Daserf Анализ

IOB - Indicator of Behavior (17)

Временная шкала

Язык

en16
de2

Страна

cn10
us6
kr2

Акторы

Деятельность

Интерес

Временная шкала

Тип

Поставщик

Продукт

WordPress4
Node.js2
Coremail2
Microsoft Internet Explorer2
My Link Trader2

Уязвимости

#УязвимостиBaseTemp0dayСегодняЭ�RemEPSSCTICVE
1Coremail Document Attachment межсайтовый скриптинг5.25.2$0-$5k$0-$5kNot DefinedNot Defined0.001200.00CVE-2015-6942
2Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash раскрытие информации5.35.2$5k-$25kРасчетHighWorkaround0.020160.00CVE-2007-1192
3ExpressVPN Service Port 2015 Xvpnd.exe XVPN.SetPreference обход каталога6.26.0$0-$5k$0-$5kNot DefinedWorkaround0.000440.00CVE-2018-15490
4Shenzhen Yunni Technology iLnkP2P UID Generator Random слабое шифрование7.77.7$0-$5k$0-$5kNot DefinedNot Defined0.001760.08CVE-2019-11219
5Shenzhen Yunni Technology iLnkP2P Authentication слабая аутентификация7.77.7$0-$5k$0-$5kNot DefinedNot Defined0.006690.05CVE-2019-11220
6Hisilicon HI3510 Web Management Portal Credentials эскалация привилегий6.56.5$0-$5k$0-$5kNot DefinedNot Defined0.001040.00CVE-2019-10710
7Hisilicon HI3510 RTSP Stream/Web Portal эскалация привилегий6.46.3$0-$5k$0-$5kNot DefinedWorkaround0.001680.00CVE-2019-10711
8WordPress URL Validator Redirect6.66.5$5k-$25k$0-$5kNot DefinedOfficial Fix0.005090.04CVE-2018-10101
9WordPress Password Reset wp-login.php mail эскалация привилегий6.15.8$5k-$25k$0-$5kProof-of-ConceptNot Defined0.028270.05CVE-2017-8295
10WordPress Admin Shell эскалация привилегий7.36.6$25k-$100k$0-$5kFunctionalWorkaround0.000000.00
11My Link Trader out.php sql-инъекция6.35.7$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.05
12Apple macOS AppleSMC отказ в обслуживании7.87.6$5k-$25k$0-$5kNot DefinedOfficial Fix0.000450.00CVE-2016-4678
13Node.js ServerResponse#writeHead Split эскалация привилегий6.15.9$0-$5k$0-$5kNot DefinedOfficial Fix0.004370.00CVE-2016-5325
14Microsoft Internet Explorer Garbage Collection jscript9.dll ProcessMark раскрытие информации5.34.8$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.000000.00
15IBM Java Virtual Machine раскрытие информации5.35.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.005550.02CVE-2015-1914

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP-адресHostnameАкторКампанииIdentifiedТипУверенность
127.255.69.209Daserf27.03.2022verifiedВысокий
2XX.XXX.XX.XXXXxxxxx27.03.2022verifiedВысокий
3XXX.XXX.X.XXXxxxxx27.03.2022verifiedВысокий
4XXX.XXX.XXX.XXXXxxxxx27.03.2022verifiedВысокий
5XXX.XXX.XXX.XXXxxxxx27.03.2022verifiedВысокий

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueКлассУязвимостиВектор доступаТипУверенность
1T1006CAPEC-126CWE-22Path TraversalpredictiveВысокий
2T1059.007CAPEC-209CWE-79Cross Site ScriptingpredictiveВысокий
3TXXXXCAPEC-122CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveВысокий
4TXXXX.XXXCAPEC-178CWE-XXXXxxx XxxxxxxxpredictiveВысокий
5TXXXXCAPEC-CWE-XXXXxxxxxxxxx XxxxxxpredictiveВысокий
6TXXXXCAPEC-108CWE-XXXxx XxxxxxxxxpredictiveВысокий
7TXXXXCAPEC-50CWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveВысокий
8TXXXXCAPEC-116CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveВысокий
9TXXXXCAPEC-CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveВысокий

IOA - Indicator of Attack (9)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDКлассIndicatorТипУверенность
1File/out.phppredictiveСредний
2Filedata/gbconfiguration.datpredictiveВысокий
3Filexx-xxxxx.xxxpredictiveСредний
4Filexxxxx.xxxpredictiveСредний
5Libraryxxxxxxxx.xxxpredictiveСредний
6ArgumentxxxxpredictiveНизкий
7ArgumentxxpredictiveНизкий
8ArgumentxxxxxxpredictiveНизкий
9Network Portxxx/xxxxpredictiveСредний

Ссылки (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!