RedFoxtrot Анализ

IOB - Indicator of Behavior (755)

Временная шкала

Язык

en632
zh100
ja8
es6
it4

Страна

cn154
us140
gb4
id2
bd2

Акторы

Деятельность

Интерес

Временная шкала

Тип

Поставщик

Продукт

Microsoft Windows52
Google Chrome26
Apple iOS22
Linux Kernel20
Microsoft Internet Explorer18

Уязвимости

#УязвимостиBaseTemp0dayСегодняЭ�RemCTIEPSSCVE
1TikiWiki tiki-register.php эскалация привилегий7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix7.850.01009CVE-2006-6168
2DZCP deV!L`z Clanportal config.php эскалация привилегий7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.570.00943CVE-2010-0966
3Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash раскрытие информации5.35.2$5k-$25k$0-$5kHighWorkaround0.020.02016CVE-2007-1192
4Tiki Admin Password tiki-login.php слабая аутентификация8.07.7$0-$5k$0-$5kNot DefinedOfficial Fix3.390.00936CVE-2020-15906
5Beijing Baichuo Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php эскалация привилегий7.57.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.060.00067CVE-2023-4873
6LogicBoard CMS away.php Redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable3.510.00000
7WordPress sql-инъекция6.86.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.00467CVE-2022-21664
8SourceCodester Employee and Visitor Gate Pass Logging System GET Parameter view_designation.php sql-инъекция7.16.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.060.00135CVE-2023-2090
9Drupal Database Connection Error Message раскрытие информации5.35.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.000.00000
10Sun Java fontmanager.dll UIManager.getSystemLookAndFeelClassName повреждение памяти7.87.5$25k-$100k$0-$5kNot DefinedOfficial Fix0.020.00000
11Citrix XenServer Web Self Service Management Interface Privilege Escalation6.36.0$25k-$100k$0-$5kNot DefinedOfficial Fix0.020.00000
12WP Statistics Plugin class-wp-statistics-hits.php sql-инъекция8.58.4$0-$5k$0-$5kNot DefinedNot Defined0.020.36793CVE-2022-25149
13xrdp sesman Server повреждение памяти7.87.6$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00050CVE-2022-23613
14Liferay Portal CE JSON Payload эскалация привилегий7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.020.01289CVE-2019-16891
15Cisco ASA Command Line Interface EpicBanana/JetPlow эскалация привилегий7.87.4$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.030.97507CVE-2016-6367
16Hikvision Product Message эскалация привилегий5.55.5$0-$5k$0-$5kNot DefinedNot Defined0.020.97493CVE-2021-36260
17VMware ESXi/Workstation/Fusion vmxnet3 Virtual Network Adapter повреждение памяти4.44.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00044CVE-2020-3971
18Mail Masta Plugin csvexport.php sql-инъекция8.58.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.020.00597CVE-2017-6095
19Apple macOS раскрытие информации4.44.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00077CVE-2020-9944
20Apple tvOS раскрытие информации4.44.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00077CVE-2020-9943

IOC - Indicator of Compromise (22)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP-адресHostnameАкторКампанииIdentifiedТипУверенность
145.32.22.22045.32.22.220.vultrusercontent.comRedFoxtrot12.10.2022verifiedВысокий
245.32.146.17445.32.146.174.vultrusercontent.comRedFoxtrot12.10.2022verifiedВысокий
345.76.216.6245.76.216.62.vultrusercontent.comRedFoxtrot12.10.2022verifiedВысокий
445.77.178.76thematrix.devRedFoxtrot12.10.2022verifiedВысокий
566.42.33.21466.42.33.214.vultrusercontent.comRedFoxtrot12.10.2022verifiedВысокий
6XXX.XXX.XX.XXXxxx.xxx.xx.xxx.xxxxxxxxxxxxxxxx.xxxXxxxxxxxxx12.10.2022verifiedВысокий
7XXX.XX.XXX.XXxxxxxxx-xxxx.xxxxxxxxxxxxxxxxXxxxxxxxxx12.10.2022verifiedВысокий
8XXX.XXX.XXX.XXXXxxxxxxxxx12.10.2022verifiedВысокий
9XXX.XXX.XXX.XXXxxxxxxxxx12.10.2022verifiedВысокий
10XXX.XXX.XXX.XXXxx-xxxxxxx-xxxxxx-xxxxxxxx.xxxxx.xxxxxxxxxxxxxx.xxxXxxxxxxxxx12.10.2022verifiedВысокий
11XXX.XX.XXX.XXXxxx.xx.xxx.xxx.xxxxxxxxxxxxxxxx.xxxXxxxxxxxxx12.10.2022verifiedВысокий
12XXX.XX.XXX.XXXXxxxxxxxxx12.10.2022verifiedВысокий
13XXX.XXX.XXX.XXxxxxxxxxx12.10.2022verifiedВысокий
14XXX.XXX.XX.XXXxxx-xxx-xx-xxx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxxxxxx12.10.2022verifiedВысокий
15XXX.XXX.XXX.XXXXxxxxxxxxx12.10.2022verifiedВысокий
16XXX.XXX.XXX.XXXXxxxxxxxxx12.10.2022verifiedВысокий
17XXX.XXX.XXX.XXXxxxxxxxxx12.10.2022verifiedВысокий
18XXX.XX.XX.XXXxxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxxXxxxxxxxxx12.10.2022verifiedВысокий
19XXX.XX.XX.XXXxxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxxXxxxxxxxxx12.10.2022verifiedВысокий
20XXX.XXX.XXX.XXXxxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxxXxxxxxxxxx12.10.2022verifiedВысокий
21XXX.XXX.XXX.XXXXxxxxxxxxx12.10.2022verifiedВысокий
22XXX.XXX.XXX.XXXxxxxxxxxxxxxxx.xxxxxXxxxxxxxxx12.10.2022verifiedВысокий

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueУязвимостиВектор доступаТипУверенность
1T1006CWE-21, CWE-22, CWE-24Path TraversalpredictiveВысокий
2T1040CWE-294, CWE-319Authentication Bypass by Capture-replaypredictiveВысокий
3T1055CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveВысокий
4T1059CWE-94Argument InjectionpredictiveВысокий
5T1059.007CWE-79, CWE-80Cross Site ScriptingpredictiveВысокий
6TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveВысокий
7TXXXX.XXXCWE-XXXXxx Xx Xxxx-xxxxx XxxxxxxxpredictiveВысокий
8TXXXX.XXXCWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveВысокий
9TXXXXCWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveВысокий
10TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveВысокий
11TXXXXCWE-XXX, CWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveВысокий
12TXXXXCWE-XXXXxxxxxxxxx XxxxxxpredictiveВысокий
13TXXXXCWE-XXXxx XxxxxxxxxpredictiveВысокий
14TXXXXCWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveВысокий
15TXXXX.XXXCWE-XXXXxxxxxxxxxxxpredictiveВысокий
16TXXXXCWE-XXXXxxxxxxxx Xxxxxx XxxxpredictiveВысокий
17TXXXXCWE-XXX, CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveВысокий
18TXXXX.XXXCWE-XXXxxxxxxxxxxxxpredictiveВысокий
19TXXXXCWE-XXX, CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveВысокий
20TXXXX.XXXCWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveВысокий
21TXXXXCWE-XXXXxxxxxxxxxx XxxxxxpredictiveВысокий

IOA - Indicator of Attack (192)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDКлассIndicatorТипУверенность
1File/admin/maintenance/view_designation.phppredictiveВысокий
2File/admin/sys_sql_query.phppredictiveВысокий
3File/app/Http/Controllers/Admin/NEditorController.phppredictiveВысокий
4File/cgi-bin/luci/api/wirelesspredictiveВысокий
5File/cgi-bin/vitogate.cgipredictiveВысокий
6File/forum/away.phppredictiveВысокий
7File/getcfg.phppredictiveСредний
8File/group1/uploapredictiveВысокий
9File/importexport.phppredictiveВысокий
10File/inc/lists/csvexport.phppredictiveВысокий
11File/server-statuspredictiveВысокий
12File/sgmi/predictiveНизкий
13File/system/user/resetPwdpredictiveВысокий
14File/tos/index.php?editor/fileGetpredictiveВысокий
15File/uncpath/predictiveСредний
16File/user/updatePwdpredictiveВысокий
17File/var/log/nginxpredictiveВысокий
18Fileaddentry.phppredictiveСредний
19Fileadmin-ajax.php?action=get_wdtable order[0][dir]predictiveВысокий
20Fileadmin/plib/api-rpc/Agent.phppredictiveВысокий
21Fileapplications/core/modules/front/system/content.phppredictiveВысокий
22Fileatt_protocol.ccpredictiveВысокий
23Filexxxx-xxxx.xpredictiveСредний
24Filexxxxxxxxxxxxxx.xxxpredictiveВысокий
25Filexxxxx.xxxpredictiveСредний
26Filexxx.xpredictiveНизкий
27Filexxxxx/xxxxxxx.xxxpredictiveВысокий
28Filexxxxx.xxxpredictiveСредний
29Filexxxxxxxx.xpredictiveСредний
30Filexxxxxxxxx.xxxpredictiveВысокий
31Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveВысокий
32Filexx.xxxpredictiveНизкий
33Filexxxxxxxx.xxxpredictiveСредний
34Filexxxx.xxxpredictiveСредний
35Filexx_xxxxxx.xxxpredictiveВысокий
36Filexxxx/xx/xxxxxxxxx/xxxxxxxxxxxxxxxxxx.xxxpredictiveВысокий
37Filexxxxx.xxxpredictiveСредний
38Filexxx/xxxxxx/xxxxxx.xpredictiveВысокий
39Filexxxx.xxxpredictiveСредний
40Filexxxxxxxx.xxxpredictiveСредний
41Filexxxxxxxx.xxxpredictiveСредний
42Filexx/xxxx/xxxxxxx.xpredictiveВысокий
43Filexx/xxx/xxx_xxxxxxxx.xpredictiveВысокий
44Filexxxxxx.xxxpredictiveСредний
45Filexxx_xxx.xxxpredictiveСредний
46Filexxxxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveВысокий
47Filexxxxxxxxxx.xxxpredictiveВысокий
48Filexx_xxx.xxxpredictiveСредний
49Filexxx/xxxxxx.xxxpredictiveВысокий
50Filexxx/xxxxxxxxxxx/xxxxxxx.xxxpredictiveВысокий
51Filexxxxx.xxxpredictiveСредний
52Filexxxxxxxxxxxxx.xxxpredictiveВысокий
53Filexx/xxx/xxxxx.xxxpredictiveВысокий
54Filexxxxxx.xpredictiveСредний
55Filexxxxxx/xxxxx.xpredictiveВысокий
56Filexxxxxxxxxx.xxxpredictiveВысокий
57Filexxxxx.xxxpredictiveСредний
58Filexxxxx.xxxpredictiveСредний
59Filexxxxxxxxxx/xxxxxxx.xpredictiveВысокий
60Filexxxx-xxxxxx.xpredictiveВысокий
61Filexxxxxxxx.xxxpredictiveСредний
62Filexxx/xxxxxx.xpredictiveСредний
63Filexxx.xxxpredictiveНизкий
64Filexxxxxx.xpredictiveСредний
65Filexxxxxxxx.xxxpredictiveСредний
66Filexxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]predictiveВысокий
67Filexxxxxxxx.xxxpredictiveСредний
68Filexxxxxxxx.xxxpredictiveСредний
69Filexxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxxpredictiveВысокий
70Filexxxxxxxxx/xxxxxxx/xxxx/xxxxxxxxxxxxxxxxxxxxxxx.xxxpredictiveВысокий
71Filexx_xxxx.xxpredictiveСредний
72Filexxxxxxxx.xxxpredictiveСредний
73Filexxxxxxx.xxxpredictiveСредний
74Filexxxxx.xxxpredictiveСредний
75Filexxxx-xxxxxx.xpredictiveВысокий
76Filexxxx_xxxxxx_xxxxxx.xxxpredictiveВысокий
77Filexxxxxx.xxpredictiveСредний
78Filexxx/xxxxxxxx/xxxx_xxxxxx.xpredictiveВысокий
79Filexxxxxx.xxxpredictiveСредний
80Filexxxxxx/xxxxxxx/xxxxxx/xxxxxxxx.xxxpredictiveВысокий
81Filexxxxxx/xxxxxxx/xx-xx/xxxx/xxxxx.xxxpredictiveВысокий
82Filexxxxxx/xxxxxxxxx/xxxxxxx.xpredictiveВысокий
83Filexxxx-xxxxx.xxxpredictiveВысокий
84Filexxxx-xxxxxxxx.xxxpredictiveВысокий
85Filexxxxxxxx.xxxpredictiveСредний
86Filexxxxx/xxxxxx.xpredictiveВысокий
87Filexxx.xxxpredictiveНизкий
88Filexxxxx/xxxxxxxx.xxxpredictiveВысокий
89Filexxxx/xxx/xxxx-xxxxx.xxxpredictiveВысокий
90Filexxxxxxx.xxxpredictiveСредний
91Filexxxxxxx.xxxpredictiveСредний
92Filexxxxxx.xxxpredictiveСредний
93Filexx-xxxxx/xxxxx-xxxx.xxxpredictiveВысокий
94Filexx-xxxxx/xxxxx.xxxpredictiveВысокий
95Filexx-xxxxxxxx/xxxxx-xx-xxxxx.xxxpredictiveВысокий
96Filexx-xxxxxxxx/xxxxx.xxxpredictiveВысокий
97File~/xxxxxxxx/xxxxx-xx-xxxxxxxxxx-xxxx.xxxpredictiveВысокий
98Library/xxx/xxx/xxx/xxxx/xxxxxxxxxx/xxxxx/xxxxx.xxxpredictiveВысокий
99Libraryxxxxxxxxxxx.xxxpredictiveВысокий
100Libraryxxxxxxxxx/xxx-xxxxxx/xxxxxxxx.xxxpredictiveВысокий
101Libraryxxxxxxxx.xxxpredictiveСредний
102Libraryxxxxxxxxxxx.xxxpredictiveВысокий
103Libraryxxxxx.xxxpredictiveСредний
104Libraryxxxxxxxxxxxxxxxx.xxxpredictiveВысокий
105Libraryxxx.xxxpredictiveНизкий
106Libraryxxxxxxx.xxxpredictiveСредний
107Libraryxxxxxxx.xxxpredictiveСредний
108Libraryxxxxxx.xxxpredictiveСредний
109Libraryxxx xxxxxxxxxpredictiveВысокий
110Libraryxxxxxx/x/xxxxxxxxpredictiveВысокий
111Argument$_xxx['xxxx']predictiveВысокий
112Argument-xpredictiveНизкий
113ArgumentxxxxxxxxxxpredictiveСредний
114ArgumentxxxpredictiveНизкий
115ArgumentxxxxxxxxxxxxxxpredictiveВысокий
116ArgumentxxxxxxxxpredictiveСредний
117ArgumentxxxxxxpredictiveНизкий
118Argumentxxxxxxx_xxpredictiveСредний
119ArgumentxxxxxxxxxxpredictiveСредний
120Argumentxxxxxxx_xxxxxpredictiveВысокий
121ArgumentxxxxxxxxxxxpredictiveСредний
122ArgumentxxxxxxpredictiveНизкий
123Argumentxxxx/xxxxpredictiveСредний
124ArgumentxxxxxxxxxxxxxpredictiveВысокий
125ArgumentxxxxxpredictiveНизкий
126ArgumentxxxxpredictiveНизкий
127ArgumentxxxxxxxxpredictiveСредний
128ArgumentxxxxxxxxpredictiveСредний
129Argumentxxxx:predictiveНизкий
130ArgumentxxpredictiveНизкий
131ArgumentxxpredictiveНизкий
132ArgumentxxxxxxxxxpredictiveСредний
133ArgumentxxpredictiveНизкий
134Argumentxxxx_xxpredictiveНизкий
135Argumentxxxxx[xxxxxxx]predictiveВысокий
136ArgumentxxxxpredictiveНизкий
137ArgumentxxxxxxxxxxxpredictiveСредний
138ArgumentxxxpredictiveНизкий
139Argumentxxxxx/xxxxpredictiveСредний
140Argumentxxxxxxx/xxxxxpredictiveВысокий
141ArgumentxxxxxxpredictiveНизкий
142Argumentxxxx_xxxpredictiveСредний
143Argumentxxxxxx_xxxxpredictiveСредний
144Argumentxxxxxxx xxxxxxpredictiveВысокий
145Argumentxxx_xxpredictiveНизкий
146Argumentxxxx_xxxxpredictiveСредний
147ArgumentxxxxxxxxxxpredictiveСредний
148ArgumentxxxxxxpredictiveНизкий
149ArgumentxxxxxxxxxxpredictiveСредний
150Argumentxxxxxx_xxpredictiveСредний
151ArgumentxxxxxxxxpredictiveСредний
152ArgumentxxxpredictiveНизкий
153ArgumentxxxxxxxxxxpredictiveСредний
154ArgumentxxxpredictiveНизкий
155ArgumentxxxpredictiveНизкий
156ArgumentxxxxxxxxxxpredictiveСредний
157ArgumentxxxxxxxxxxxpredictiveСредний
158Argumentxxxxxx xxxxxxpredictiveВысокий
159ArgumentxxxpredictiveНизкий
160ArgumentxxxpredictiveНизкий
161Argumentxxxx-xxxxxxxxpredictiveВысокий
162Argumentxxxxxxxx/xxxxpredictiveВысокий
163ArgumentxxxxpredictiveНизкий
164Argumentxxxxx/xxxxx/xxxxx/xxxx/xxxxxxpredictiveВысокий
165Input Value%xxxxxx+-x+x+xx.x.xx.xxx%xx%xxpredictiveВысокий
166Input Value../../predictiveНизкий
167Input Value/xxxxxx/..%xxpredictiveВысокий
168Input Value::$xxxxx_xxxxxxxxxxpredictiveВысокий
169Input Valuexxxx -x xxxxxxxx=xxxxxx.xxxxxxx xxxx://xxx.xxx.x.x/xxxxxx.xxxpredictiveВысокий
170Input ValuexxxxxxpredictiveНизкий
171Pattern+|xx xx xx xx xx xx xx|predictiveВысокий
172Pattern/xxxxx/xxxxxxx.xxxpredictiveВысокий
173Pattern/xxxxxxxxxx/predictiveСредний
174Patternxxxx|xx|predictiveСредний
175PatternxxxxpredictiveНизкий
176PatternxxxpredictiveНизкий
177PatternxxxxxxxxxxxpredictiveСредний
178Patternxxxxxxx|xx xx xx xx xx|predictiveВысокий
179PatternxxxxpredictiveНизкий
180PatternxxxxpredictiveНизкий
181Patternxxxxxxxxx|xx|predictiveВысокий
182PatternxxxxpredictiveНизкий
183Patternx|xx|x|xx|_|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|predictiveВысокий
184Patternxxxxxx.xxxxxxpredictiveВысокий
185Patternxxxxx/xxxxxxxxxpredictiveВысокий
186Pattern|xx xx xx xx|predictiveВысокий
187Pattern|xx xx|predictiveНизкий
188Pattern|xx xx xx xx|<|xx xx xx|xxxxpredictiveВысокий
189Pattern|xx|x|xx xx|predictiveСредний
190Network Portxxx/xxpredictiveНизкий
191Network Portxxx/xxxx (xxx)predictiveВысокий
192Network Portxxx xxxxxx xxxxpredictiveВысокий

Ссылки (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!