NDSW Анализ

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (74)

Язык

en	62
ru	6
de	2
zh	2
it	2

Страна

ru	54
us	18

Акторы

NDSW	3
Locky	2
Emotet (Trickbot + Zeus Panda)	1
Hancitor (HelloFax Theme)	1
YKCOL (Locky Variant)	1

Интерес

Тип

Not Defined	12
Programming Language Software	6
Content Management System	4
Forum Software	4
Router Operating System	4

Поставщик

Not Defined	8
Microsoft	6
D-Link	4
Phplinkdirectory	2
Cisco	2

Продукт

Microsoft Office	2
Microsoft Visual Studio Code	2
Phplinkdirectory PHP Link Directory	2
Cisco IronPort AsyncOS	2
WPML	2

Уязвимости

#	Уязвимости	Base	Temp	0day	Сегодня	Э�	Rem	EPSS	CTI	CVE
1	PHP Link Directory Administration Page index.html межсайтовый скриптинг	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00374	0.17	CVE-2007-0529
2	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	1.97
3	Esoftpro Online Guestbook Pro ogp_show.php sql-инъекция	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00108	0.07	CVE-2009-4935
4	phpMyAdmin phpinfo.php раскрытие информации	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00142	0.00	CVE-2016-9848
5	DZCP deV!L`z Clanportal config.php эскалация привилегий	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.57	CVE-2010-0966
6	MGB OpenSource Guestbook email.php sql-инъекция	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.01302	0.74	CVE-2007-0354
7	Flat PHP Board обход каталога	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.01
8	Simple PHP Guestbook guestbook.php межсайтовый скриптинг	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
9	212cafe 212cafeboard view.php sql-инъекция	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00064	0.08	CVE-2008-4713
10	Microsoft Office Object Remote Code Execution	7.0	6.3	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.97339	0.02	CVE-2017-8570
11	Lars Ellingsen Guestserver guestbook.cgi межсайтовый скриптинг	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00169	0.17	CVE-2005-4222
12	Huawei SmartCare Dashboard Stored межсайтовый скриптинг	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00065	0.00	CVE-2017-15312
13	Flat PHP Board обход каталога	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.04
14	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash раскрытие информации	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
15	D-Link DIR-865L register_send.php слабая аутентификация	7.5	7.1	$5k-$25k	$5k-$25k	Proof-of-Concept	Not Defined	0.00109	0.02	CVE-2013-3096
16	jforum User эскалация привилегий	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00289	0.06	CVE-2019-7550
17	Cannot PHP infoBoard эскалация привилегий	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01049	0.00	CVE-2008-4334
18	Phplinkdirectory PHP Link Directory conf_users_edit.php неизвестная уязвимость	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00526	0.07	CVE-2011-0643
19	Add Comments Plugin Setting межсайтовый скриптинг	3.6	3.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00056	0.00	CVE-2022-3909
20	AlilG AliBoard File Upload usercp.php эскалация привилегий	6.3	6.1	$0-$5k	$0-$5k	High	Unavailable	0.00529	0.05	CVE-2008-7029

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-адрес	Hostname	Актор	Identified	Тип	Уверенность
1	109.234.35.249	v1020533.hosted-by-vdsina.ru	NDSW	29.07.2022	verified	Высокий
2	XXX.XX.XXX.XX		Xxxx	29.07.2022	verified	Высокий
3	XXX.XXX.XXX.XXX	xxxx.xx	Xxxx	29.07.2022	verified	Высокий

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Уязвимости	Вектор доступа	Тип	Уверенность
1	T1006	CWE-22	Path Traversal	predictive	Высокий
2	T1059	CWE-94	Argument Injection	predictive	Высокий
3	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Высокий
4	TXXXX	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Высокий
5	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Высокий
6	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Высокий
7	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Высокий
8	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Высокий
9	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Высокий

IOA - Indicator of Attack (40)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Класс	Indicator	Тип	Уверенность
1	File	/forum/away.php	predictive	Высокий
2	File	admin/conf_users_edit.php	predictive	Высокий
3	File	admin/index.php	predictive	Высокий
4	File	blog.php	predictive	Средний
5	File	comments/feed	predictive	Высокий
6	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Высокий
7	File	xxxxxxxx.xxx	predictive	Средний
8	File	xxx/xxx/xxxxx	predictive	Высокий
9	File	xxxxx.xxx	predictive	Средний
10	File	xxxxx.xxx	predictive	Средний
11	File	xxxxxxxxx.xxx	predictive	Высокий
12	File	xxxxxxxxx.xxx	predictive	Высокий
13	File	xxxxxxxxxx/xxxxxxxxxx/xxxxxxxx/xxxxxxxxxxxxxxxxxxx.xxx	predictive	Высокий
14	File	xxx/xxxxxx.xxx	predictive	Высокий
15	File	xxxxx.xxxx	predictive	Средний
16	File	xxxxxxxx.xxx	predictive	Средний
17	File	xxxx.xxx	predictive	Средний
18	File	xxx_xxxx.xxx	predictive	Средний
19	File	xxxxxxx.xxx	predictive	Средний
20	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	Высокий
21	File	xxxxxxxx_xxxx.xxx	predictive	Высокий
22	File	xxx.x	predictive	Низкий
23	File	xxxxxx.xxx	predictive	Средний
24	File	xxxx.xxx	predictive	Средний
25	File	xxxxxx.xxx	predictive	Средний
26	Argument	xxxxxx	predictive	Низкий
27	Argument	xxxxxxxx	predictive	Средний
28	Argument	xxx	predictive	Низкий
29	Argument	xxxxxxxxxxx	predictive	Средний
30	Argument	xxxxxxx	predictive	Низкий
31	Argument	xx	predictive	Низкий
32	Argument	xxxx	predictive	Низкий
33	Argument	xxx	predictive	Низкий
34	Argument	xxxxxxxx	predictive	Средний
35	Argument	xxxxxxxx	predictive	Средний
36	Argument	xxxxxxxx	predictive	Средний
37	Argument	xxxxxx	predictive	Низкий
38	Argument	xxxx	predictive	Низкий
39	Argument	xxxxx	predictive	Низкий
40	Argument	xxxxxxxx	predictive	Средний

Ссылки (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ ПредыдущийОбзорДалее ▸

Interested in the pricing of exploits?

See the underground prices here!