Xpiro Анализ

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (85)

Язык

en	82
fr	2
de	2

Страна

us	26
es	8
vn	2
in	2
kr	2

Акторы

Xpiro	4
Ramnit	2
TrickBot	1
Zeus	1

Интерес

Тип

Not Defined	24
Smartphone Operating System	6
E-Commerce Management Software	4
Content Management System	4
Web Server	4

Поставщик

Not Defined	34
SAP	8
Google	8
Apache	4
Apple	2

Продукт

Google Android	6
SAP Internet Graphics Server	4
phpMyAdmin	2
Apple iTunes	2
woocommerce-exporter Plugin	2

Уязвимости

#	Уязвимости	Base	Temp	0day	Сегодня	Э�	Rem	CTI	EPSS	CVE
1	ThemeIsle Orbit Fox Plugin межсайтовый скриптинг	4.9	4.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00045	CVE-2024-1323
2	IBM PowerSC эскалация привилегий	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.00073	CVE-2023-50940
3	Embed Calendly Plugin Shortcode межсайтовый скриптинг	5.1	5.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00045	CVE-2023-4995
4	Tracker Software PDF-XChange Editor U3D File Parser раскрытие информации	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00000	CVE-2023-42058
5	Mozilla Firefox XLL Add-In File эскалация привилегий	4.3	4.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00055	CVE-2023-4581
6	PHP Jabbers Yacht Listing Script Password Recovery раскрытие информации	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00091	CVE-2023-40761
7	OpenRapid RapidCMS run-movepass.php эскалация привилегий	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.06	0.00063	CVE-2023-4448
8	Chamilo SVG File fileUpload.lib.php эскалация привилегий	7.6	7.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00088	CVE-2023-34944
9	Apache InLong эскалация привилегий	6.5	6.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00	0.00125	CVE-2023-31206
10	Nokia NetAct Configuration Dashboard Page XML External Entity	6.4	6.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00069	CVE-2023-26057
11	Google Android PowerVR Kernel Driver PVRSRVBridgeRGXTDMSubmitTransfer повреждение памяти	6.5	6.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00043	CVE-2021-0879
12	Oracle MySQL Server Packaging раскрытие информации	7.5	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.06	0.00092	CVE-2022-43551
13	Mikrobi Babel redirect.php Redirect	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00215	CVE-2019-1010290
14	Nextcloud App Password Protection слабая аутентификация	4.1	4.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00053	CVE-2023-28647
15	Google Android unwinding.cc UnwindingWorker повреждение памяти	5.4	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00042	CVE-2023-21018
16	OTCMS apiRun.php AutoRun межсайтовый скриптинг	4.4	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.00062	CVE-2023-1635
17	Google Android повреждение памяти	5.4	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00042	CVE-2023-21042
18	SourceCodester Alphaware Simple E-Commerce System Payment summary.php эскалация привилегий	6.1	5.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02	0.00200	CVE-2023-0998
19	ThingsBoard слабая аутентификация	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.00337	CVE-2023-26462
20	Microsoft Dynamics 365 межсайтовый скриптинг	5.4	4.9	$5k-$25k	$0-$5k	Unproven	Official Fix	0.02	0.00052	CVE-2023-21573

IOC - Indicator of Compromise (27)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-адрес	Hostname	Актор	Identified	Тип	Уверенность
1	3.217.206.46	ec2-3-217-206-46.compute-1.amazonaws.com	Xpiro	13.08.2022	verified	Средний
2	3.223.115.185	ec2-3-223-115-185.compute-1.amazonaws.com	Xpiro	06.11.2021	verified	Средний
3	13.107.42.23		Xpiro	18.07.2021	verified	Высокий
4	20.36.252.129		Xpiro	08.01.2022	verified	Высокий
5	20.42.73.29		Xpiro	13.02.2022	verified	Высокий
6	20.189.173.20		Xpiro	13.02.2022	verified	Высокий
7	XX.XXX.XXX.XX		Xxxxx	13.02.2022	verified	Высокий
8	XX.XXX.XX.XX	xx.xx.xxx.xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxx	13.02.2022	verified	Средний
9	XX.XX.XX.XXX		Xxxxx	06.11.2021	verified	Высокий
10	XX.XX.XX.XX	xxxxx-xx.xxxxxxx.xxxxxx.xxx	Xxxxx	13.02.2022	verified	Высокий
11	XX.XX.XX.XXX	xxxxxx-xxx.xxxxxxx.xxxxxx.xxx	Xxxxx	13.02.2022	verified	Высокий
12	XX.XXX.XXX.XXX		Xxxxx	13.02.2022	verified	Высокий
13	XX.XXX.XXX.XXX		Xxxxx	13.02.2022	verified	Высокий
14	XX.XX.XX.XXX	xxxxxxxxx.xxx.xxxxxxx.xx	Xxxxx	24.10.2021	verified	Высокий
15	XX.XX.XXX.XX	xxxx.xxxxxxxxx.xxx	Xxxxx	24.10.2021	verified	Высокий
16	XX.XX.XXX.XX	xxxx-xx.xxxxxxx.xxxxxx.xxx	Xxxxx	13.02.2022	verified	Высокий
17	XX.XXX.XXX.XXX		Xxxxx	24.10.2021	verified	Высокий
18	XX.XXX.XXX.XX	xxxx.xxxxxxxxxx.xxx	Xxxxx	13.02.2022	verified	Высокий
19	XX.XXX.XXX.XXX	xxxxx-xxx.xxxxxxx.xxxxxx.xxx	Xxxxx	13.02.2022	verified	Высокий
20	XXX.XX.XX.XX		Xxxxx	08.01.2022	verified	Высокий
21	XXX.XX.XX.XX		Xxxxx	08.01.2022	verified	Высокий
22	XXX.XXX.XX.XX		Xxxxx	13.02.2022	verified	Высокий
23	XXX.XX.XXX.XXX	xxx-xxx-xx-xxx-xxx.xxxxxxx-x.xxxxxxxxx.xxx	Xxxxx	13.08.2022	verified	Средний
24	XXX.XX.XX.XX		Xxxxx	13.02.2022	verified	Высокий
25	XXX.XX.XX.XX		Xxxxx	13.02.2022	verified	Высокий
26	XXX.XX.XXX.XXX	x-xxxx.x-xxxxxx.xxx	Xxxxx	06.05.2022	verified	Высокий
27	XXX.XXX.XX.XXX	xxxxx.xxx-xxx-xx.xxxxxx.xxxxxxxxxxxx.xxx	Xxxxx	13.02.2022	verified	Высокий

TTP - Tactics, Techniques, Procedures (17)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Уязвимости	Вектор доступа	Тип	Уверенность
1	T1006	CWE-22	Path Traversal	predictive	Высокий
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Высокий
3	T1059	CWE-94	Argument Injection	predictive	Высокий
4	T1059.007	CWE-79	Cross Site Scripting	predictive	Высокий
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Высокий
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Высокий
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Высокий
8	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Высокий
9	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Высокий
10	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Высокий
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Высокий
12	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Высокий
13	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	Высокий
14	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Высокий
15	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Высокий
16	TXXXX.XXX	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Высокий
17	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Высокий

IOA - Indicator of Attack (32)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Класс	Indicator	Тип	Уверенность
1	File	/alphaware/summary.php	predictive	Высокий
2	File	/LoginAdmin	predictive	Средний
3	File	/vloggers_merch/classes/Master.php?f=delete_inventory	predictive	Высокий
4	File	admin/run-movepass.php	predictive	Высокий
5	File	xxxxxx.xxx	predictive	Средний
6	File	xxxxxxx/xxx/xxx-xxxx.x	predictive	Высокий
7	File	xxxxxx.xx	predictive	Средний
8	File	xxx/xxxxx.xxxx	predictive	Высокий
9	File	xxxxxxxxxxxxx.xxx	predictive	Высокий
10	File	xxxxxxxx.xxx	predictive	Средний
11	File	xxx_xxxx.x	predictive	Средний
12	File	xxxxxx-xxxxxxx.xxx	predictive	Высокий
13	File	xxxxxxx.xxx	predictive	Средний
14	File	xxxxxxxxx.xx	predictive	Средний
15	File	xxxxxxxxx/xxx/xxx.x	predictive	Высокий
16	File	xxxx.xx	predictive	Низкий
17	File	xxxxxxxxxxxx.xxx	predictive	Высокий
18	Library	/xxxxxxxxxx.xxx.xxx	predictive	Высокий
19	Argument	xxxxxx	predictive	Низкий
20	Argument	xxx_xxxxxx_xxxx_xxx_xxxxxx_xxxx/xxx_xxxxxx_xxxx_xxx_xxxxxx_xxxxx	predictive	Высокий
21	Argument	xxxx	predictive	Низкий
22	Argument	xxxxxx	predictive	Низкий
23	Argument	xxxx	predictive	Низкий
24	Argument	xxxxxxxx/xxxxxxxxx	predictive	Высокий
25	Argument	xxxxxxx_xxxxxxx	predictive	Высокий
26	Argument	xx_xxxx	predictive	Низкий
27	Argument	xxx_xxxxxxx_xxxxxxxx/xxx_xxxxxxx_xxxxxxxx	predictive	Высокий
28	Argument	xxx	predictive	Низкий
29	Argument	xxxxxxxx	predictive	Средний
30	Input Value	::$xxxxx_xxxxxxxxxx	predictive	Высокий
31	Pattern	\|xx\|	predictive	Низкий
32	Network Port	xxx xxxxxx xxxx	predictive	Высокий

Ссылки (8)

The following list contains external sources which discuss the actor and the associated activities:

◂ ПредыдущийОбзорДалее ▸

Do you need the next level of professionalism?

Upgrade your account now!