Scarab Ransomware Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (67)

Lang

en	38
ru	20
zh	10

Land

us	36
ru	18
gb	6
cn	4
nl	2

Skådespelare

Scarab Ransomware	7
Cobalt Strike	5
IcedID	5
Sliver	3
Rhadamanthys	3

Intressera

Typ

Not Defined	28
Operating System	12
Content Management System	6
Firewall Software	4
Network Camera Software	2

Säljare

Not Defined	30
Microsoft	10
PHPGurukul	4
Tiandy	2
GNU	2

Produkt

Microsoft Windows	10
WordPress	4
Tiandy IP Cameras	2
FLDS	2
GNU C Library	2

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	Fusion Builder Plugin HTTP Request privilegier eskalering	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.26067	0.02	CVE-2022-1386
2	Mattermost Server Websocket svag autentisering	6.8	6.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00061	0.04	CVE-2023-3615
3	PbootCMS function.php parserIfLabel privilegier eskalering	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.52551	0.05	CVE-2022-32417
4	SonicWALL Secure Remote Access cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02391	0.02	CVE-2021-20028
5	DeDeCMS recommend.php sql injektion	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02834	0.04	CVE-2017-17731
6	WordPress förfalskning på begäran över webbplatsen	6.5	6.3	$5k-$25k	$0-$5k	High	Official Fix	0.00332	0.04	CVE-2016-6897
7	Apache Tomcat HTTP/2 Execution förnekande av tjänsten	6.4	6.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.72665	0.04	CVE-2019-0199
8	Google Android att_protocol.cc attp_build_read_by_type_value_cmd minneskorruption	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00043	0.00	CVE-2024-0031
9	Dahua IPC-HX3XXX Data Packet svag autentisering	8.1	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.06414	0.00	CVE-2021-33045
10	IBM PowerVM VIOS Remote Code Execution	9.3	9.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00136	0.02	CVE-2022-35643
11	Exim Line spool_read_header privilegier eskalering	5.4	5.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00928	0.03	CVE-2020-28026
12	GNU C Library Environment Variable ld.so minneskorruption	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01574	0.04	CVE-2023-4911
13	Microsoft Windows Secondary Login CreateProcessWithLogon privilegier eskalering	7.8	7.6	$25k-$100k	$0-$5k	High	Official Fix	0.00044	0.05	CVE-2016-0099
14	Linux Kernel route4_change minneskorruption	8.8	8.4	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00054	0.00	CVE-2022-2588
15	emlog index.php informationsgivning	5.5	5.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00300	0.02	CVE-2021-3293
16	TrueConf Server sql injektion	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00656	0.05	CVE-2022-46764
17	FLDS redir.php sql injektion	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00203	0.38	CVE-2008-5928
18	SonicWall SSLVPN SMA100 sql injektion	7.3	7.3	$0-$5k	$0-$5k	High	Not Defined	0.02628	0.04	CVE-2021-20016
19	Newphoria Auction Camera Application Whitelist Protection privilegier eskalering	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00326	0.00	CVE-2015-5633
20	Git Plugin Build privilegier eskalering	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01156	0.09	CVE-2022-36883

IOC - Indicator of Compromise (15)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Identified	Typ	Förtroende
1	3.76.107.228	ec2-3-76-107-228.eu-central-1.compute.amazonaws.com	Scarab Ransomware	05/03/2024	verified	Medium
2	24.144.120.189		Scarab Ransomware	01/01/2024	verified	Hög
3	87.251.64.19		Scarab Ransomware	05/03/2024	verified	Hög
4	XX.XXX.XX.XX		Xxxxxx Xxxxxxxxxx	05/03/2024	verified	Hög
5	XX.XXX.XX.XXX		Xxxxxx Xxxxxxxxxx	05/03/2024	verified	Hög
6	XXX.XX.XXX.XXX	xxx.xxx.xx.xxx.xxxxxx.xx.xxxxxxxx.xxx	Xxxxxx Xxxxxxxxxx	01/01/2024	verified	Hög
7	XXX.XX.XX.XX	xx.xx.xx.xxx.xxxxxx.xx.xxxxxxxx.xxx	Xxxxxx Xxxxxxxxxx	01/01/2024	verified	Hög
8	XXX.XXX.XXX.XXX		Xxxxxx Xxxxxxxxxx	05/03/2024	verified	Hög
9	XXX.XXX.XXX.XXX		Xxxxxx Xxxxxxxxxx	05/03/2024	verified	Hög
10	XXX.XXX.X.XXX		Xxxxxx Xxxxxxxxxx	05/03/2024	verified	Hög
11	XXX.XX.XX.XXX		Xxxxxx Xxxxxxxxxx	05/03/2024	verified	Hög
12	XXX.XX.XX.XXX		Xxxxxx Xxxxxxxxxx	05/03/2024	verified	Hög
13	XXX.XXX.XXX.XX		Xxxxxx Xxxxxxxxxx	05/03/2024	verified	Hög
14	XXX.XXX.XXX.XXX		Xxxxxx Xxxxxxxxxx	05/03/2024	verified	Hög
15	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxxxxx.xxxxxx.xxx	Xxxxxx Xxxxxxxxxx	05/03/2024	verified	Hög

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klass	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1		CAPEC-10	CWE-20, CWE-119, CWE-120, CWE-121, CWE-189, CWE-190, CWE-285, CWE-287, CWE-345, CWE-346, CWE-352, CWE-400, CWE-404, CWE-415, CWE-476, CWE-502, CWE-613, CWE-665, CWE-787, CWE-862, CWE-863, CWE-918, CWE-942	Unknown Vulnerability	predictive	Hög
2	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Hög
3	T1055	CAPEC-10	CWE-74, CWE-707	Improper Neutralization of Data within XPath Expressions	predictive	Hög
4	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX, CWE-XXXX	Xxxxxxxx Xxxxxxxxx	predictive	Hög
5	TXXXX.XXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XX, CWE-XXX	Xxxxx Xxxx Xxxxxxxxx	predictive	Hög
6	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
7	TXXXX.XXX	CAPEC-191	CWE-XXX, CWE-XXX, CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Hög
8	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XX, CWE-XXX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Hög
9	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxx Xxxxxxxxx	predictive	Hög
10	TXXXX	CAPEC-38	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	Hög
11	TXXXX.XXX	CAPEC-114	CWE-XXX, CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
12	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög
13	TXXXX.XXX	CAPEC-19	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Hög

IOA - Indicator of Attack (31)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	/cgi-bin/supervisor/PwdGrp.cgi	predictive	Hög
2	File	add-category.php	predictive	Hög
3	File	admin/dashboard.php	predictive	Hög
4	File	att_protocol.cc	predictive	Hög
5	File	xxxxxx.xxx	predictive	Medium
6	File	xxxxxxxx.xxx	predictive	Medium
7	File	xxxxxxx.xxx	predictive	Medium
8	File	xxxxxx/xxxxxxxxxxx	predictive	Hög
9	File	xxxx_xxxx.xxx	predictive	Hög
10	File	xx.xx	predictive	Låg
11	File	xxxxxxx.xx	predictive	Medium
12	File	xxx_xxx_xxxxxxx.xxx	predictive	Hög
13	File	xxxx/xxxxxxxxx.xxx	predictive	Hög
14	File	xxxxx.xxx	predictive	Medium
15	File	xxxxxx_xxx.xx	predictive	Hög
16	File	xxxxxxx.xxx	predictive	Medium
17	File	x/xxxxx.xxx	predictive	Medium
18	File	xxx/xxxxx_xxxxxx.xxx	predictive	Hög
19	File	xxxxxx\xxxxxx\xxxxxxxxx-xxxxxx-xxxxxxx\xxx\xxxxxxx\xxxxxxxxxxxxx.xxx	predictive	Hög
20	File	xx-xxxxxxxx/xxxxxxxx/xxxxxxx/xxxxxxxxxxxxxxxx.xxx	predictive	Hög
21	Argument	$_xxxxx	predictive	Låg
22	Argument	xxxxxxxx/xxxxxxxxxxxx	predictive	Hög
23	Argument	xxxx_xx	predictive	Låg
24	Argument	xxxxxxxxxxxxxx	predictive	Hög
25	Argument	xxxxx_xxxxxxxx	predictive	Hög
26	Argument	xxxx	predictive	Låg
27	Argument	xx	predictive	Låg
28	Argument	xxxxx	predictive	Låg
29	Argument	xxxxx	predictive	Låg
30	Argument	xxxx	predictive	Låg
31	Argument	\xxxxxx\	predictive	Medium

Referenser (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Might our Artificial Intelligence support you?

Check our Alexa App!