CapraRAT Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (35)

Lang

en	28
zh	6
it	2

Land

us	26
cn	8

Skådespelare

CapraRAT	1
Crimson RAT	1

Intressera

Typ

Not Defined	10
Web Server	4
Content Management System	2
Database Software	2
Operating System	2

Säljare

Not Defined	8
Apache	4
D-Link	4
PuneethReddyHC	2
Keenetic	2

Produkt

Apache HTTP Server	4
PuneethReddyHC Event Management	2
Django	2
Pligg	2
Keenetic KN-1010	2

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	h5ai privilegier eskalering	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.03315	0.00	CVE-2015-3203
2	TikiWiki tiki-register.php privilegier eskalering	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01075	5.05	CVE-2006-6168
3	Advanced Guestbook index.php kataloggenomgång	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.04
4	D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi svag autentisering	9.8	9.0	$5k-$25k	$0-$5k	Proof-of-Concept	Workaround	0.01274	0.17	CVE-2024-3272
5	SPIP spip.php cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00132	0.50	CVE-2022-28959
6	Login with Phone Number Plugin Setting cross site scripting	2.4	2.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00058	0.00	CVE-2022-0598
7	Microsoft Windows Remote Desktop Protocol informationsgivning	3.5	3.1	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00043	0.00	CVE-2021-38631
8	Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Configuration Setting ndmComponents.js informationsgivning	5.3	4.9	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00045	7.12	CVE-2024-4021
9	D-Link DIR-865L register_send.php svag autentisering	7.5	7.1	$5k-$25k	$5k-$25k	Proof-of-Concept	Not Defined	0.00109	0.02	CVE-2013-3096
10	Pligg cloud.php sql injektion	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.41
11	PuneethReddyHC Event Management register.php sql injektion	5.5	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.04	CVE-2024-3432
12	Tiki Admin Password tiki-login.php svag autentisering	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	3.06	CVE-2020-15906
13	LushiWarPlaner register.php sql injektion	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00821	0.05	CVE-2007-0864
14	YaBB yabb.pl cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01240	0.04	CVE-2004-2402
15	Django Cache informationsgivning	3.7	3.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00495	0.00	CVE-2014-1418
16	PHP MySQL Admin Panel Generator edit-db.php cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00058	0.02	CVE-2022-28102
17	Microsoft IIS IP/Domain Restriction privilegier eskalering	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00817	0.12	CVE-2014-4078
18	OFCMS uploadFile privilegier eskalering	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00250	0.04	CVE-2019-9617
19	jsoup HTML Parser/XML Parser förnekande av tjänsten	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00640	0.00	CVE-2021-37714
20	Zoom On-Premise Meeting Connector Controller privilegier eskalering	4.7	4.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00219	0.04	CVE-2021-34416

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Identified	Typ	Förtroende
1	34.102.136.180	180.136.102.34.bc.googleusercontent.com	CapraRAT	17/03/2023	verified	Medium
2	XX.XXX.XXX.XX		Xxxxxxxx	17/03/2023	verified	Hög
3	XXX.XXX.XX.XX	xxxxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxxx	17/03/2023	verified	Hög
4	XXX.XX.XXX.XXX	xxxxxxxxx.xxxxxxx.xxx	Xxxxxxxx	17/03/2023	verified	Hög

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klass	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Hög
2	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	Hög
3	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
4	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Hög
5	TXXXX	CAPEC-108	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Hög
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Hög
7	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög
8	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Hög

IOA - Indicator of Attack (22)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	/backend/register.php	predictive	Hög
2	File	/cgi-bin/nas_sharing.cgi	predictive	Hög
3	File	/edit-db.php	predictive	Medium
4	File	/xxxxxxxxxxxxx.xx	predictive	Hög
5	File	/xxxx.xxx	predictive	Medium
6	File	xxxxx/xxxxxxx/xxxxxxxxxx	predictive	Hög
7	File	xxxxx.xxx	predictive	Medium
8	File	xxxxx.xxx	predictive	Medium
9	File	xxxxxxxx.xxx	predictive	Medium
10	File	xxxxxxxx_xxxx.xxx	predictive	Hög
11	File	xxxx-xxxxx.xxx	predictive	Hög
12	File	xxxx-xxxxxxxx.xxx	predictive	Hög
13	File	xxxx.xx	predictive	Låg
14	Argument	xxxxx	predictive	Låg
15	Argument	xxxxxxxxxx	predictive	Medium
16	Argument	xxxxx_xx/xxxx_xxxx/xxxxx/xxxxxx/xxxxxxx/xxxxxx	predictive	Hög
17	Argument	xxxx	predictive	Låg
18	Argument	xx	predictive	Låg
19	Argument	xxxx	predictive	Låg
20	Argument	xxxx	predictive	Låg
21	Input Value	xxxx.xxx::$xxxx	predictive	Hög
22	Input Value	xxxxxxxxxx	predictive	Medium

Referenser (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!