Dark Caracal Анализ

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (327)

Язык

en	254
zh	62
pl	4
ru	4
ja	2

Страна

la	214
cz	34
us	28
cn	26
my	14

Акторы

Cobalt Strike	10
Ave Maria	8
Dark Caracal	6
RedLine Stealer	6
AsyncRAT	5

Интерес

Тип

Not Defined	122
Content Management System	24
WordPress Plugin	18
Advertising Software	8
Application Server Software	6

Поставщик

Not Defined	132
Microsoft	10
Apache	8
Revive	8
Joomla	6

Продукт

Revive Adserver	8
WordPress	8
Joomla CMS	6
Qualcomm Snapdragon Mobile	4
OpenBSD OpenSSH	4

Уязвимости

#	Уязвимости	Base	Temp	0day	Сегодня	Э�	Rem	EPSS	CTI	CVE
1	TikiWiki tiki-register.php эскалация привилегий	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01009	7.93	CVE-2006-6168
2	Synacor Zimbra Collaboration mboximport обход каталога	4.7	4.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.96142	0.00	CVE-2022-27925
3	DEXT5 DEXT5Upload dext5handler.jsp эскалация привилегий	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01228	0.02	CVE-2020-13442
4	DEXT5Upload dext5handler.jsp обход каталога	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00503	0.02	CVE-2020-35362
5	Tiki Admin Password tiki-login.php слабая аутентификация	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	3.30	CVE-2020-15906
6	DZCP deV!L`z Clanportal config.php эскалация привилегий	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.33	CVE-2010-0966
7	nginx эскалация привилегий	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	0.00	CVE-2020-12440
8	FasterXML jackson-databind эскалация привилегий	9.8	9.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00410	0.08	CVE-2019-14540
9	Liferay Portal эскалация привилегий	9.8	8.8	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00578	0.00	CVE-2011-1571
10	Drupal Sanitization API межсайтовый скриптинг	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00056	0.02	CVE-2020-13672
11	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	3.25
12	LiteSpeed Cache Plugin Shortcode межсайтовый скриптинг	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00051	0.03	CVE-2023-4372
13	WebTitan Appliance Extensions Persistent межсайтовый скриптинг	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
14	ipTIME NAS-I Bulletin Manage эскалация привилегий	7.1	7.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00988	0.03	CVE-2020-7847
15	request-baskets API Request {name} эскалация привилегий	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.08109	0.00	CVE-2023-27163
16	PHP phpinfo межсайтовый скриптинг	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02101	0.04	CVE-2007-1287
17	Microsoft Windows Scripting Engine Remote Code Execution	5.9	5.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.37113	0.00	CVE-2021-34480
18	DevExpress ASP.NET Web Forms ASPxHttpHandlerModule DXR.axd эскалация привилегий	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00183	0.00	CVE-2022-41479
19	CodeIgniter old эскалация привилегий	6.6	6.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.06897	0.02	CVE-2022-21647
20	Basilix Webmail login.php3 эскалация привилегий	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.02

IOC - Indicator of Compromise (9)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-адрес	Hostname	Актор	Identified	Тип	Уверенность
1	74.208.167.252		Dark Caracal	16.12.2020	verified	Высокий
2	77.78.103.41	assigned-77-78-103-41.dc3.cz	Dark Caracal	16.12.2020	verified	Высокий
3	XXX.XX.XXX.XX	xxxxx.xxxxxxxx.xxxx	Xxxx Xxxxxxx	16.12.2020	verified	Высокий
4	XXX.XX.XXX.XX	xxxxxxx.xxxxx.xx	Xxxx Xxxxxxx	16.12.2020	verified	Высокий
5	XXX.XX.XXX.XXX	xxxxx.xxxxxxxxxxxxx.xxx	Xxxx Xxxxxxx	16.12.2020	verified	Высокий
6	XXX.XX.XXX.XXX	xxxxxxx.xxxxx.xx	Xxxx Xxxxxxx	16.12.2020	verified	Высокий
7	XXX.XX.XXX.XXX	xxxxxxx.xxxxx.xx	Xxxx Xxxxxxx	16.12.2020	verified	Высокий
8	XXX.XXX.XXX.XXX		Xxxx Xxxxxxx	16.12.2020	verified	Высокий
9	XXX.XXX.XXX.XX		Xxxx Xxxxxxx	16.12.2020	verified	Высокий

TTP - Tactics, Techniques, Procedures (19)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Уязвимости	Вектор доступа	Тип	Уверенность
1	T1006	CWE-21, CWE-22, CWE-24	Path Traversal	predictive	Высокий
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Высокий
3	T1059	CWE-88, CWE-94, CWE-1321	Argument Injection	predictive	Высокий
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Высокий
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Высокий
6	TXXXX.XXX	CWE-XXX, CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Высокий
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Высокий
8	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Высокий
9	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Высокий
10	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Высокий
11	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Высокий
12	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Высокий
13	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Высокий
14	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	Высокий
15	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Высокий
16	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Высокий
17	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Высокий
18	TXXXX.XXX	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Высокий
19	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Высокий

IOA - Indicator of Attack (161)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Класс	Indicator	Тип	Уверенность
1	File	/admin/dl_sendmail.php	predictive	Высокий
2	File	/adminPage/conf/reload	predictive	Высокий
3	File	/api/baskets/{name}	predictive	Высокий
4	File	/api/v2/cli/commands	predictive	Высокий
5	File	/apply.cgi	predictive	Средний
6	File	/dede/sys_sql_query.php	predictive	Высокий
7	File	/Device/Device/GetDeviceInfoList?deviceCode=&searchField=&deviceState=	predictive	Высокий
8	File	/DXR.axd	predictive	Средний
9	File	/forum/away.php	predictive	Высокий
10	File	/mfsNotice/page	predictive	Высокий
11	File	/novel/bookSetting/list	predictive	Высокий
12	File	/novel/userFeedback/list	predictive	Высокий
13	File	/owa/auth/logon.aspx	predictive	Высокий
14	File	/spip.php	predictive	Средний
15	File	/usr/bin/pkexec	predictive	Высокий
16	File	/x_portal_assemble_surface/jaxrs/portal/list?v=8.2.3-4-43f4fe3	predictive	Высокий
17	File	/zm/index.php	predictive	Высокий
18	File	adclick.php	predictive	Средний
19	File	admin.jcomments.php	predictive	Высокий
20	File	xxxxx/xxxx-xxxxxxx/xxxxxxxxxxx	predictive	Высокий
21	File	xxxxxxxxxxx/xxxxxxx/xxxxx/xxxxx/xxxxxxxxx/xxxxxxxx.xxx	predictive	Высокий
22	File	xxxxx.xxx	predictive	Средний
23	File	xxxxxxxxxxx.xxx	predictive	Высокий
24	File	xxxx/xxxxxxxxxxxx.xxx	predictive	Высокий
25	File	xxxx.xxx	predictive	Средний
26	File	xx_xxxx_xx_xxxx_xxxx.xxx	predictive	Высокий
27	File	xxxx_xxxxxxx.xxx	predictive	Высокий
28	File	xxx-xxx/xxxxxxx.xx	predictive	Высокий
29	File	xxxxx.xxx	predictive	Средний
30	File	xxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxx/xxxx_xxxxx.xxxx	predictive	Высокий
31	File	xxxxx-xxxxxxx.xxx	predictive	Высокий
32	File	xxxxxxxxxx/xxx_xxxxxxxxxx/xxxxxxx/xxxxxxxxxx.xxx	predictive	Высокий
33	File	xxxxxx.xxx	predictive	Средний
34	File	xxxxxxxxxx\xxxx.xxx	predictive	Высокий
35	File	xxxxxxxxxxx.xxx	predictive	Высокий
36	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Высокий
37	File	xxxxxxxxxxxx.xxx	predictive	Высокий
38	File	xxxx-xxxxxx.xxx	predictive	Высокий
39	File	xxxx.xxx	predictive	Средний
40	File	xxxxxxxxxxx.xxxxx.xxx	predictive	Высокий
41	File	xxxx.xxx	predictive	Средний
42	File	xxxxx_xxxxxxxx.xxx	predictive	Высокий
43	File	xxxxx_xxxx.xxx	predictive	Высокий
44	File	xxxxxxxxxx\xxxxxx\xxxxxxxxxxxxx.xxx	predictive	Высокий
45	File	xxxxxxx/xxxxxxxxxxxx.xxx	predictive	Высокий
46	File	xxx/xxxxxx.xxx	predictive	Высокий
47	File	xxxxxxxx/xxxxxxx/xxxxxxx.xxxx.xxx	predictive	Высокий
48	File	xxxxx.xxxx	predictive	Средний
49	File	xxxxx.xxx	predictive	Средний
50	File	xxxxx.xxx/xxxxxx.xxx/xxxxxxxxxxxxx.xxx/xxxxxxxx.xxx	predictive	Высокий
51	File	xxxxx.xxx?x=xxxx&x=xxxx&x=xx_xxx_xxxxxx	predictive	Высокий
52	File	xxxxx.xxx?x=xxxx&x=xxxxxxx&x=xxx	predictive	Высокий
53	File	xxx.x	predictive	Низкий
54	File	xxxx_xxxxxxx.xxx	predictive	Высокий
55	File	xx/xxx/xxxxxxxx/xxx_xxxxxxxxx/xxx_xxxxxxxx_xxxxx/_/xxxxxxx_xxx	predictive	Высокий
56	File	xxxxx.xxxx	predictive	Средний
57	File	xxxxx.xxx	predictive	Средний
58	File	xxxx.xxxx	predictive	Средний
59	File	xx_xxxx.x	predictive	Средний
60	File	xxxxxxx/xxxxxxxx/xxxxxxxx.xxx	predictive	Высокий
61	File	xxx/xxxx/xxxx_xxxxxxxxx.x	predictive	Высокий
62	File	xxx/xxxxxxxxx/xx_xxxxxx_xxx.x	predictive	Высокий
63	File	xxxxxxx_xxxx.xxx	predictive	Высокий
64	File	xxxxxxxxxxxxxxxxx.xxx	predictive	Высокий
65	File	xxxxxxx.xxx	predictive	Средний
66	File	xxxxxxx/xxxxxxx/xxx/xxxxxxxxxx.xxx?xxxxxxxx=xxxx&xxxxxx=xxxxxxxxxx	predictive	Высокий
67	File	xxxxxxx_xxxx.xxx	predictive	Высокий
68	File	xxxxx.xxx	predictive	Средний
69	File	xxxx_xxxx_xxxxxx.xxx	predictive	Высокий
70	File	xxxx.xxx	predictive	Средний
71	File	xxxxxxxx-xxxxxxxxxxx.xxx	predictive	Высокий
72	File	xxxx_xxxxx.xxxx	predictive	Высокий
73	File	xxxxxxxxxx_xxxx.xxx	predictive	Высокий
74	File	xxx/xxxx/xxxx	predictive	Высокий
75	File	xxxxxx/xxxxx/xxxx_xxxxxxx.xxx	predictive	Высокий
76	File	xxxxxx\xxxxxxxx\xx_xxxxx_xxxxxxx.xxx	predictive	Высокий
77	File	xxxxxxx.xxx.xx.xxxxxxxxxxx.xxx	predictive	Высокий
78	File	xxxxxxxxx/xxxxxxxx.xxx	predictive	Высокий
79	File	xxxx_xxxxxx.xx	predictive	Высокий
80	File	xxxx-xxxxx.xxx	predictive	Высокий
81	File	xxxx-xxxxxxxx.xxx	predictive	Высокий
82	File	xxxxxxxx.xxx	predictive	Средний
83	File	xxxxxx_xxxxx.xxx	predictive	Высокий
84	File	xxxxxx.xxx	predictive	Средний
85	File	xxxxxxx-xxxxx.xxx	predictive	Высокий
86	File	xxxx_xxxxx.xxx	predictive	Высокий
87	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	Высокий
88	File	xxxx.xxx	predictive	Средний
89	File	xx-xxxxx/xxxx.xxx	predictive	Высокий
90	File	xx-xxxxx-xxxxxx.xxx	predictive	Высокий
91	File	xx-xxxxxxxx/xxxxxxxxx.xxx	predictive	Высокий
92	File	xxx/xxxxxxxx/xxxxxxxx.xxx	predictive	Высокий
93	File	xxxx.xxx	predictive	Средний
94	File	~/xxx/xxxx-xxxxxxxxx.xxx	predictive	Высокий
95	File	~/xxxxxxxx/xxxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	Высокий
96	File	~/xxxxxxxx/xxxxx-xx-xxxxxxxxxx-xxxxxxxxx.xxx	predictive	Высокий
97	File	~/xxxxxxxx/xxxxxx/xxxxxx.xxx	predictive	Высокий
98	Library	xxxxxxx/xxx.xxx.xxx.xxx	predictive	Высокий
99	Argument	xxxxxxx xx/xxxxxxx xxxx	predictive	Высокий
100	Argument	xxx_xxx	predictive	Низкий
101	Argument	xxxx	predictive	Низкий
102	Argument	xxxxxxxxx	predictive	Средний
103	Argument	xxxxxxxx	predictive	Средний
104	Argument	xxx_xxx_xx_xxx_xxxxxxxxxx_x	predictive	Высокий
105	Argument	xxxxx_xxxx	predictive	Средний
106	Argument	xxxx_xxx_xxxx	predictive	Высокий
107	Argument	xxxxxxxxxx	predictive	Средний
108	Argument	xxx	predictive	Низкий
109	Argument	xxxxxxxxxxxxxxx	predictive	Высокий
110	Argument	xxxxxx	predictive	Низкий
111	Argument	xxxxxxxxxxxxx	predictive	Высокий
112	Argument	xxxx	predictive	Низкий
113	Argument	xxxxx	predictive	Низкий
114	Argument	xxxxxxxxx_xxxxxx	predictive	Высокий
115	Argument	xxxxxxxxx	predictive	Средний
116	Argument	xx_xxxxxxx	predictive	Средний
117	Argument	xxxx	predictive	Низкий
118	Argument	xxxxxxxx	predictive	Средний
119	Argument	xxxxx	predictive	Низкий
120	Argument	xxxxxxxxxxxxxxx	predictive	Высокий
121	Argument	xxxxxx_xxxxx	predictive	Средний
122	Argument	xx_xx	predictive	Низкий
123	Argument	xxxxxxx[xxxxxxx]	predictive	Высокий
124	Argument	xxxxxxx	predictive	Низкий
125	Argument	xxxxxx	predictive	Низкий
126	Argument	xxxxx	predictive	Низкий
127	Argument	xxxxxx_xxxx_xxx	predictive	Высокий
128	Argument	xx	predictive	Низкий
129	Argument	xxx	predictive	Низкий
130	Argument	xxxx	predictive	Низкий
131	Argument	xxxx	predictive	Низкий
132	Argument	xxx xxxxxxxx/xxxxxxx xxxxxxxx	predictive	Высокий
133	Argument	xxxxxxxx	predictive	Средний
134	Argument	xx	predictive	Низкий
135	Argument	xxxxxx/xxxxx/xxxx	predictive	Высокий
136	Argument	xxxxxxx	predictive	Низкий
137	Argument	xxxx	predictive	Низкий
138	Argument	xxxxxxxx	predictive	Средний
139	Argument	xxxxxx_xxxxxx	predictive	Высокий
140	Argument	xxxxxxx xxxx	predictive	Средний
141	Argument	xxxxxxxx_xx	predictive	Средний
142	Argument	xxx_xxxxxx	predictive	Средний
143	Argument	xxxxxx_xxxxx	predictive	Средний
144	Argument	xxxxxxxx	predictive	Средний
145	Argument	xxxx_xxxx	predictive	Средний
146	Argument	xxxx	predictive	Низкий
147	Argument	xxx	predictive	Низкий
148	Argument	xxxxxx	predictive	Низкий
149	Argument	xxxxxx_xxxx[]	predictive	Высокий
150	Argument	xxxxxxx	predictive	Низкий
151	Argument	xxx	predictive	Низкий
152	Argument	xxxxx	predictive	Низкий
153	Argument	xx_xxxxxxxx	predictive	Средний
154	Argument	xxx	predictive	Низкий
155	Argument	xxxxxxxx	predictive	Средний
156	Argument	_xxx_xxxxxxxxxxx_	predictive	Высокий
157	Input Value	xxxxx	predictive	Низкий
158	Input Value	xxxxxxxxx' xxx 'x'='x	predictive	Высокий
159	Input Value	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx	predictive	Высокий
160	Pattern	\|xx xx xx xx\|	predictive	Высокий
161	Network Port	xxxxx	predictive	Низкий

Ссылки (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ ПредыдущийОбзорДалее ▸

Do you need the next level of professionalism?

Upgrade your account now!