Bookworm Анализ

IOB - Indicator of Behavior (19)

Временная шкала

Язык

en16
zh4

Страна

cn10
us8
kr2

Акторы

Деятельность

Интерес

Временная шкала

Тип

Поставщик

Продукт

strapi4
Shenzhen Yunni Technology iLnkP2P2
VMware Workstation2
VMware Fusion2
Magnifica Webscripts Anima Gallery2

Уязвимости

#УязвимостиBaseTemp0dayСегодняЭ�RemEPSSCTICVE
1Microsoft Windows Kerberos слабая аутентификация8.98.1$25k-$100k$5k-$25kUnprovenOfficial Fix0.000480.03CVE-2024-20674
2Google Chrome ANGLE повреждение памяти7.57.4$25k-$100k$5k-$25kNot DefinedOfficial Fix0.001570.06CVE-2024-0223
3Oracle Agile Product Lifecycle Management for Process Installation Remote Code Execution7.37.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.000460.02CVE-2024-20956
4Oracle Audit Vault and Database Firewall неизвестная уязвимость7.57.2$5k-$25k$5k-$25kNot DefinedOfficial Fix0.000480.02CVE-2024-20909
5JForum Login эскалация привилегий6.56.5$0-$5k$0-$5kNot DefinedNot Defined0.001510.06CVE-2012-5338
6strapi Admin Console отказ в обслуживании3.83.8$0-$5k$0-$5kNot DefinedNot Defined0.000790.00CVE-2020-8123
7strapi Password Reset Auth.js эскалация привилегий9.89.6$0-$5k$0-$5kNot DefinedOfficial Fix0.892980.02CVE-2019-18818
8FiberHome HG2201T telnet.cgi эскалация привилегий8.08.0$0-$5k$0-$5kNot DefinedNot Defined0.006090.00CVE-2019-17186
9jforum User эскалация привилегий5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.002890.06CVE-2019-7550
10Shenzhen Yunni Technology iLnkP2P Authentication слабая аутентификация7.77.7$0-$5k$0-$5kNot DefinedNot Defined0.006690.04CVE-2019-11220
11FileZilla Filezilla Server File Upload отказ в обслуживании5.35.1$0-$5k$0-$5kNot DefinedOfficial Fix0.001590.00CVE-2005-0851
12PHPMyWind index.php Stored межсайтовый скриптинг5.25.2$0-$5k$0-$5kNot DefinedNot Defined0.000870.04CVE-2019-7660
13Apple macOS Kernel раскрытие информации3.33.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000990.00CVE-2017-13852
14VMware ESXi/Workstation Pro/Player/Fusion Pro/Fusion раскрытие информации5.75.1$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.000620.01CVE-2017-4905
15VMware Workstation/Fusion Drag/Drop повреждение памяти9.68.6$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.004000.00CVE-2017-4901
16Adobe Flash Player повреждение памяти8.07.7$25k-$100k$0-$5kNot DefinedOfficial Fix0.013990.00CVE-2017-3099
17Adobe Flash Player эскалация привилегий7.56.8$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.277500.00CVE-2017-3106
18Fabrice Bellard QEMU cirrus_vga.c повреждение памяти5.34.6$5k-$25k$0-$5kUnprovenOfficial Fix0.001000.00CVE-2014-8106
19Magnifica Webscripts Anima Gallery func.php обход каталога7.37.3$0-$5k$0-$5kNot DefinedNot Defined0.003830.06CVE-2015-4415

Кампании (1)

These are the campaigns that can be associated with the actor:

  • Thailand

IOC - Indicator of Compromise (11)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP-адресHostnameАкторКампанииIdentifiedТипУверенность
143.248.8.249BookwormThailand02.09.2021verifiedВысокий
2103.226.127.47BookwormThailand02.09.2021verifiedВысокий
3104.156.239.105104.156.239.105.vultr.comBookwormThailand02.09.2021verifiedСредний
4XXX.XXX.XXX.XXXXxxxxxxxXxxxxxxx02.09.2021verifiedВысокий
5XXX.XXX.XXX.XXXxxxxxxxXxxxxxxx02.09.2021verifiedВысокий
6XXX.XXX.XXX.XXXxxxxxxxXxxxxxxx02.09.2021verifiedВысокий
7XXX.XXX.XXX.XXXxxxxxxxXxxxxxxx02.09.2021verifiedВысокий
8XXX.XXX.XXX.XXXxxxxxxxXxxxxxxx02.09.2021verifiedВысокий
9XXX.XXX.XXX.XXXXxxxxxxxXxxxxxxx02.09.2021verifiedВысокий
10XXX.XXX.XXX.XXXXxxxxxxxXxxxxxxx02.09.2021verifiedВысокий
11XXX.XXX.XXX.XXXxxxxxxxXxxxxxxx02.09.2021verifiedВысокий

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueУязвимостиВектор доступаТипУверенность
1T1006CWE-22Path TraversalpredictiveВысокий
2TXXXX.XXXCWE-XXXxxxx Xxxx XxxxxxxxxpredictiveВысокий
3TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveВысокий
4TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveВысокий

IOA - Indicator of Attack (9)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDКлассIndicatorТипУверенность
1File/install/index.phppredictiveВысокий
2File/var/WEB-GUI/cgi-bin/telnet.cgipredictiveВысокий
3Filexxxxxx_xxx.xpredictiveСредний
4Filexxxx.xxxpredictiveСредний
5Filexxxxxxxx/xxxxxx-xxxxx/xxxxxxxxxxx/xxxx.xxpredictiveВысокий
6Filexxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxxpredictiveВысокий
7ArgumentxxxxxxxxxxpredictiveСредний
8Argumentxxxxx/xxxxpredictiveСредний
9ArgumentxxxxxxxxpredictiveСредний

Ссылки (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you want to use VulDB in your project?

Use the official API to access entries easily!