics, Techniques, Procedures (6)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueУязвимостиВектор доступаТипУверенность
1T1055CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveВысокий
2T1068CWE-264, CWE-269, CWE-284Execution with Unnecessary PrivilegespredictiveВысокий
3TXXXXCWE-XXXxx XxxxxxxxxpredictiveВысокий
4TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveВысокий
5TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveВысокий
6TXXXX.XXXCWE-XXXxxxxxxxxxxxxpredictiveВысокий

IOA - Indicator of Attack (13)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDКлассIndicatorТипУверенность
1Filejson-stringifier.hpredictiveВысокий
2Filemm/memory.cpredictiveСредний
3File\\.\pipe\WPSCloudSvr\WpsCloudSvrpredictiveВысокий
4Libraryxxxxxx.xxxpredictiveСредний
5Libraryxxx.xxxpredictiveНизкий
6Libraryxxxxxx.xxxpredictiveСредний
7Libraryxxxxxx/xxxxxxxxx/xxxxx.xxxpredictiveВысокий
8ArgumentxxxxxxxpredictiveНизкий
9Argumentxxxxx->xxxxpredictiveСредний
10Argumentxxxxxxxx.xxxxpredictiveВысокий
11Argumentxxxxxx_xxxxpredictiveСредний
12ArgumentxxxxxxxxpredictiveСредний
13Input Valuexx-xxxx://predictiveСредний

Ссылки (2)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!