DarkHydrus Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (155)

Lang

en	140
es	10
de	2
zh	2
fr	2

Land

us	146

Skådespelare

DarkHydrus	1
APT33	1
DarkHydrus (.iqy)	1

Intressera

Typ

Not Defined	38
Content Management System	16
Forum Software	4
Groupware Software	2
Chat Software	2

Säljare

Not Defined	32
Tiki	4
EFS	2
Bitrix	2
Thomas R. Pasawicz	2

Produkt

WordPress	4
PHPWind	4
Tiki Wiki CMS Groupware	2
EFS Easy Chat Server	2
Tiki	2

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash informationsgivning	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php privilegier eskalering	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.25	CVE-2010-0966
3	Tiki Admin Password tiki-login.php svag autentisering	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	5.03	CVE-2020-15906
4	PHP phpinfo cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02101	0.04	CVE-2007-1287
5	TikiWiki tiki-register.php privilegier eskalering	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01075	1.87	CVE-2006-6168
6	jforum User privilegier eskalering	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00289	0.05	CVE-2019-7550
7	JForum jforum.page förfalskning på begäran över webbplatsen	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00173	0.02	CVE-2022-26173
8	Responsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit cross site scripting	3.2	3.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00073	0.04	CVE-2018-25085
9	Tiki Wiki CMS Groupware tiki-edit_wiki_section.php cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00110	0.00	CVE-2010-4240
10	PHP Link Directory Administration Page index.html cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00374	1.10	CVE-2007-0529
11	Smartisoft phpBazar classified_right.php privilegier eskalering	6.5	6.2	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00933	0.03	CVE-2006-2528
12	JForum Login privilegier eskalering	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00151	0.06	CVE-2012-5338
13	cpCommerce register.php cross site scripting	4.3	4.2	$0-$5k	$0-$5k	High	Unavailable	0.00641	0.03	CVE-2007-2968
14	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	3.26
15	Pligg cloud.php sql injektion	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.67
16	PHPWind goto.php Redirect	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00348	0.14	CVE-2015-4134
17	Advisto Peel SHOPPING caddie_ajout.php förfalskning på begäran över webbplatsen	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00118	0.04	CVE-2018-20848
18	Lars Ellingsen Guestserver guestbook.cgi cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00169	0.24	CVE-2005-4222
19	Serendipity exit.php privilegier eskalering	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.53
20	Bitrix Site Manager redirect.php privilegier eskalering	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00113	0.03	CVE-2008-2052

Kampanjer (1)

These are the campaigns that can be associated with the actor:

DarkHydrus

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Kampanjer	Identified	Typ	Förtroende
1	94.130.88.9	cm16.debounce.io	DarkHydrus		22/12/2020	verified	Hög
2	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxxxxxxxx		29/08/2021	verified	Hög
3	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxxxxxxxx		16/12/2020	verified	Hög
4	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx.xxx.xxxxxxxxxxxx.xx	Xxxxxxxxxx		16/12/2020	verified	Hög
5	XXX.XX.XXX.XXX	xxxxxxxx-xx-xxxx.xxxxx.xxx	Xxxxxxxxxx	Xxxxxxxxxx	22/12/2020	verified	Hög

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klass	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1		CAPEC-10	CWE-20, CWE-59, CWE-73, CWE-119, CWE-189, CWE-287, CWE-352, CWE-369, CWE-399, CWE-400, CWE-404, CWE-416, CWE-862, CWE-863	Unknown Vulnerability	predictive	Hög
2	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Hög
3	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxxxxxxx Xxxxxxxxx	predictive	Hög
4	TXXXX.XXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XX, CWE-XXX	Xxxxx Xxxx Xxxxxxxxx	predictive	Hög
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
6	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Hög
7	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxx Xxxxxxxxx	predictive	Hög
8	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög
9	TXXXX.XXX	CAPEC-112	CWE-XXX, CWE-XXX, CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Hög

IOA - Indicator of Attack (76)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	/etc/sudoers	predictive	Medium
2	File	/forum/away.php	predictive	Hög
3	File	/obs/book.php	predictive	Hög
4	File	/opt/IBM/es/lib/libffq.cryptionjni.so	predictive	Hög
5	File	/register.do	predictive	Medium
6	File	4.3.0.CP04	predictive	Medium
7	File	adclick.php	predictive	Medium
8	File	addentry.php	predictive	Medium
9	File	add_comment.php	predictive	Hög
10	File	book.php	predictive	Medium
11	File	xxxxxxxxxx_xxxxx.xxx	predictive	Hög
12	File	xxxxx.xxx	predictive	Medium
13	File	xxxxxx/xxx.x	predictive	Medium
14	File	xxxxxxx_xxx.xxx	predictive	Hög
15	File	xxxxxx.xxx	predictive	Medium
16	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Hög
17	File	xxxxxxxx.xxx	predictive	Medium
18	File	xxxxx.xxx	predictive	Medium
19	File	xx/xxxxx/xxxxxx_xxxxx.xxx	predictive	Hög
20	File	xxxx.xxx	predictive	Medium
21	File	xxxx.xxx	predictive	Medium
22	File	xxxxxxxxx.xxx	predictive	Hög
23	File	xx/xxxxxxx/xxxxxx_xxx.x	predictive	Hög
24	File	xxx/xxxxxx.xxx	predictive	Hög
25	File	xxxxx.xxxx	predictive	Medium
26	File	xxxxx.xxx	predictive	Medium
27	File	xxxxxx.xxxx	predictive	Medium
28	File	xxx/xxxx/xxx.x	predictive	Hög
29	File	xxxxxxxxx.x	predictive	Medium
30	File	xxxx.xxx	predictive	Medium
31	File	xxxxx.xxx	predictive	Medium
32	File	xxxxxxxx.xxx	predictive	Medium
33	File	xxxxxxxx.xxx	predictive	Medium
34	File	xxxxxxxx.xx	predictive	Medium
35	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	Hög
36	File	xxxxxxxx_xxxxxx.xxx	predictive	Hög
37	File	xxxxxxxxxx_xxxxx.xxxxxx	predictive	Hög
38	File	xxxxxxxxxxxxxx.xxx	predictive	Hög
39	File	xxxxxx-xxxx/xxx/xxxx/xxxx/xxx/xxxxxx/xxxxxxxxxxxx.xxxx	predictive	Hög
40	File	xxxx-xxxxxxxx.xxx	predictive	Hög
41	File	xxxx-xxxx_xxxx_xxxxxxx.xxx	predictive	Hög
42	File	xxxx-xxxxx.xxx	predictive	Hög
43	File	xxxx-xxxxxxxx.xxx	predictive	Hög
44	File	xxxx/xxxxxxxx.xxx	predictive	Hög
45	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	Hög
46	File	xx-xxxxx.xxx	predictive	Medium
47	File	xx-xxxxxxxx.xxx	predictive	Hög
48	Library	xxxx/xxx/xxxxxx/xx-xxxx-xxxxxx.xxx	predictive	Hög
49	Library	xxx/xxx/xx/xxx/xxxxxx.xxxxxxxxxxx.xx	predictive	Hög
50	Argument	$xxxx	predictive	Låg
51	Argument	xxxxxxxxxx	predictive	Medium
52	Argument	xxxxxxxx	predictive	Medium
53	Argument	xxxxxxxx	predictive	Medium
54	Argument	xxxxxxxx	predictive	Medium
55	Argument	xxxx_xxxx	predictive	Medium
56	Argument	xxxxxxxxxx	predictive	Medium
57	Argument	xxxxxx	predictive	Låg
58	Argument	xxxxxxxxx[x]	predictive	Medium
59	Argument	xx_xx_xxxx_xxxx	predictive	Hög
60	Argument	xxxx	predictive	Låg
61	Argument	xxxx	predictive	Låg
62	Argument	xxxxxx/xxxxx	predictive	Medium
63	Argument	xx	predictive	Låg
64	Argument	xxxxxxxx_xxx	predictive	Medium
65	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	Hög
66	Argument	xxxx	predictive	Låg
67	Argument	xxxxxxxxxxxxxxx	predictive	Hög
68	Argument	xxxxx	predictive	Låg
69	Argument	xx_xxxx	predictive	Låg
70	Argument	xxxxxxxxxx	predictive	Medium
71	Argument	xx	predictive	Låg
72	Argument	xxx	predictive	Låg
73	Argument	xxxx	predictive	Låg
74	Argument	xxx	predictive	Låg
75	Argument	xxxxxxxx/xxxxxxxx	predictive	Hög
76	Argument	xxxx_xxxxx	predictive	Medium

Referenser (5)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Interested in the pricing of exploits?

See the underground prices here!