AV Tech Support Scam Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (21)

Lang

en	16
ru	6

Land

cn	12
ru	6
ua	2
pl	2

Skådespelare

AV Tech Support Scam	2
IcedID	1

Intressera

Typ

Not Defined	8
Firewall Software	2
Programming Language Software	2
Operating System	2
Web Browser	2

Säljare

Not Defined	6
Tongda	2
Sangfor	2
FasterXML	2
Linux	2

Produkt

Tongda OA	2
ITFlow	2
Sangfor Next-Gen Application Firewall	2
FasterXML jackson-databind	2
Linux Kernel	2

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	mintplex-labs anything-llm POST privilegier eskalering	7.9	7.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00043	0.04	CVE-2024-0440
2	QNAP QTS/QuTS hero/QuTScloud privilegier eskalering	5.4	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00305	0.04	CVE-2023-47218
3	Tenda AC9 fromSetIpMacBind minneskorruption	8.8	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00043	0.06	CVE-2024-25748
4	DedeCMS article_allowurl_edit.php privilegier eskalering	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00094	0.19	CVE-2023-2928
5	Sangfor Next-Gen Application Firewall loadfile.php informationsgivning	4.7	4.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00113	0.08	CVE-2023-30804
6	Tongda OA delete.php sql injektion	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00063	0.05	CVE-2023-5019
7	ITFlow settings.php cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00045	0.02	CVE-2024-25344
8	Huawei HarmonyOS/EMUI Wi-Fi Module svag autentisering	4.3	4.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00043	0.04	CVE-2022-48621
9	FasterXML jackson-databind privilegier eskalering	6.8	6.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00431	0.06	CVE-2021-20190
10	LG Signage TV webOS privilegier eskalering	6.8	6.8	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00043	0.04	CVE-2024-1885
11	SAP IDES Systems privilegier eskalering	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00043	0.03	CVE-2024-22132
12	Microsoft Windows Media Center MCL File ehshell.exe XML External Entity	6.5	5.9	$100k och mer	$0-$5k	Proof-of-Concept	Unavailable	0.00000	0.00
13	Rarlab UnRAR Unpack kataloggenomgång	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.90549	0.00	CVE-2022-30333
14	Microsoft Intune Management Extension Remote Code Execution	8.1	7.1	$25k-$100k	$0-$5k	Unproven	Official Fix	0.01007	0.00	CVE-2021-31980
15	DevExpress.XtraReports.UI privilegier eskalering	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01502	0.00	CVE-2021-36483
16	MikroTik RouterOS bfd förnekande av tjänsten	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00209	0.00	CVE-2020-20220
17	Linux Kernel Array Access xfrm_user.c __xfrm_policy_unlink informationsgivning	5.9	5.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00045	0.03	CVE-2019-15666
18	Linksys WRT1900ACS Cookie Base64 svag kryptering	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00046	0.03	CVE-2019-7311
19	Google Chrome Blink privilegier eskalering	5.8	5.6	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00119	0.00	CVE-2017-5027
20	PCRE pcregrep informationsgivning	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00469	0.00	CVE-2015-8393

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Identified	Typ	Förtroende
1	68.183.175.204		AV Tech Support Scam	10/01/2019	verified	Hög
2	XXX.XX.XXX.XX		Xx Xxxx Xxxxxxx Xxxx	10/01/2019	verified	Hög
3	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx.xxxxxxxxx.xxxxxxxx.xxx	Xx Xxxx Xxxxxxx Xxxx	10/01/2019	verified	Hög
4	XXX.XXX.XXX.XXX		Xx Xxxx Xxxxxxx Xxxx	10/01/2019	verified	Hög
5	XXX.XXX.XXX.XXX		Xx Xxxx Xxxxxxx Xxxx	10/01/2019	verified	Hög

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klass	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1		CAPEC-10	CWE-20, CWE-119, CWE-121, CWE-125, CWE-287, CWE-306, CWE-404, CWE-476, CWE-502, CWE-610, CWE-611, CWE-918	Unknown Vulnerability	predictive	Hög
2	T1006	CAPEC-126	CWE-21, CWE-22	Path Traversal	predictive	Hög
3	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxxxxxxx Xxxxxxxxx	predictive	Hög
4	TXXXX.XXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxxxx Xxxx Xxxxxxxxx	predictive	Hög
5	TXXXX	CAPEC-19	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
6	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XX, CWE-XXX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Hög
7	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxx Xxxxxxxxx	predictive	Hög
8	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög
9	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Hög

IOA - Indicator of Attack (10)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	/nova/bin/bfd	predictive	Hög
2	File	ehshell.exe	predictive	Medium
3	File	xxxxxxx/xx/xxxxxx/xxxxx_xxxxxxxxxxxxx/xxxxxx.xxx	predictive	Hög
4	File	xxx/xxxx/xxxx_xxxx.x	predictive	Hög
5	File	xxxxxxxx.xxx	predictive	Medium
6	File	xxxx_xxxx/xxxxxxxx.xxx	predictive	Hög
7	File	xxxxxxx/xxxx/xxxxxxx_xxxxxxxx_xxxx.xxx	predictive	Hög
8	Argument	-x	predictive	Låg
9	Argument	xxxxxxx	predictive	Låg
10	Argument	xxxxxxxxxxxxx_xx	predictive	Hög

Referenser (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Interested in the pricing of exploits?

See the underground prices here!