FunkyBot Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (53)

Lang

zh	34
en	20

Land

cn	44
us	10

Skådespelare

Cobalt Strike	1
FunkyBot	1

Intressera

Typ

SSH Server Software	16
Not Defined	12
Application Server Software	2
Operating System	2
Remote Access Software	2

Säljare

Not Defined	16
Matt Johnston	4
Apache	2
Microsoft	2
SolarWinds	2

Produkt

Dropbear	6
Dropbear SSH	4
Matt Johnston Dropbear SSH Server	4
Apache Tomcat	2
BusyBox	2

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash informationsgivning	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	Dropbear informationsgivning	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00084	0.02	CVE-2019-12953
3	Mofi Network MOFI4500-4GXeLTE Dropbear SSH Daemon rom privilegier eskalering	7.6	7.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00225	0.00	CVE-2020-15833
4	Dropbear Filename scp.c Privilege Escalation	6.8	6.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00222	0.04	CVE-2020-36254
5	Apache RocketMQ Update Configuration privilegier eskalering	8.0	8.0	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.97312	0.03	CVE-2023-33246
6	Apache Tomcat Form Authentication Example cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00109	0.02	CVE-2022-34305
7	BusyBox awk Applet minneskorruption	5.9	5.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00236	0.00	CVE-2021-42386
8	Vivotek FD8136 Busybox/wget privilegier eskalering	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00327	0.03	CVE-2018-14494
9	BusyBox gzip Data decompress_gunzip.c huft_build privilegier eskalering	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00767	0.04	CVE-2021-28831
10	BusyBox man Applet förnekande av tjänsten	5.5	5.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00045	0.00	CVE-2021-42373
11	BusyBox unlzma Applet informationsgivning	7.3	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00123	0.03	CVE-2021-42374
12	BusyBox ash Applet förnekande av tjänsten	5.5	5.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00045	0.04	CVE-2021-42375
13	BusyBox netstat Privilege Escalation	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01132	0.03	CVE-2022-28391
14	BusyBox awk Applet copyvar minneskorruption	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00067	0.04	CVE-2022-30065
15	Hikvision Hybrid SAN Web Module privilegier eskalering	8.2	8.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.26770	0.00	CVE-2022-28171
16	Matt Johnston Dropbear SSH Server förnekande av tjänsten	9.9	9.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01032	0.02	CVE-2012-0920
17	Dropbear SSH Shell Command Restriction privilegier eskalering	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02835	0.04	CVE-2016-3116
18	Dropbear SSH dropbearconvert privilegier eskalering	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00956	0.02	CVE-2016-7407
19	Dropbear SSH dbclient privilegier eskalering	7.1	6.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00940	0.02	CVE-2016-7408
20	Dropbear SSH dbclient/server Memory informationsgivning	4.4	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00042	0.01	CVE-2016-7409

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Identified	Typ	Förtroende
1	6.43.51.17		FunkyBot	05/09/2019	verified	Hög
2	XXX.XX.XXX.XXX	xxx.xx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxx	05/09/2019	verified	Hög
3	XXX.XX.XX.XXX		Xxxxxxxx	05/09/2019	verified	Hög

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klass	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1		CAPEC-10	CWE-20, CWE-74, CWE-93, CWE-119, CWE-125, CWE-287, CWE-399, CWE-404, CWE-415, CWE-416, CWE-476, CWE-610, CWE-611, CWE-707, CWE-755	Unknown Vulnerability	predictive	Hög
2	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Hög
3	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxxxxxxx Xxxxxxxxx	predictive	Hög
4	TXXXX.XXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XX, CWE-XXX	Xxxxx Xxxx Xxxxxxxxx	predictive	Hög
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
6	TXXXX.XXX	CAPEC-191	CWE-XXX, CWE-XXX, CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Hög
7	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XX, CWE-XXX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Hög
8	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxx Xxxxxxxxx	predictive	Hög
9	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög

IOA - Indicator of Attack (21)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	/.ssh/authorized_keys	predictive	Hög
2	File	/rom	predictive	Låg
3	File	data/gbconfiguration.dat	predictive	Hög
4	File	xxxxxxxxxx_xxxxxx.x	predictive	Hög
5	File	xxxxx.xxx	predictive	Medium
6	File	xxxxxxx/xxxx.xxxxx.xxx	predictive	Hög
7	File	xxx_xxxx.xxx	predictive	Medium
8	File	xxx.x	predictive	Låg
9	File	xxxx_xxxxxxx.x	predictive	Hög
10	File	xxx-xxxx.x	predictive	Medium
11	File	xxxxxx.xxx	predictive	Medium
12	Argument	$xxxxxxx	predictive	Medium
13	Argument	-x/-x	predictive	Låg
14	Argument	-x	predictive	Låg
15	Argument	xxxxxxx	predictive	Låg
16	Argument	xxxx	predictive	Låg
17	Argument	xxxxxx	predictive	Låg
18	Argument	xxxxxxxx/xxxx	predictive	Hög
19	Argument	xxxxxxxx/xxxxxxxx	predictive	Hög
20	Input Value	xxxx:xxxxxx	predictive	Medium
21	Network Port	xxx/xx (xxx)	predictive	Medium

Referenser (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!