OnePercent Анализ

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (187)

Язык

en	152
sv	12
de	8
es	6
it	4

Страна

us	140
sv	12
ir	12
ru	8
cn	6

Акторы

OnePercent	6
Stantinko	1
Baldr	1
Dridex	1
Echobot	1

Интерес

Тип

Not Defined	36
Content Management System	16
Programming Language Software	6
Operating System	6
Web Server	4

Поставщик

Not Defined	46
Microsoft	6
Apache	4
Google	2
Pivotal	2

Продукт

PHP	6
MediaWiki	6
Microsoft Windows	4
Apache Tomcat	4
Google Chrome	2

Уязвимости

#	Уязвимости	Base	Temp	0day	Сегодня	Э�	Rem	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash раскрытие информации	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02	0.02016	CVE-2007-1192
2	Tiki TikiWiki tiki-editpage.php эскалация привилегий	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.05	0.01194	CVE-2004-1386
3	WPS Hide Login Plugin Secret Login Page options.php эскалация привилегий	6.9	6.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05	0.02933	CVE-2021-24917
4	Apple Mac OS X TCP/IP Stack отказ в обслуживании	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.03667	CVE-2004-0171
5	MGB OpenSource Guestbook email.php sql-инъекция	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.97	0.01302	CVE-2007-0354
6	Zipato Zipabox Smart Home Controller раскрытие информации	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00423	CVE-2018-15125
7	Samsung SCX-6x55X Syncthru Web Service раскрытие информации	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01	0.00145	CVE-2021-42913
8	DZCP deV!L`z Clanportal config.php эскалация привилегий	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	1.01	0.00943	CVE-2010-0966
9	OpenSSH Authentication Username раскрытие информации	5.3	4.8	$5k-$25k	$0-$5k	High	Official Fix	0.00	0.10737	CVE-2016-6210
10	Microsoft IIS межсайтовый скриптинг	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.00548	CVE-2017-0055
11	Microsoft IIS IP/Domain Restriction эскалация привилегий	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00	0.00817	CVE-2014-4078
12	PHP phpinfo межсайтовый скриптинг	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.23	0.02101	CVE-2007-1287
13	PHP phpinfo межсайтовый скриптинг	6.3	5.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.04	0.08985	CVE-2006-0996
14	Matt Martz & Andy Stratton Page Restrict Plugin неизвестная уязвимость	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00043	CVE-2024-24702
15	nginx эскалация привилегий	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.14	0.00241	CVE-2020-12440
16	Google Android Linkify.java addLinks эскалация привилегий	7.5	7.4	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00	0.00098	CVE-2019-2003
17	Adobe Magento Mage-Messages Cookie межсайтовый скриптинг	2.4	2.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00187	CVE-2021-28556
18	GitHub Enterprise Server GraphQL API эскалация привилегий	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00161	CVE-2022-23739
19	Mitsubishi Electric Factory Automation обход каталога	7.3	7.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.01117	CVE-2020-14523
20	TP-Link WR886N httpd Service PingIframeRpm.htm повреждение памяти	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00069	CVE-2021-44864

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-адрес	Hostname	Актор	Identified	Тип	Уверенность
1	31.187.64.199	sophia.onebusinessdesign.info	OnePercent	26.08.2021	verified	Высокий
2	80.82.67.221		OnePercent	26.08.2021	verified	Высокий
3	XXX.XXX.XXX.XX		Xxxxxxxxxx	26.08.2021	verified	Высокий
4	XXX.XXX.XXX.XXX		Xxxxxxxxxx	26.08.2021	verified	Высокий
5	XXX.XXX.XXX.XXX		Xxxxxxxxxx	26.08.2021	verified	Высокий
6	XXX.XX.XXX.XX		Xxxxxxxxxx	26.08.2021	verified	Высокий
7	XXX.XXX.XXX.XXX		Xxxxxxxxxx	26.08.2021	verified	Высокий

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Уязвимости	Вектор доступа	Тип	Уверенность
1	T1006	CWE-22	Path Traversal	predictive	Высокий
2	T1059	CWE-94	Argument Injection	predictive	Высокий
3	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Высокий
4	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Высокий
5	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Высокий
6	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Высокий
7	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Высокий
8	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Высокий
9	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Высокий
10	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Высокий

IOA - Indicator of Attack (69)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Класс	Indicator	Тип	Уверенность
1	File	/+CSCOE+/logon.html	predictive	Высокий
2	File	/download	predictive	Средний
3	File	/forum/away.php	predictive	Высокий
4	File	/port_3480/data_request	predictive	Высокий
5	File	/uncpath/	predictive	Средний
6	File	/userRpm/PingIframeRpm.htm	predictive	Высокий
7	File	/wp-admin/options.php	predictive	Высокий
8	File	adclick.php	predictive	Средний
9	File	xxx_xxxxxxx.xxx	predictive	Высокий
10	File	xxxxx/xxxxx.xxx?x=xx_xxx&x=xxxxx&x=xxxxx&x=xxxxx_xxxx_xxxxxxx&xxxxx=xxxx&xxxxx=x	predictive	Высокий
11	File	xxx.xxx	predictive	Низкий
12	File	xxxxxxxxxxxxxxxxx.xxx	predictive	Высокий
13	File	xxxx-xxxx.x	predictive	Средний
14	File	xxxxxxxxxxx.xxx	predictive	Высокий
15	File	xxx.xxx	predictive	Низкий
16	File	xxxxxxxxx-xxxxxxx.xxx	predictive	Высокий
17	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Высокий
18	File	xxxxx.x	predictive	Низкий
19	File	xxxxxxx/xxx/xxx/xxx_xxxx.x	predictive	Высокий
20	File	xxxxx.xxx	predictive	Средний
21	File	xxxx.xxx	predictive	Средний
22	File	xxx/xxxxxx.xxx	predictive	Высокий
23	File	xxxxxxx/xxxxxx/xxxxxxx/xxxxxx/xxx.xxx	predictive	Высокий
24	File	xxxxxxx.xxxx	predictive	Средний
25	File	xxxxx.xxx	predictive	Средний
26	File	xxxx	predictive	Низкий
27	File	xxxx.xxx	predictive	Средний
28	File	xxxxxxx.xxx	predictive	Средний
29	File	xxxxxxx_xxxxxx.xxx	predictive	Высокий
30	File	xxxxxxxx.xx	predictive	Средний
31	File	xxxxxxxx_xxxxxx.xxx	predictive	Высокий
32	File	xxxxx.xxx	predictive	Средний
33	File	xxxxxx.xxx	predictive	Средний
34	File	xxxxxxxxxxxx.xxx	predictive	Высокий
35	File	xxxx-xxxxxxxx.xxx	predictive	Высокий
36	File	xxxxxx.xxx	predictive	Средний
37	File	xxxxxx.xxx	predictive	Средний
38	File	xxxxxx.xxx	predictive	Средний
39	File	xxxxx/xxxxxxxx	predictive	Высокий
40	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	Высокий
41	File	xx-xxxxx/xxxxxxxx/xxxxx-xx-xxxxxx.xxx	predictive	Высокий
42	File	xx-xxxxxxxxx.xxx	predictive	Высокий
43	Library	xxxxxxxxxxxx.xxx	predictive	Высокий
44	Library	xxx/xxx.x	predictive	Средний
45	Library	xxx/xxx.x	predictive	Средний
46	Library	xxxxxxx.xxx	predictive	Средний
47	Argument	xxxxx_xxxxxxxx	predictive	Высокий
48	Argument	xxxxxxxx	predictive	Средний
49	Argument	xxxxx	predictive	Низкий
50	Argument	xxx	predictive	Низкий
51	Argument	xxxxxxxx	predictive	Средний
52	Argument	xxxxxxxxxxxxxxxxxxxxx	predictive	Высокий
53	Argument	xxxx	predictive	Низкий
54	Argument	xxxxxxxxx xxxx	predictive	Высокий
55	Argument	xxxxxx	predictive	Низкий
56	Argument	xxxx	predictive	Низкий
57	Argument	xxxxxxxxx	predictive	Средний
58	Argument	xx	predictive	Низкий
59	Argument	xxxx	predictive	Низкий
60	Argument	xxxxxxx	predictive	Низкий
61	Argument	xxxxxxxx	predictive	Средний
62	Argument	xxxx_xxxx	predictive	Средний
63	Argument	xxx	predictive	Низкий
64	Argument	xxxxxx_xxxx	predictive	Средний
65	Argument	xx_xx	predictive	Низкий
66	Argument	xxxxx_xx	predictive	Средний
67	Argument	xxxxxxxx/xxxx	predictive	Высокий
68	Argument	xxxxx	predictive	Низкий
69	Network Port	xxx/xxx (xxx)	predictive	Высокий

Ссылки (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ ПредыдущийОбзорДалее ▸

Interested in the pricing of exploits?

See the underground prices here!