RuRAT Анализ

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (474)

Язык

en	246
de	208
it	14
es	4
fr	2

Страна

us	470
ir	2
br	2

Акторы

RuRAT	1

Интерес

Тип

Not Defined	44
Content Management System	20
Forum Software	14
Operating System	4
Programming Language Software	4

Поставщик

Not Defined	52
Jelsoft	4
Microsoft	2
SSReader	2
MikroTik	2

Продукт

WordPress	8
Jelsoft vBulletin	4
Devilz Clanportal	4
DT Register Extension	2
Microsoft Register Server	2

Уязвимости

#	Уязвимости	Base	Temp	0day	Сегодня	Э�	Rem	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash раскрытие информации	5.3	5.2	$5k-$25k	Расчет	High	Workaround	0.02016	0.00	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php эскалация привилегий	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.22	CVE-2010-0966
3	Woltlab Burning Board register.php межсайтовый скриптинг	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00957	0.00	CVE-2007-1443
4	Magic Photo Storage Website register.php эскалация привилегий	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
5	YaBB register.pl повреждение памяти	10.0	8.7	$0-$5k	$0-$5k	Unproven	Official Fix	0.17348	0.05	CVE-2007-3208
6	WordPress wp-register.php межсайтовый скриптинг	4.3	4.2	$5k-$25k	$0-$5k	High	Unavailable	0.00322	0.00	CVE-2007-5105
7	Phpwebgallery register.php межсайтовый скриптинг	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00573	0.03	CVE-2007-1109
8	Expinion.net News Manager Lite comment_add.asp межсайтовый скриптинг	4.3	3.8	$0-$5k	$0-$5k	Unproven	Official Fix	0.00607	0.00	CVE-2004-1845
9	Phorum register.php межсайтовый скриптинг	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01601	0.02	CVE-2007-0769
10	SSReader Ultra Star Reader ActiveX Control pdg2.dll Register повреждение памяти	10.0	9.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.07057	0.05	CVE-2007-5892
11	SSReader Ultra Star Reader ActiveX Control register повреждение памяти	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03617	0.00	CVE-2007-5807
12	StoreSprite register.php межсайтовый скриптинг	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01850	0.02	CVE-2007-4307
13	AlstraSoft AskMe Pro register.php межсайтовый скриптинг	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00
14	Microsoft Register Server отказ в обслуживании	5.3	5.3	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00350	0.00	CVE-2007-3658
15	Scribe forum.php register эскалация привилегий	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.02434	0.00	CVE-2007-5822
16	WordPress wp-register.php межсайтовый скриптинг	4.3	4.2	$5k-$25k	$0-$5k	High	Unavailable	0.00533	0.05	CVE-2007-5106
17	Andys Chat register.php повреждение памяти	10.0	10.0	$0-$5k	$0-$5k	Not Defined	Unavailable	0.03106	0.00	CVE-2006-7036
18	PBSite register.php Local Privilege Escalation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00
19	LushiWarPlaner register.php sql-инъекция	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00821	0.05	CVE-2007-0864
20	TeamCal register.php обход каталога	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-адрес	Hostname	Актор	Кампании	Identified	Тип	Уверенность
1	86.104.15.123	cphost07.qhoster.net	RuRAT		04.08.2022	verified	Высокий
2	XXX.XXX.XX.XXX	xxxxx-x.xxx-xxxxxxx.xxx	Xxxxx		04.08.2022	verified	Высокий

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Класс	Уязвимости	Вектор доступа	Тип	Уверенность
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Высокий
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Высокий
3	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	Высокий
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Высокий
5	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Высокий
6	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Высокий
7	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Высокий
8	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Высокий
9	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Высокий
10	TXXXX.XXX	CAPEC-	CWE-XX	Xxxxxxxxxxxxx	predictive	Высокий
11	TXXXX	CAPEC-157	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Высокий

IOA - Indicator of Attack (85)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Класс	Indicator	Тип	Уверенность
1	File	/index.php	predictive	Средний
2	File	/rom-0	predictive	Низкий
3	File	/uncpath/	predictive	Средний
4	File	adclick.php	predictive	Средний
5	File	add_comment.php	predictive	Высокий
6	File	base_maintenance.php	predictive	Высокий
7	File	comment_add.asp	predictive	Высокий
8	File	data/gbconfiguration.dat	predictive	Высокий
9	File	drivers/block/floppy.c	predictive	Высокий
10	File	email.php	predictive	Средний
11	File	EmployeeSearch.cc	predictive	Высокий
12	File	exit.php	predictive	Средний
13	File	forum.php	predictive	Средний
14	File	goto.php	predictive	Средний
15	File	xxxxxxxxx.xxx	predictive	Высокий
16	File	xxx/xxxxxx.xxx	predictive	Высокий
17	File	xxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxx	predictive	Высокий
18	File	xxxxxxx/xxxxxxx/xxxxxxxx_xxxxxxxx.xxx.xxx	predictive	Высокий
19	File	xxxxx.xxx	predictive	Средний
20	File	xxxxx.xxx.xxx	predictive	Высокий
21	File	xxxxx.xxx	predictive	Средний
22	File	xxxxx.xxx	predictive	Средний
23	File	xxxxx.xxx	predictive	Средний
24	File	xxxxxxxx.xxx	predictive	Средний
25	File	xxxxxxxx.xxxx	predictive	Высокий
26	File	xxxxxxxx.xxx	predictive	Средний
27	File	xxxxxxxx.xxx	predictive	Средний
28	File	xxxxxxxx.xx	predictive	Средний
29	File	xxxxxxxx_xxxxxx.xxx	predictive	Высокий
30	File	xxxxxxx_xxx_xxxxx_xxxxxx.xxxx	predictive	Высокий
31	File	xxxxxxxxxx/xxxxxxxxxx_xxxxxxxxxx.xxx	predictive	Высокий
32	File	xxxxxx/xxxxxxxx.xxx	predictive	Высокий
33	File	xxxxxx.xxx	predictive	Средний
34	File	xxxxxxx/xxxxxxxx.xxx	predictive	Высокий
35	File	xxxx-xxxxxxxx.xxx	predictive	Высокий
36	File	xxxx/xxxxxxxx.xxx	predictive	Высокий
37	File	xxxxx/xxxxxxxx.xxx	predictive	Высокий
38	File	xxxx/xxxxxxxx.xxx	predictive	Высокий
39	File	xx-xxxxx/xxxxx-xxxx.xxx?xx-xxxxx-xxxxxx[]=xxxxxxxx	predictive	Высокий
40	File	xx-xxxxx.xxx	predictive	Средний
41	File	xx-xxxxxxxx.xxx	predictive	Высокий
42	File	xxxxxx.xxx	predictive	Средний
43	Library	xxxx.xxx	predictive	Средний
44	Argument	xxxxxxx	predictive	Низкий
45	Argument	xxxxxx	predictive	Низкий
46	Argument	xxxxxxxx	predictive	Средний
47	Argument	xxxxxxx	predictive	Низкий
48	Argument	xxxx	predictive	Низкий
49	Argument	xxxxx	predictive	Низкий
50	Argument	xxxxx	predictive	Низкий
51	Argument	xxxxxxx=xxxxxxxx	predictive	Высокий
52	Argument	xxxx	predictive	Низкий
53	Argument	xxxx_xxxxx	predictive	Средний
54	Argument	xxxxxxxx	predictive	Средний
55	Argument	xx	predictive	Низкий
56	Argument	xx_xxxxxxxx	predictive	Средний
57	Argument	xxxxxxx_xxxx	predictive	Средний
58	Argument	xxxxxxxxx-xxxxxxx/xxxxxxxxx/xxxxxxxxxx	predictive	Высокий
59	Argument	xxxx	predictive	Низкий
60	Argument	xxxxxxxxxxxxx	predictive	Высокий
61	Argument	xxxxxxx	predictive	Низкий
62	Argument	xxxx	predictive	Низкий
63	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	Высокий
64	Argument	xxxx	predictive	Низкий
65	Argument	xxxx	predictive	Низкий
66	Argument	xxxx	predictive	Низкий
67	Argument	xxxxxxxx	predictive	Средний
68	Argument	xxxx_xxxx	predictive	Средний
69	Argument	xxx_xxxx	predictive	Средний
70	Argument	xxxxxx	predictive	Низкий
71	Argument	xxxxxxxxxxxx	predictive	Средний
72	Argument	xxxxxx	predictive	Низкий
73	Argument	xxxxxxxxxx	predictive	Средний
74	Argument	xxx	predictive	Низкий
75	Argument	xxxxx	predictive	Низкий
76	Argument	xxx	predictive	Низкий
77	Argument	xxxxxxxx	predictive	Средний
78	Argument	xxxx_xxxxx	predictive	Средний
79	Argument	xxxx_xxxxx	predictive	Средний
80	Argument	xxx	predictive	Низкий
81	Argument	_xxxxxx[xxxx_xxxx]	predictive	Высокий
82	Input Value	xxxx	predictive	Низкий
83	Input Value	xxxxxxxxx' xxx 'x'='x	predictive	Высокий
84	Input Value	xxxx	predictive	Низкий
85	Network Port	xxx xxxxxx xxxx	predictive	Высокий

Ссылки (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ ПредыдущийОбзорДалее ▸

Interested in the pricing of exploits?

See the underground prices here!