MATA Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (323)

Lang

en	258
zh	40
de	10
fr	8
pl	4

Land

la	212
us	52
cn	20
gb	18
me	12

Skådespelare

Cobalt Strike	15
Ave Maria	10
Lazarus	8
RedLine Stealer	7
MATA	6

Intressera

Typ

Not Defined	102
Content Management System	30
Operating System	20
Application Server Software	12
Programming Language Software	10

Säljare

Not Defined	124
Microsoft	28
Apache	6
SensioLabs	4
Fortinet	4

Produkt

Microsoft Windows	16
WordPress	8
SensioLabs Symfony	4
PHP	4
mysql2	4

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	TikiWiki tiki-register.php privilegier eskalering	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01075	1.35	CVE-2006-6168
2	Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 privilegier eskalering	5.3	5.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00047	0.04	CVE-2023-1453
3	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	2.39
4	Tiki Admin Password tiki-login.php svag autentisering	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	4.13	CVE-2020-15906
5	WordPress AdServe adclick.php sql injektion	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00073	0.08	CVE-2008-0507
6	Primetek Primefaces svag kryptering	8.5	8.3	$0-$5k	$0-$5k	High	Not Defined	0.97013	0.00	CVE-2017-1000486
7	Drupal Sanitization API cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00056	0.02	CVE-2020-13672
8	Microsoft Windows HMAC Key Derivation Local Privilege Escalation	8.8	8.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00048	0.03	CVE-2023-36400
9	LiteSpeed Cache Plugin Shortcode cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00051	0.03	CVE-2023-4372
10	WebTitan Appliance Extensions Persistent cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
11	ipTIME NAS-I Bulletin Manage privilegier eskalering	7.1	7.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00988	0.03	CVE-2020-7847
12	RARLabs WinRAR ZIP Archive Remote Code Execution	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.44373	0.03	CVE-2023-38831
13	request-baskets API Request {name} privilegier eskalering	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.08109	0.00	CVE-2023-27163
14	DZCP deV!L`z Clanportal config.php privilegier eskalering	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.74	CVE-2010-0966
15	PHP phpinfo cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02101	0.04	CVE-2007-1287
16	nginx privilegier eskalering	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	3.74	CVE-2020-12440
17	Microsoft Windows Scripting Engine Remote Code Execution	5.9	5.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.37113	0.00	CVE-2021-34480
18	NotificationX Plugin SQL Statement sql injektion	5.6	5.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02414	0.04	CVE-2022-0349
19	DevExpress ASP.NET Web Forms ASPxHttpHandlerModule DXR.axd privilegier eskalering	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00183	0.04	CVE-2022-41479
20	Basilix Webmail login.php3 privilegier eskalering	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.02

IOC - Indicator of Compromise (19)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Identified	Typ	Förtroende
1	2.4.17.15	lfbn-mon-1-592-15.w2-4.abo.wanadoo.fr	Mata	25/07/2020	verified	Hög
2	23.227.199.53	23-227-199-53.static.hvvc.us	MATA	31/03/2022	verified	Hög
3	23.227.199.69	23-227-199-69.static.hvvc.us	MATA	31/03/2022	verified	Hög
4	23.254.119.12		MATA	31/03/2022	verified	Hög
5	XX.XX.XXX.XXX		Xxxx	31/03/2022	verified	Hög
6	XX.XXX.XXX.XX		Xxxx	31/03/2022	verified	Hög
7	XXX.XXX.XX.X		Xxxx	31/03/2022	verified	Hög
8	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxx	31/03/2022	verified	Hög
9	XXX.XXX.XX.XX	xxxxxxx.xxx-xxxxxxxxxxx.xxxx	Xxxx	31/03/2022	verified	Hög
10	XXX.XX.XXX.XXX	xxxx.xxxxxxxxxxxxxxxxxxxxx.xxx	Xxxx	31/03/2022	verified	Hög
11	XXX.XX.XXX.XXX	xxxxxxx.xxxxx.xx	Xxxx	31/03/2022	verified	Hög
12	XXX.XX.XXX.XX	xx-xxx-xx-xxx-xx.xxxx.xxxxxxxxx.xxx	Xxxx	31/03/2022	verified	Hög
13	XXX.XX.XXX.XX		Xxxx	31/03/2022	verified	Hög
14	XXX.XX.XXX.XXX	xxx-xxx-xx-xxx.xxxxxxx-xxx	Xxxx	31/03/2022	verified	Hög
15	XXX.XX.XX.XXX		Xxxx	31/03/2022	verified	Hög
16	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx	Xxxx	31/03/2022	verified	Hög
17	XXX.XXX.XXX.X		Xxxx	31/03/2022	verified	Hög
18	XXX.XX.XXX.XX	xxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxx.xxx	Xxxx	31/03/2022	verified	Hög
19	XXX.XXX.XX.XXX	xxxxxxx.xx-xxxx-xxx-xxxx.xxx	Xxxx	31/03/2022	verified	Hög

TTP - Tactics, Techniques, Procedures (20)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klass	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1	T1006	CAPEC-126	CWE-21, CWE-22, CWE-24	Path Traversal	predictive	Hög
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Hög
3	T1059	CAPEC-137	CWE-88, CWE-94, CWE-1321	Argument Injection	predictive	Hög
4	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	Hög
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
6	TXXXX.XXX	CAPEC-16	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Hög
7	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Hög
8	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Hög
9	TXXXX	CAPEC-0	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Hög
10	TXXXX	CAPEC-1	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Hög
11	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Hög
12	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Hög
13	TXXXX	CAPEC-112	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
14	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
15	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	Hög
16	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög
17	TXXXX.XXX	CAPEC-0	CWE-XX	Xxxxxxxxxxxxx	predictive	Hög
18	TXXXX	CAPEC-112	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Hög
19	TXXXX.XXX	CAPEC-0	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Hög
20	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Hög

IOA - Indicator of Attack (172)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	/admin/dl_sendmail.php	predictive	Hög
2	File	/adminPage/conf/reload	predictive	Hög
3	File	/api/baskets/{name}	predictive	Hög
4	File	/api/v2/cli/commands	predictive	Hög
5	File	/Device/Device/GetDeviceInfoList?deviceCode=&searchField=&deviceState=	predictive	Hög
6	File	/DXR.axd	predictive	Medium
7	File	/forum/away.php	predictive	Hög
8	File	/mfsNotice/page	predictive	Hög
9	File	/novel/bookSetting/list	predictive	Hög
10	File	/novel/userFeedback/list	predictive	Hög
11	File	/out.php	predictive	Medium
12	File	/owa/auth/logon.aspx	predictive	Hög
13	File	/phppath/php	predictive	Medium
14	File	/spip.php	predictive	Medium
15	File	/systemrw/	predictive	Medium
16	File	/x_portal_assemble_surface/jaxrs/portal/list?v=8.2.3-4-43f4fe3	predictive	Hög
17	File	/zm/index.php	predictive	Hög
18	File	adclick.php	predictive	Medium
19	File	admin.jcomments.php	predictive	Hög
20	File	admin/gv_mail.php	predictive	Hög
21	File	application/modules/admin/views/ecommerce/products.php	predictive	Hög
22	File	xxxx/xxxxxxxxxxxx.xxx	predictive	Hög
23	File	xxxx.xxx	predictive	Medium
24	File	xx_xxxx_xx_xxxx_xxxx.xxx	predictive	Hög
25	File	xxxx_xxxxxxx.xxx	predictive	Hög
26	File	xxxxxxxx.xxx	predictive	Medium
27	File	xxxxxx.xxx	predictive	Medium
28	File	xxxxx.xxx	predictive	Medium
29	File	xxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxx/xxxx_xxxxx.xxxx	predictive	Hög
30	File	xxxxx-xxxxxxx.xxx	predictive	Hög
31	File	xxxxxxxxxx/xxx_xxxxxxxxxx/xxxxxxx/xxxxxxxxxx.xxx	predictive	Hög
32	File	xxxxxxxxxx\xxxx.xxx	predictive	Hög
33	File	xxxxxxxxxxx.xxx	predictive	Hög
34	File	xxxx-xxxxxx.xxx	predictive	Hög
35	File	xxxx.xxx	predictive	Medium
36	File	xxx/xxxx/xxxx_xxxxxx.x	predictive	Hög
37	File	xxxxxxxxxxx.xxxxx.xxx	predictive	Hög
38	File	xxxxxxx.xxx	predictive	Medium
39	File	xxxxx.xxx	predictive	Medium
40	File	xxxx.xxx	predictive	Medium
41	File	xxxxx_xxxx.xxx	predictive	Hög
42	File	xxxxxxxxxx\xxxxxx\xxxxxxxxxxxxx.xxx	predictive	Hög
43	File	xxx/xxxxxx.xxx	predictive	Hög
44	File	xxxxxxxx/xxxxxxx/xxxxxxx.xxxx.xxx	predictive	Hög
45	File	xxxxx.xxxx	predictive	Medium
46	File	xxxxx.xxx	predictive	Medium
47	File	xxxxx.xxx/xxxxxx.xxx/xxxxxxxxxxxxx.xxx/xxxxxxxx.xxx	predictive	Hög
48	File	xxxxx.xxx?x=xxxx&x=xxxx&x=xx_xxx_xxxxxx	predictive	Hög
49	File	xxxxx.xxx?x=xxxx&x=xxxxxxx&x=xxx	predictive	Hög
50	File	xxxxxxxx/xxxxxxxx_xxxxxxx_xxxxxx/xxxxx.xxx	predictive	Hög
51	File	xxxx_xxxx.xxx	predictive	Hög
52	File	xxxx_xxxxxxx.xxx	predictive	Hög
53	File	xxxxx.xxxx	predictive	Medium
54	File	xxxxx.xxx	predictive	Medium
55	File	xxxx.xxxx	predictive	Medium
56	File	xxxxxx/xxxxxxxxx.xxx	predictive	Hög
57	File	xx_xxxx.x	predictive	Medium
58	File	xxx/xxxx/xxxx_xxxxxxxxx.x	predictive	Hög
59	File	xxxxxxx_xxxx.xxx	predictive	Hög
60	File	xxxxxxxxxxxxxxxxx.xxx	predictive	Hög
61	File	xxxxx_xxxxxx_xxxxxxxx.xxx	predictive	Hög
62	File	xxxxxxx.xxx	predictive	Medium
63	File	xxxxxxxxxxxxx.xxx	predictive	Hög
64	File	xxxxxxxxxxxx.xxx	predictive	Hög
65	File	xxxxxxx/xxxxxxx/xxx/xxxxxxxxxx.xxx?xxxxxxxx=xxxx&xxxxxx=xxxxxxxxxx	predictive	Hög
66	File	xxxxx.xxx	predictive	Medium
67	File	xxxx.xxx	predictive	Medium
68	File	xxxxxxxx.xxx	predictive	Medium
69	File	xxxxxxxxxx.xxx	predictive	Hög
70	File	xxxxxxxx.xx	predictive	Medium
71	File	xxxx_xxxx_xxxxxx.xxx	predictive	Hög
72	File	xxxxxxxxxxxxxx.xxx	predictive	Hög
73	File	xxxx_xxxxxxx_xxxxxxxx.xxx	predictive	Hög
74	File	xxxx_xxxxx.xxxx	predictive	Hög
75	File	xxxxxxxxxx_xxxx.xxx	predictive	Hög
76	File	xxx/xxxx/xxxx	predictive	Hög
77	File	xxxxxx\xxxxxxxx\xx_xxxxx_xxxxxxx.xxx	predictive	Hög
78	File	xxxxxxx.xxx.xx.xxxxxxxxxxx.xxx	predictive	Hög
79	File	xxxxxxxxx/xxxxxxxx.xxx	predictive	Hög
80	File	xxxx_xxxxxx.xx	predictive	Hög
81	File	xxxx-xxxxx.xxx	predictive	Hög
82	File	xxxx-xxxxxxxx.xxx	predictive	Hög
83	File	xxxxxx_xxxxx.xxx	predictive	Hög
84	File	xxxxxx.xxx	predictive	Medium
85	File	xxx.xxx	predictive	Låg
86	File	xxxxxxx-xxxxx.xxx	predictive	Hög
87	File	xxxx_xxxxx.xxx	predictive	Hög
88	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	Hög
89	File	xxxx.xxx	predictive	Medium
90	File	xxxxxxxx.xxx	predictive	Medium
91	File	xxxxxxxxx.xxx	predictive	Hög
92	File	xx-xxxxx-xxxxxx.xxx	predictive	Hög
93	File	xx-xxxxxxxx/xxxx.xxx	predictive	Hög
94	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	Hög
95	File	xx-xxxxxxxxx.xxx	predictive	Hög
96	File	xxx/xxxxxxxx/xxxxxxxx.xxx	predictive	Hög
97	File	xxxx.xxx	predictive	Medium
98	File	_xxxxxxxx/xxxx?xxxx	predictive	Hög
99	File	~/xxx/xxxx-xxxxxxxxx.xxx	predictive	Hög
100	File	~/xxxxxxxx/xxxxx-xx-xxxxxxxxxx-xxxxxxxxx.xxx	predictive	Hög
101	Library	xxxxxx.xxx	predictive	Medium
102	Library	xxxxxx.xxx	predictive	Medium
103	Library	xxxxxx.xxx	predictive	Medium
104	Library	xxxxxxx/xxx.xxx.xxx.xxx	predictive	Hög
105	Library	xxxx-xxxxxx.xxx	predictive	Hög
106	Argument	xxx_xxx	predictive	Låg
107	Argument	xxxx	predictive	Låg
108	Argument	xxxxxxxxx	predictive	Medium
109	Argument	xxxxxxxx	predictive	Medium
110	Argument	xxx_xxx_xx_xxx_xxxxxxxxxx_x	predictive	Hög
111	Argument	xxxxx_xxxx	predictive	Medium
112	Argument	xxxx_xxx_xxxx	predictive	Hög
113	Argument	xxx	predictive	Låg
114	Argument	xxxxxxxxx	predictive	Medium
115	Argument	xxxxxxxxxx	predictive	Medium
116	Argument	xxx_xx	predictive	Låg
117	Argument	xxx	predictive	Låg
118	Argument	xxx	predictive	Låg
119	Argument	xxxxxxxxxxxxxxx	predictive	Hög
120	Argument	xxxx_xx	predictive	Låg
121	Argument	xxx	predictive	Låg
122	Argument	xxxx	predictive	Låg
123	Argument	xxxxxxxxx_xxxxxx	predictive	Hög
124	Argument	xxxxxxxxx	predictive	Medium
125	Argument	xx_xxxxxxx	predictive	Medium
126	Argument	xxxx	predictive	Låg
127	Argument	xxxxxxxx	predictive	Medium
128	Argument	xxxxx	predictive	Låg
129	Argument	xxxxxx_xxxxx	predictive	Medium
130	Argument	xxxxxxxxx	predictive	Medium
131	Argument	xx_xx	predictive	Låg
132	Argument	xxxxxxx[xxxxxxx]	predictive	Hög
133	Argument	xxxxxxx	predictive	Låg
134	Argument	xxxxxx	predictive	Låg
135	Argument	xxxxx	predictive	Låg
136	Argument	xx	predictive	Låg
137	Argument	xxx	predictive	Låg
138	Argument	xxxx	predictive	Låg
139	Argument	xxxx	predictive	Låg
140	Argument	xxxx/xxxxxxxx	predictive	Hög
141	Argument	xxx xxxxxxxx/xxxxxxx xxxxxxxx	predictive	Hög
142	Argument	xxxxxxxx	predictive	Medium
143	Argument	xx_xx	predictive	Låg
144	Argument	xxxxxx/xxxxx/xxxx	predictive	Hög
145	Argument	xxxxxxx	predictive	Låg
146	Argument	xxxxxxx	predictive	Låg
147	Argument	xxxx	predictive	Låg
148	Argument	xxxxxxxx	predictive	Medium
149	Argument	xxxxxx_xxxxxx	predictive	Hög
150	Argument	xxxxxxxx_xx	predictive	Medium
151	Argument	xxxxxxxx_xxx	predictive	Medium
152	Argument	xxxxxx_xxxxx	predictive	Medium
153	Argument	xxx	predictive	Låg
154	Argument	xxxx_xxxx	predictive	Medium
155	Argument	xxxx	predictive	Låg
156	Argument	xxxxxx	predictive	Låg
157	Argument	xxxxxxx	predictive	Låg
158	Argument	xxx_xxxx	predictive	Medium
159	Argument	xxx	predictive	Låg
160	Argument	xx_xx	predictive	Låg
161	Argument	xxxxx	predictive	Låg
162	Argument	xxxxx_xx	predictive	Medium
163	Argument	xxx	predictive	Låg
164	Argument	xxxxxx	predictive	Låg
165	Argument	xxxxxxxx	predictive	Medium
166	Argument	_xxx_xxxxxxxxxxx_	predictive	Hög
167	Input Value	<xxxxxx >xxxxx(xxx)</xxxxxx>	predictive	Hög
168	Input Value	xxxxxxxxx' xxx 'x'='x	predictive	Hög
169	Input Value	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx	predictive	Hög
170	Pattern	\|xx xx xx xx\|	predictive	Hög
171	Network Port	xxxxx	predictive	Låg
172	Network Port	xxx/xxxxx	predictive	Medium

Referenser (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Do you need the next level of professionalism?

Upgrade your account now!