PAPERWALL Анализ

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (10)

Язык

zh	8
en	2

Страна

cn	8
us	2

Акторы

PAPERWALL	2
Cobalt Strike	1

Интерес

Тип

Not Defined	8
Web Server	2

Поставщик

Not Defined	8
0xJacky	2

Продукт

Elasticsearch	6
0xJacky nginx-ui	2
FLDS	2

Уязвимости

#	Уязвимости	Base	Temp	0day	Сегодня	Э�	Rem	EPSS	CTI	CVE
1	0xJacky nginx-ui Certificate Import write_file.go обход каталога	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00165	0.03	CVE-2024-23827
2	Clash Proxies Name Column эскалация привилегий	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00274	0.00	CVE-2022-26255
3	Hashicorp Terraform обход каталога	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.04	CVE-2023-4782
4	Google Android ShannonRcs раскрытие информации	4.4	4.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.04	CVE-2023-20923
5	Google Android ActivityManagerService.java openContentUri раскрытие информации	3.3	3.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2023-21292
6	Elasticsearch Searchable Snapshot эскалация привилегий	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00112	0.00	CVE-2021-22147
7	Elasticsearch Grok Parser отказ в обслуживании	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00138	0.03	CVE-2021-22144
8	Elasticsearch Error Report раскрытие информации	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.96378	0.03	CVE-2021-22145
9	Joomla CMS com_easyblog sql-инъекция	6.3	6.1	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00000	0.57
10	FLDS redir.php sql-инъекция	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00203	0.03	CVE-2008-5928

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-адрес	Актор	Identified	Тип	Уверенность
1	43.153.75.48	PAPERWALL	08.02.2024	verified	Высокий
2	43.155.173.104	PAPERWALL	08.02.2024	verified	Высокий
3	XX.XXX.XX.XXX	Xxxxxxxxx	08.02.2024	verified	Высокий
4	XX.XXX.XX.XXX	Xxxxxxxxx	08.02.2024	verified	Высокий
5	XX.XXX.XXX.XXX	Xxxxxxxxx	08.02.2024	verified	Высокий
6	XX.XX.XX.XX	Xxxxxxxxx	08.02.2024	verified	Высокий
7	XXX.XX.XXX.XX	Xxxxxxxxx	08.02.2024	verified	Высокий
8	XXX.XXX.XXX.XX	Xxxxxxxxx	08.02.2024	verified	Высокий

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Класс	Уязвимости	Вектор доступа	Тип	Уверенность
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Высокий
2	TXXXX	CAPEC-10	CWE-XX	Xxxxxxxx Xxxxxxxxxxxxxx Xx Xxxx Xxxxxx Xxxxx Xxxxxxxxxxx	predictive	Высокий
3	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Высокий
4	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Высокий

IOA - Indicator of Attack (4)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Класс	Indicator	Тип	Уверенность
1	File	ActivityManagerService.java	predictive	Высокий
2	File	redir.php	predictive	Средний
3	File	xxxxx_xxxx.xx	predictive	Высокий
4	Argument	xx	predictive	Низкий

Ссылки (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ ПредыдущийОбзорДалее ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!