Rancor Analys

IOB - Indicator of Behavior (906)

Tidslinje

Lang

it168
pl168
fr158
sv154
en128

Land

us890
cn10
vn6

Skådespelare

Aktiviteter

Intressera

Tidslinje

Typ

Säljare

Produkt

Microsoft Internet Explorer16
ownCloud16
FFmpeg14
Mozilla Firefox14
Apple Mac OS X12

Sårbarheter

#SårbarhetBaseTemp0dayI dagUtnRemEPSSCTICVE
1TikiWiki tiki-register.php privilegier eskalering7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.010751.90CVE-2006-6168
2Boa Webserver GET wapopen kataloggenomgång6.46.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.735400.09CVE-2017-9833
3Anti-Web write.cgi kataloggenomgång7.27.2$0-$5k$0-$5kNot DefinedNot Defined0.007020.02CVE-2017-9097
4mpg123 MP3 File id3.c next_text minneskorruption4.44.4$0-$5k$0-$5kNot DefinedNot Defined0.001770.00CVE-2017-9545
5LogicBoard CMS away.php Redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable0.000003.23
6Clash Configuration File cfw-setting.yaml privilegier eskalering8.08.0$0-$5k$0-$5kNot DefinedNot Defined0.003890.00CVE-2023-24205
7Lenovo X Server FFDC Service Log privilegier eskalering5.45.4$0-$5k$0-$5kNot DefinedNot Defined0.000600.00CVE-2017-3744
8DZCP deV!L`z Clanportal config.php privilegier eskalering7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.009431.23CVE-2010-0966
9Synacor Zimbra Collaboration XML External Entity8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.004410.02CVE-2016-9924
10e-Quick Cart shopprojectlogin.asp sql injektion6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.000000.04
11Tiki Admin Password tiki-login.php svag autentisering8.07.7$0-$5k$0-$5kNot DefinedOfficial Fix0.009364.80CVE-2020-15906
12Pligg cloud.php sql injektion6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.000000.71
13vBulletin redirector.php Redirect6.66.6$0-$5k$0-$5kNot DefinedNot Defined0.001220.07CVE-2018-6200
14phpPgAds adclick.php okänd sårbarhet5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.003171.66CVE-2005-3791
15Google Android SDK Platform Tools Signedness adb_client.c adb_connect minneskorruption8.88.3$100k och mer$0-$5kProof-of-ConceptOfficial Fix0.000000.00
16Netgear D6300B Credential Storage nvram svag kryptering5.44.6$5k-$25k$0-$5kProof-of-ConceptWorkaround0.000000.00
17OpenStack Keystone privilegier eskalering5.35.1$0-$5k$0-$5kNot DefinedOfficial Fix0.011660.00CVE-2013-2014
18Sensysnetworks TrafficDOT privilegier eskalering8.37.9$0-$5k$0-$5kNot DefinedOfficial Fix0.008280.00CVE-2014-2378
19Cws sahab-alkher.com X.509 Certificate svag kryptering6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.000490.00CVE-2014-7052
20Appbasedtechnologies Belaire Family Orthodontics X.509 Certificate svag kryptering6.36.3$0-$5kBeräknandeNot DefinedNot Defined0.000490.00CVE-2014-7405

Kampanjer (1)

These are the campaigns that can be associated with the actor:

  • PLAINTEE/DDKONG

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (18)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueKlassSårbarheterÅtkomstvektorTypFörtroende
1CAPEC-10CWE-17, CWE-19, CWE-20, CWE-59, CWE-119, CWE-125, CWE-170, CWE-189, CWE-192, CWE-266, CWE-275, CWE-287, CWE-352, CWE-362, CWE-384, CWE-399, CWE-400, CWE-401, CWE-404, CWE-415, CWE-416, CWE-610, CWE-611, CWE-732, CWE-862, CWE-863, CWE-908, CWE-918Unknown VulnerabilitypredictiveHög
2T1006CAPEC-126CWE-22Path TraversalpredictiveHög
3T1055CAPEC-10CWE-74, CWE-707Improper Neutralization of Data within XPath ExpressionspredictiveHög
4T1059CAPEC-10CWE-74, CWE-94, CWE-707Argument InjectionpredictiveHög
5TXXXX.XXXCAPEC-10CWE-XX, CWE-XX, CWE-XX, CWE-XXXXxxxx Xxxx XxxxxxxxxpredictiveHög
6TXXXXCAPEC-122CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHög
7TXXXX.XXXCAPEC-0CWE-XXX, CWE-XXXXxx Xx Xxxx-xxxxx XxxxxxxxpredictiveHög
8TXXXX.XXXCAPEC-191CWE-XXX, CWE-XXX, CWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveHög
9TXXXXCAPEC-10CWE-XX, CWE-XX, CWE-XX, CWE-XXXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveHög
10TXXXX.XXXCAPEC-178CWE-XXXXxxx XxxxxxxxpredictiveHög
11TXXXXCAPEC-0CWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveHög
12TXXXXCAPEC-10CWE-XX, CWE-XX, CWE-XX, CWE-XXXXxx XxxxxxxxxpredictiveHög
13TXXXXCAPEC-0CWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveHög
14TXXXXCAPEC-37CWE-XXX, CWE-XXXXxxxxxxxx Xxxxxxx Xx Xxxxxxxxx XxxxxxxxxxxpredictiveHög
15TXXXX.XXXCAPEC-133CWE-XXXXxxxxxxxpredictiveHög
16TXXXXCAPEC-116CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveHög
17TXXXXCAPEC-157CWE-XXX, CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveHög
18TXXXX.XXXCAPEC-19CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveHög

IOA - Indicator of Attack (230)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlassIndicatorTypFörtroende
1File/bin/login.phppredictiveHög
2File/cgi-bin/wapopenpredictiveHög
3File/cgi/cpaddons_feature.plpredictiveHög
4File/data/nvrampredictiveMedium
5File/forum/away.phppredictiveHög
6File/frontend/x3/cpanelpro/filelist-thumbs.htmlpredictiveHög
7File/fs/cifs/file.cpredictiveHög
8File/goform/loginpredictiveHög
9File/horde/util/go.phppredictiveHög
10File/mib.dbpredictiveLåg
11File/modules/profile/index.phppredictiveHög
12File/OA_HTML/cabo/jsps/a.jsppredictiveHög
13File/out.phppredictiveMedium
14File/system/site.phppredictiveHög
15Fileadb/adb_client.cpredictiveHög
16Fileadclick.phppredictiveMedium
17Fileadd_comment.phppredictiveHög
18Fileadelogs.adobe.compredictiveHög
19Fileadmin.phppredictiveMedium
20Fileadmin/google_search_console/class-gsc-table.phppredictiveHög
21Fileadministrator/components/com_media/helpers/media.phppredictiveHög
22Fileandroid/webkit/SearchBoxImpl.javapredictiveHög
23Fileapp-layer-ssh.cpredictiveHög
24Filearch_init.cpredictiveMedium
25Fileauthenticate.cpredictiveHög
26Fileawstats.plpredictiveMedium
27FileBKCLogSvr.exepredictiveHög
28Filexx.xxxpredictiveLåg
29FilexxxxxxpredictiveLåg
30Filexxx_xxxxxxxxx.xxxpredictiveHög
31Filexxxxxxxx.xxxpredictiveMedium
32Filexxxxxxxxxxxx.xxxpredictiveHög
33Filexxx-xxxx.xxxpredictiveMedium
34Filexxx-xxxxxxx.xxxxpredictiveHög
35Filexxx-xxx/xxxxx.xxxpredictiveHög
36FilexxxxxxxxpredictiveMedium
37Filexxxxx.xxxpredictiveMedium
38Filexxxxxx/xxx.xpredictiveMedium
39Filexxxxxx/xxxxx/xxxxxxx.xpredictiveHög
40Filexxxxxxxxxxxxx.xxxpredictiveHög
41Filexxxxxxx.xxxpredictiveMedium
42Filexxxxxxx-xxxxx-xxxxxxxx.xxxpredictiveHög
43Filexxxxxxx/xxxxxx/xxxxxxxxxxxxxxx_xxxx.xxpredictiveHög
44Filexxxxxxxxx.xxxpredictiveHög
45Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHög
46Filexxxx_xxxxxxx.xxxpredictiveHög
47Filexxxxxx.xxxpredictiveMedium
48Filexxxxxx-xxxxx.xpredictiveHög
49Filexxxx_xxxxx.xxxpredictiveHög
50Filexxxx/xxxxxxxxxx/xxxxxx-xxxxx.xpredictiveHög
51Filexxxxxxxxxxxxx/predictiveHög
52Filexxxxxxx/xxxxxxxxxxx/xxxxxxxxxpredictiveHög
53Filexxxxxxxx_xxxxxxxx.xxxpredictiveHög
54Filexx/xxx/xxxxx.xpredictiveHög
55Filexxxxxxx.xxxpredictiveMedium
56Filexxxx_xxxx.xxxpredictiveHög
57Filexxxxxxxxxxxxxxx.xxxpredictiveHög
58Filexxxx.xxxpredictiveMedium
59Filexxxxxxxx.xxxpredictiveMedium
60Filexxxxx.xxpredictiveMedium
61Filexxxxxxxx-xxxx-xxxxxx-xx-xxxxxxx.xxxpredictiveHög
62Filexxx/xxxxxx.xxxpredictiveHög
63Filexxx/xxxxx/xxxx-xxxxxxxx.xxxpredictiveHög
64Filexxxxx.xxxpredictiveMedium
65Filexxxxxxx-xx.xpredictiveMedium
66Filexxx.xpredictiveLåg
67Filexxxxxxxxxx/xxxx.xpredictiveHög
68Filexxxxxxxxxx/xxxx.xpredictiveHög
69Filexxxxxxxxxx/xxxx_xxpredictiveHög
70Filexxxxxxxxxxx/xxxxx.xpredictiveHög
71Filexxxxxxxxxxx/xxxxxxxxxxx.xpredictiveHög
72Filexxxxx.xxxpredictiveMedium
73Filexxxxx.xxxpredictiveMedium
74Filexxxx.xxxpredictiveMedium
75Filexxxxxxxxxx.xpredictiveMedium
76Filexxxxx/xxxxxxx/xxxxxx_xxxxx_xxxxxxx.xxpredictiveHög
77Filexxxx_xxxxx.xxxxxxxx-xxx.xxxpredictiveHög
78Filexxxxxxxx.xpredictiveMedium
79Filexxxx.xxxpredictiveMedium
80Filexxx-xxxxxxxx.xpredictiveHög
81Filexxxxxxx.xxxpredictiveMedium
82Filexxxxxxx.xxxpredictiveMedium
83Filexxxxxxx/xxxxxxxxxxxx.xpredictiveHög
84Filexxx_xxx_xxx/xxxxx.xpredictiveHög
85Filexxxxxxxxx.xpredictiveMedium
86Filexxx/xxxx/xxx_xxxxxx.xpredictiveHög
87Filexxx/xxxxxx/xxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxx.xxxxpredictiveHög
88Filexxx/xxxxxx/xxxxxxxx/xxxxx/xxxxxxxxx.xxxxpredictiveHög
89Filexxxx/xxxxxxxxx.xxxpredictiveHög
90Filexxxxxxxxxx_xxxx.xxxpredictiveHög
91Filexx_xxxx.xxxpredictiveMedium
92Filexxx.xxxxpredictiveMedium
93Filexxxxxxx.xxxpredictiveMedium
94Filexxxxx.xxxpredictiveMedium
95Filexxxxxxxx.xxxpredictiveMedium
96Filexxxxxxxxxx.xxxpredictiveHög
97Filexxxxxxxxx/xxx/xxxxxxxxxxxxx.xxxpredictiveHög
98Filexxxxxxx_xxx_xxxxx_xxxxxx.xxxxpredictiveHög
99Filexxxxxx.xxxpredictiveMedium
100Filexxxxxxxxxx.xxxpredictiveHög
101Filexxxxxxxx.xxxpredictiveMedium
102Filexxxxx/xxxxxxxxxxxx/xxxxxxx/xxx.xxxxpredictiveHög
103Filexxxxxxxxxxxxxxxx.xxxpredictiveHög
104Filexxxxx_xxxxxx_xxxxxxx.xxxpredictiveHög
105Filexxxxxxxxx.xpredictiveMedium
106Filexxxxx/xxxx/xxxxx.xpredictiveHög
107Filexxxxxxxxx.xxxpredictiveHög
108Filexx_xxxxxxx.xxxpredictiveHög
109Filexxxxxxxxxxx.xxxpredictiveHög
110Filexxxxxxxx.xxxpredictiveMedium
111Filexxxx-xxxxx.xxxpredictiveHög
112Filexxxx-xxxxxxxx.xxxpredictiveHög
113Filexxx.xxxpredictiveLåg
114Filexxxxxxxxxxx_xxxxx.xxxpredictiveHög
115Filexxxx/xxxx_xxxx.xpredictiveHög
116Filexxxxxxxxx_xxxx.xpredictiveHög
117Filexxxxxxx.xpredictiveMedium
118Filexxxxxxx.xxxpredictiveMedium
119Filexxx.xxxpredictiveLåg
120Filexx-xxxxx/xx/xxxx-xxx.xxpredictiveHög
121Filexx-xxxxxxxx/xxxxx-xxxxxx.xxxpredictiveHög
122Filexx-xxxxxxxx/xxxxx-xx-xxxxx.xxxpredictiveHög
123Filexx-xxxxxxxx/xxxxx-xx-xxxxxx-xxxxxx.xxxpredictiveHög
124Filexx-xxxxxxxxxxx.xxxpredictiveHög
125Filexx-xxxxxxxxx.xxxpredictiveHög
126Libraryxxxxxxx\xxx\xxxxxxxx-xxx-x.xxxpredictiveHög
127Libraryxxx/xxxxxx_xxxx.xx)predictiveHög
128Libraryxxx/xxxxxx/xxxxxx_.xpredictiveHög
129Libraryxxx/xxxxxx/xxxxxxxx/xxx.xxxpredictiveHög
130Libraryxxx/xxx.xxpredictiveMedium
131Libraryxxx/xxxxxxxx/xxxx.xxpredictiveHög
132LibraryxxxxxxpredictiveLåg
133Libraryxxxxxxx/xxxxx/xxx/xxxxxx.xpredictiveHög
134Libraryxxx/xxxxxxxxx/xxx.xpredictiveHög
135Argument$_xxxxxxx['xxxx']predictiveHög
136Argument-xpredictiveLåg
137Argument/../predictiveLåg
138ArgumentxxxxxxxxxxpredictiveMedium
139ArgumentxxxxxxxxxxxpredictiveMedium
140ArgumentxxxxxxxxpredictiveMedium
141ArgumentxxxpredictiveLåg
142ArgumentxxxxxxxxxxpredictiveMedium
143ArgumentxxxpredictiveLåg
144ArgumentxxxxxxxpredictiveLåg
145ArgumentxxxxxxpredictiveLåg
146ArgumentxxxxpredictiveLåg
147ArgumentxxxpredictiveLåg
148ArgumentxxxxxxxxpredictiveMedium
149ArgumentxxxxpredictiveLåg
150ArgumentxxxxxxxxxxxxxpredictiveHög
151ArgumentxxxpredictiveLåg
152ArgumentxxxxxxxpredictiveLåg
153ArgumentxxxxxpredictiveLåg
154ArgumentxxxxxxxxxxpredictiveMedium
155ArgumentxxxxxxxxpredictiveMedium
156ArgumentxxxxxpredictiveLåg
157ArgumentxxxxxxxpredictiveLåg
158ArgumentxxxxxxxxxpredictiveMedium
159ArgumentxxxxxxxxpredictiveMedium
160ArgumentxxxxxxxxxxxxpredictiveMedium
161ArgumentxxpredictiveLåg
162Argumentxxxxx_xxxx_xxxxxxpredictiveHög
163ArgumentxxxxpredictiveLåg
164ArgumentxxxxpredictiveLåg
165ArgumentxxxxxxpredictiveLåg
166ArgumentxxxxxxpredictiveLåg
167Argumentxxxx/xxx_xxxxxx/xxxxpredictiveHög
168ArgumentxxxxxxxxxxpredictiveMedium
169ArgumentxxxpredictiveLåg
170ArgumentxxxxxpredictiveLåg
171Argumentxxxx_xxxxxpredictiveMedium
172Argumentxxx_xxxxxxpredictiveMedium
173ArgumentxxxxpredictiveLåg
174ArgumentxxxxxxxxpredictiveMedium
175Argumentxxx-xxx xxxx xxxxxxxxpredictiveHög
176ArgumentxxxxxxxxxpredictiveMedium
177ArgumentxxxxxxxxpredictiveMedium
178ArgumentxxxxxxxxxxxpredictiveMedium
179ArgumentxxxxxxxxxpredictiveMedium
180Argumentxxx_xxxxpredictiveMedium
181ArgumentxxxxxxxxpredictiveMedium
182ArgumentxxxpredictiveLåg
183ArgumentxxxxxpredictiveLåg
184Argumentxxxxxxxxxxxxx xxpredictiveHög
185ArgumentxxxxxxxxpredictiveMedium
186Argumentxxxxxxxx_xxxpredictiveMedium
187ArgumentxxxxxxxxxpredictiveMedium
188ArgumentxxxxxxxpredictiveLåg
189ArgumentxxxxxxpredictiveLåg
190ArgumentxxxxxxpredictiveLåg
191ArgumentxxxxxxxxxxpredictiveMedium
192Argumentxxxxxx_xxpredictiveMedium
193Argumentxxxx_xxxpredictiveMedium
194ArgumentxxxxpredictiveLåg
195ArgumentxxpredictiveLåg
196ArgumentxxxpredictiveLåg
197Argumentxx_xxpredictiveLåg
198ArgumentxxxxxpredictiveLåg
199ArgumentxxxxxxpredictiveLåg
200ArgumentxxxxxxxxxpredictiveMedium
201ArgumentxxxxxxpredictiveLåg
202Argumentxx_xxpredictiveLåg
203ArgumentxxxxxxxxpredictiveMedium
204ArgumentxxxxxxxxpredictiveMedium
205ArgumentxxxxxxpredictiveLåg
206Argumentxxxxxx[]predictiveMedium
207ArgumentxxxxxxxxxxxxxxxpredictiveHög
208Argumentxxxx=xxxxxxxxpredictiveHög
209Argumentxxxxxx_xxxpredictiveMedium
210ArgumentxxxpredictiveLåg
211ArgumentxxxpredictiveLåg
212ArgumentxxxxxxxxpredictiveMedium
213ArgumentxxxxxpredictiveLåg
214Argumentxxx[xxxx_xx]predictiveMedium
215ArgumentxxxxxxpredictiveLåg
216ArgumentxxxxxxxxxxxpredictiveMedium
217Argument_xxxxxxxpredictiveMedium
218Input Value'xx x=xpredictiveLåg
219Input Value);<xxxxxx>xxxxx('xxx')</xxxxxx>predictiveHög
220Input Value..%xxpredictiveLåg
221Input Value../..predictiveLåg
222Input Value/\xxxxxxx.xxxpredictiveHög
223Input Valuex" xxxxxxxxxxx=xxxxxx(xxxxxx) xxx="predictiveHög
224Input Valuexxxxxxx.xxx_xxx.xxxpredictiveHög
225Input ValuexxxxxxpredictiveLåg
226Input Value\xxx\xxx\xxx\xxx\xxxpredictiveHög
227Network Portxxxxxxxxxxxxxx xxxxxxpredictiveHög
228Network Portxxx/xxxxpredictiveMedium
229Network Portxxx/xxxx (xxxx) / xxx/xxxx (xxxxx)predictiveHög
230Network Portxxx xxxxxx xxxxpredictiveHög

Referenser (2)

The following list contains external sources which discuss the actor and the associated activities:

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!