Neutrino Exploit Kit Анализ

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (99)

Язык

en	90
fr	4
de	2
ru	2
pl	2

Страна

us	40
ir	28
ca	10
ru	2
pl	2

Акторы

Neutrino Exploit Kit	3

Интерес

Тип

Not Defined	40
Content Management System	6
Programming Language Software	6
Web Server	6
Operating System	4

Поставщик

Not Defined	30
Microsoft	6
Netgear	6
D-Link	4
VMware	4

Продукт

WordPress	4
Apache HTTP Server	4
Flexera InstallShield	2
Allegro RomPager	2
jco.ir Karma	2

Уязвимости

#	Уязвимости	Base	Temp	0day	Сегодня	Э�	Rem	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash раскрытие информации	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02	0.02016	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php эскалация привилегий	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.24	0.00943	CVE-2010-0966
3	FLDS redir.php sql-инъекция	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.02	0.00203	CVE-2008-5928
4	Squid Web Proxy SSL Certificate Validation раскрытие информации	7.1	7.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.00610	CVE-2023-46724
5	Lenovo Smart Camera X3/Smart Camera X5/Smart Camera C2E Network Configuration эскалация привилегий	4.7	4.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00083	CVE-2021-3617
6	Fortinet FortiMail HTTPS sql-инъекция	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00677	CVE-2021-24007
7	Netgear NMS300 эскалация привилегий	9.8	9.8	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00516	CVE-2020-35797
8	rConfig sudoers эскалация привилегий	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.00166	CVE-2019-19585
9	vBulletin moderation.php sql-инъекция	7.3	7.0	$0-$5k	$0-$5k	High	Official Fix	0.01	0.00284	CVE-2016-6195
10	PHP unserialize повреждение памяти	7.3	6.4	$25k-$100k	$0-$5k	Unproven	Official Fix	0.03	0.00000
11	Apache Tomcat CORS Filter эскалация привилегий	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.07849	CVE-2018-8014
12	D-Link DSL-2875AL/DSL-2877AL Web Management Server index.asp слабое шифрование	6.4	6.4	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00	0.00291	CVE-2019-15656
13	HTTP/2 Window Size отказ в обслуживании	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Workaround	0.02	0.09689	CVE-2019-9511
14	nginx HTTP/2 отказ в обслуживании	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.09699	CVE-2018-16843
15	D-Link DIR-825 router_info.xml PIN эскалация привилегий	6.4	6.4	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.04	0.00390	CVE-2019-9126
16	D-Link DSL-2770L atbox.htm Credentials эскалация привилегий	7.5	7.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00	0.00369	CVE-2018-18007
17	Magento sql-инъекция	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00582	CVE-2019-7139
18	Atlassian JIRA Server/Data Center Jira Importers Plugin эскалация привилегий	7.2	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.01473	CVE-2019-15001
19	Apache HTTP Server mod_session эскалация привилегий	5.8	5.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00176	CVE-2018-1283
20	Apache HTTP Server HTTP Digest Authentication Challenge слабая аутентификация	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.01815	CVE-2018-1312

IOC - Indicator of Compromise (9)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-адрес	Hostname	Актор	Identified	Тип	Уверенность
1	45.32.183.118	45.32.183.118.vultrusercontent.com	Neutrino Exploit Kit	01.04.2022	verified	Высокий
2	78.136.221.141		Neutrino Exploit Kit	06.04.2022	verified	Высокий
3	XX.XX.X.XX		Xxxxxxxx Xxxxxxx Xxx	01.04.2022	verified	Высокий
4	XX.XXX.XXX.X	xxxx-xxxxxxxx-xxxxxx.xxxx.xxxxxx.xxx	Xxxxxxxx Xxxxxxx Xxx	06.04.2022	verified	Высокий
5	XX.XXX.XXX.X	xxx.xxxxxx.xx	Xxxxxxxx Xxxxxxx Xxx	06.04.2022	verified	Высокий
6	XX.XX.XXX.XXX	xx-xx-xxx-xxx.xxxxx.xxx.xx	Xxxxxxxx Xxxxxxx Xxx	06.04.2022	verified	Высокий
7	XXX.XX.X.XXX		Xxxxxxxx Xxxxxxx Xxx	06.04.2022	verified	Высокий
8	XXX.X.XXX.X		Xxxxxxxx Xxxxxxx Xxx	01.04.2022	verified	Высокий
9	XXX.XXX.XXX.XX	xxxxxx-xx.xxxxxx-xxxxx.xxx	Xxxxxxxx Xxxxxxx Xxx	06.04.2022	verified	Высокий

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Уязвимости	Вектор доступа	Тип	Уверенность
1	T1006	CWE-22	Path Traversal	predictive	Высокий
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Высокий
3	T1059	CWE-94	Argument Injection	predictive	Высокий
4	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Высокий
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Высокий
6	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Высокий
7	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Высокий
8	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Высокий
9	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Высокий
10	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Высокий
11	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Высокий
12	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	Высокий
13	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	Высокий
14	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Высокий
15	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Высокий

IOA - Indicator of Attack (55)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Класс	Indicator	Тип	Уверенность
1	File	/etc/sudoers	predictive	Средний
2	File	/forum/away.php	predictive	Высокий
3	File	/uncpath/	predictive	Средний
4	File	arch/x86/kernel/paravirt.c	predictive	Высокий
5	File	ArchiveNews.aspx	predictive	Высокий
6	File	atbox.htm	predictive	Средний
7	File	blank.php	predictive	Средний
8	File	xxx_xxxxxxxx.xxx	predictive	Высокий
9	File	xxxx/xxxxxxxxxxxxx.xxx	predictive	Высокий
10	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Высокий
11	File	xxx/xxxx/xxxx.x	predictive	Высокий
12	File	xxxxxxxxxxx/xxxxxxxx/xxxxxxxxxx.xxx	predictive	Высокий
13	File	xxxxxxxx.xxx	predictive	Средний
14	File	xxxxx_xxxx.xxx	predictive	Высокий
15	File	xxx/xxxxxx.xxx	predictive	Высокий
16	File	xxxxx.xxx	predictive	Средний
17	File	xxxxx.xxx	predictive	Средний
18	File	xxxxxxx.xxx	predictive	Средний
19	File	xxxx.xxx	predictive	Средний
20	File	xxxx_xxxx.xxx	predictive	Высокий
21	File	xxxxxx/xxxxxxxxxx.x	predictive	Высокий
22	File	xxxx.xxx	predictive	Средний
23	File	xxxxx.xxx	predictive	Средний
24	File	xxxxxxx/xxxx/xxxxxxxxx_xxx.xxx	predictive	Высокий
25	File	xxxxx.xxx	predictive	Средний
26	File	xxxxx.xxx	predictive	Средний
27	File	xxxxxxxxxx.xxx	predictive	Высокий
28	File	xxxxxx.x	predictive	Средний
29	File	xxxxxx.xxx	predictive	Средний
30	File	xxxxxx_xxxx.xxx	predictive	Высокий
31	File	xxxxxx_xxxx.xxx	predictive	Высокий
32	File	xxxxxxxxx.xxx	predictive	Высокий
33	File	xxxxx/xxxxx.xx	predictive	Высокий
34	Library	xxx/xx/xxxxxxx.xx	predictive	Высокий
35	Library	xxxxxxxxxxxx.xxx	predictive	Высокий
36	Argument	-x/-x	predictive	Низкий
37	Argument	xxxxxxxx	predictive	Средний
38	Argument	xxxx_xx	predictive	Низкий
39	Argument	xxxxxx_xx	predictive	Средний
40	Argument	xxxx_xxxx/xxxxx/xxxxxx	predictive	Высокий
41	Argument	xxxx_xxxxxxx	predictive	Средний
42	Argument	xx	predictive	Низкий
43	Argument	xxxxx	predictive	Низкий
44	Argument	xxxxxxxxx	predictive	Средний
45	Argument	xxxxx_xxxx_xxx	predictive	Высокий
46	Argument	xxxxxxx	predictive	Низкий
47	Argument	xxxxxxxxx	predictive	Средний
48	Argument	xxxxxx_xxxx	predictive	Средний
49	Argument	xxxxxxxxxxxx	predictive	Средний
50	Argument	xxx	predictive	Низкий
51	Argument	xxx	predictive	Низкий
52	Argument	xxxx	predictive	Низкий
53	Argument	xxxxxxxx/xxxx	predictive	Высокий
54	Argument	xxxxxxxx_x/xxxxxxxx_x	predictive	Высокий
55	Argument	xxxx->xxxxxxx	predictive	Высокий

Ссылки (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ ПредыдущийОбзорДалее ▸

Interested in the pricing of exploits?

See the underground prices here!