Necurs Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (41)

Lang

en	36
it	2
es	2
fr	2

Land

us	34
fr	6
gb	2

Skådespelare

Necurs	2

Intressera

Typ

Not Defined	8
Content Management System	6
Operating System	4
E-Commerce Management Software	2
Groupware Software	2

Säljare

Cutephp	4
Not Defined	4
Linux	2
ShopStoreNow	2
Thomas R. Pasawicz	2

Produkt

Cutephp CuteNews	4
Linux Kernel	2
ShopStoreNow E-commerce Shopping Cart	2
Thomas R. Pasawicz HyperBook Guestbook	2
WoltLab Burning Book	2

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash informationsgivning	5.3	5.2	$5k-$25k	Beräknande	High	Workaround	0.02016	0.02	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php privilegier eskalering	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.18	CVE-2010-0966
3	Joomla CMS Login sql injektion	9.8	9.8	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00201	0.00	CVE-2006-1047
4	WPFront Scroll Top Plugin Image cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00058	0.02	CVE-2021-24564
5	Francisco Burzi PHP-Nuke Addressbook addressbook.php kataloggenomgång	7.3	7.1	$25k-$100k	$0-$5k	Functional	Unavailable	0.04741	0.00	CVE-2007-1720
6	Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation	8.3	7.3	$100k och mer	$5k-$25k	Unproven	Official Fix	0.00046	0.02	CVE-2021-31969
7	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	3.99
8	Maran PHP Shop prod.php sql injektion	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00137	0.05	CVE-2008-4879
9	DUware DUpaypal detail.asp sql injektion	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00421	0.02	CVE-2006-6365
10	PHP Arena paBugs MySQL class.mysql.php privilegier eskalering	7.3	6.8	$0-$5k	$0-$5k	Functional	Unavailable	0.07369	0.02	CVE-2006-5079
11	ShopStoreNow E-commerce Shopping Cart orange.asp sql injektion	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00811	0.00	CVE-2007-0142
12	Motorola SBG6580 Web Access login förnekande av tjänsten	7.5	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00000	0.00
13	Pixelpost förfalskning på begäran över webbplatsen	7.0	6.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01098	0.02	CVE-2010-3305
14	Check Point VPN-1 UTM Edge Administrator Account WizU.html förfalskning på begäran över webbplatsen	8.8	8.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01277	0.00	CVE-2007-3489
15	Qualcomm Snapdragon Automobile Register privilegier eskalering	5.4	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00044	0.00	CVE-2017-11004
16	WoltLab Burning Book addentry.php sql injektion	7.3	6.8	$0-$5k	$0-$5k	Functional	Unavailable	0.00804	0.02	CVE-2006-5509
17	OpenBB read.php sql injektion	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00248	0.04	CVE-2005-1612
18	lshell privilegier eskalering	8.1	8.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00348	0.01	CVE-2016-6902
19	Wesley Destailleur forum todooforum.php cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00195	0.00	CVE-2013-3538
20	GetSimpleCMS index.php Redirect	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00123	0.00	CVE-2019-9915

IOC - Indicator of Compromise (25)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Identified	Typ	Förtroende
1	40.121.206.97		Necurs	13/06/2021	verified	Hög
2	62.212.154.98	ns1.crossdns.com	Necurs	01/04/2022	verified	Hög
3	64.47.209.23		Necurs	13/06/2021	verified	Hög
4	64.63.188.85		Necurs	13/06/2021	verified	Hög
5	64.231.250.149	bas3-toronto12-64-231-250-149.dsl.bell.ca	Necurs	13/06/2021	verified	Hög
6	XX.XX.XX.XX	xxxxxxxx-xxxxxx.xx.xxx	Xxxxxx	13/06/2021	verified	Hög
7	XX.XXX.XXX.XXX		Xxxxxx	13/06/2021	verified	Hög
8	XX.X.XX.XXX		Xxxxxx	13/06/2021	verified	Hög
9	XX.XX.XXX.XXX	xxxxxxxx.xxxxxxxxxxxxx.xxxx	Xxxxxx	01/04/2022	verified	Hög
10	XX.XXX.XXX.XX		Xxxxxx	13/06/2021	verified	Hög
11	XX.XXX.XX.XX	xxxxxxxxxxxxxxxxxxxxxx.xxx	Xxxxxx	01/04/2022	verified	Hög
12	XX.XXX.XXX.XX	xxx-xxxxxxxx.xxx.xxxxxxxxx.xxx	Xxxxxx	13/06/2021	verified	Hög
13	XX.XX.XXX.XXX	xxx-xx-xxx-xxx.xxx.xxxxxxxxxxxx.xxx	Xxxxxx	13/06/2021	verified	Hög
14	XX.XX.XXX.XXX		Xxxxxx	13/06/2021	verified	Hög
15	XX.XX.XXX.XXX	xxxx-xx-xx-xxx-xxx.xxxxx.xxxx.xxxxxxx.xxx	Xxxxxx	13/06/2021	verified	Hög
16	XX.XX.XX.XXX	xxxx.xxxxxxxxxxxxxx-xxxxx.xx.xx.xxx	Xxxxxx	13/06/2021	verified	Hög
17	XX.XXX.XX.XXX	xx-xxx-xx-xxx.xxx.xxxxx.xxx	Xxxxxx	01/04/2022	verified	Hög
18	XX.XXX.XX.XXX	xxxxx.xxxxxxxxx.xxx	Xxxxxx	01/04/2022	verified	Hög
19	XX.XXX.XX.XXX	xxxxx.xx-xx-xxx-xx.xx	Xxxxxx	06/04/2022	verified	Hög
20	XX.XXX.XXX.XX	xxxxx-xxxxxxxxxxx.xxx	Xxxxxx	01/04/2022	verified	Hög
21	XX.XXX.XXX.XXX	xxxxx-xxxxxxxxxxx.xxx	Xxxxxx	08/04/2022	verified	Hög
22	XXX.XXX.XX.XXX		Xxxxxx	06/04/2022	verified	Hög
23	XXX.XXX.XXX.XX	xxxxxxxxxx.xxx.xxx-xxxxxx.xxx.xx	Xxxxxx	01/04/2022	verified	Hög
24	XXX.XXX.XXX.XX		Xxxxxx	01/04/2022	verified	Hög
25	XXX.XXX.XXX.XXX	xxxxx.xx-xxx-xxx-xxx.xx	Xxxxxx	06/04/2022	verified	Hög

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klass	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Hög
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Hög
3	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Hög
4	TXXXX	CAPEC-19	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
5	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Hög
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Hög
7	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög

IOA - Indicator of Attack (32)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	/forum/away.php	predictive	Hög
2	File	/goform/login	predictive	Hög
3	File	addentry.php	predictive	Medium
4	File	addressbook.php	predictive	Hög
5	File	xxxxx/xxxxx.xxx	predictive	Hög
6	File	xxxxx.xxxxx.xxx	predictive	Hög
7	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Hög
8	File	xxxxxx.xxx	predictive	Medium
9	File	xxxxxx.xxx	predictive	Medium
10	File	xxx/xxxxxx.xxx	predictive	Hög
11	File	xxx/xxxx/xxxx_xxxxxxxxxx_xxxx.x	predictive	Hög
12	File	xxxxxx.xxx	predictive	Medium
13	File	xxx/xxxx.xxxx	predictive	Hög
14	File	xxxx.xxx	predictive	Medium
15	File	xxxx.xxx	predictive	Medium
16	File	xxxxx.xxx	predictive	Medium
17	File	xxxxxxxx.xxx/xxxxxx.xxx/xxxxxxxx.xxx	predictive	Hög
18	File	xxxx_xxxxxxxx.xxx	predictive	Hög
19	File	xxxxxxxxxx.xxx	predictive	Hög
20	Argument	xxxxxxxx	predictive	Medium
21	Argument	xxx	predictive	Låg
22	Argument	xxxxx	predictive	Låg
23	Argument	xxxxxxxx	predictive	Medium
24	Argument	xx	predictive	Låg
25	Argument	xxxx	predictive	Låg
26	Argument	xxxxxx_xxxx	predictive	Medium
27	Argument	xxxx_xx_xx_xxx	predictive	Hög
28	Argument	xx	predictive	Låg
29	Argument	xxxxxxxx	predictive	Medium
30	Argument	xxxxxxxx	predictive	Medium
31	Argument	xxx	predictive	Låg
32	Network Port	xxx xxxxxx xxxx	predictive	Hög

Referenser (5)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Do you need the next level of professionalism?

Upgrade your account now!