Darkkomet 分析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (69)

语言

en	66
es	2
de	2

国家/地区

us	46
ru	12
ua	2
it	2
fr	2

演员

Darkkomet	9
Adwind	2
NjRAT	2
Nanocore RAT	2
NetWire	2

利益

类型

Not Defined	22
Content Management System	12
JavaScript Library	6
Programming Language Software	4
Vehicle Software	4

供应商

Not Defined	26
Byzoro	4
Daimler	4
Sourcecodehero	2
Maran	2

产品

WordPress	6
Node.js	4
Byzoro Smart S85F Management Platform	4
Sourcecodehero ERP System Project	2
DokuWiki	2

漏洞

#	漏洞	Base	Temp	0day	今天	易	修正	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash 信息公开	5.3	5.2	$5k-$25k	计算	High	Workaround	0.02016	0.00	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php 权限升级	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.38	CVE-2010-0966
3	Totolink LR1200GB Web Interface cstecgi.cgi loginAuth 内存损坏	9.8	9.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.11	CVE-2024-1783
4	Drag and Drop Multiple File Upload Plugin SVG File dnd_codedropz_upload 跨网站脚本	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00102	0.00	CVE-2022-0595
5	Interactive Contact Form and Multi Step Form Builder Plugin 跨网站脚本	5.2	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00069	0.02	CVE-2023-4950
6	Byzoro Smart S85F Management Platform 权限升级	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00207	0.08	CVE-2023-4121
7	Byzoro Smart S85F Management Platform importhtml.php 权限升级	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00617	0.00	CVE-2023-4120
8	Campcodes Online Thesis Archiving System view_department.php SQL注入	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00146	0.08	CVE-2023-2144
9	CodeIgniter DB_query_builder.php or_like SQL注入	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00172	0.00	CVE-2022-40829
10	CodeIgniter DB_query_builder.php SQL注入	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00172	0.04	CVE-2022-40835
11	centreon Contact Groups Form formContactGroup.php SQL注入	6.3	5.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00212	0.08	CVE-2022-3827
12	Sourcecodehero ERP System Project processlogin.php SQL注入	8.1	7.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00170	0.04	CVE-2022-3118
13	CPG Dragonfly CMS MSAnalysis Module index.php SQL注入	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00918	0.00	CVE-2006-0727
14	Sophos SFOS Administration Service/User Portal SQL注入	9.1	8.9	$5k-$25k	$0-$5k	High	Official Fix	0.01655	0.03	CVE-2020-12271
15	ampleShop category.cfm SQL注入	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00621	0.04	CVE-2006-2038
16	ProFTPD mod_tls 弱加密	6.5	6.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00473	0.00	CVE-2009-3639
17	OpenSSH GSS2 auth-gss2.c Username 信息公开	5.3	5.2	$5k-$25k	$5k-$25k	Not Defined	Workaround	0.00257	0.04	CVE-2018-15919
18	OpenSSH Readonly Mode sftp-server.c process_open 权限升级	5.3	5.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00660	0.00	CVE-2017-15906
19	Gempar Script Toko Online shop_display_products.php SQL注入	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00100	0.02	CVE-2009-0296
20	ESMI PayPal Storefront products1h.php 跨网站脚本	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.05468	0.00	CVE-2005-0936

IOC - Indicator of Compromise (32)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP地址	Hostname	参与者	Identified	类型	可信度
1	5.189.137.8	vending.softjourn.if.ua	Darkkomet	2023-01-24	verified	高
2	12.167.151.119		Darkkomet	2022-04-13	verified	高
3	20.72.235.82		DarkKomet	2022-09-07	verified	高
4	20.81.111.85		DarkKomet	2022-09-07	verified	高
5	23.49.102.35	a23-49-102-35.deploy.static.akamaitechnologies.com	Darkkomet	2023-06-03	verified	高
6	23.221.227.172	a23-221-227-172.deploy.static.akamaitechnologies.com	DarkKomet	2022-09-07	verified	高
7	35.205.61.67	67.61.205.35.bc.googleusercontent.com	DarkKomet	2022-09-07	verified	中
8	XX.XX.XXX.XXX		Xxxxxxxxx	2022-04-07	verified	高
9	XX.XX.XXX.XX		Xxxxxxxxx	2022-04-07	verified	高
10	XX.XX.XXX.XXX		Xxxxxxxxx	2022-04-07	verified	高
11	XX.XX.XXX.X	xxx-xxxxxxxx.xxx.xxx.xxx	Xxxxxxxxx	2022-04-13	verified	高
12	XX.XXX.XXX.XXX	xxxxxxxxxxxxxx.xxxx.xxxx.xxxx.xx.xx	Xxxxxxxxx	2022-09-07	verified	高
13	XX.XX.X.XXX		Xxxxxxxxx	2022-04-13	verified	高
14	XX.XXX.XXX.XXX		Xxxxxxxxx	2023-06-03	verified	高
15	XX.XXX.XXX.XXX		Xxxxxxxxx	2022-04-08	verified	高
16	XX.XXX.XXX.XXX		Xxxxxxxxx	2023-06-03	verified	高
17	XXX.XX.XXX.XX		Xxxxxxxxx	2022-04-13	verified	高
18	XXX.XX.XXX.XX		Xxxxxxxxx	2022-04-13	verified	高
19	XXX.XXX.XXX.XXX		Xxxxxxxxx	2022-09-24	verified	高
20	XXX.XXX.XX.XXX		Xxxxxxxxx	2022-09-07	verified	高
21	XXX.XX.XXX.XX	xxxxxxxx-xxxxxx.xxxxxx.xxx	Xxxxxxxxx	2022-04-13	verified	高
22	XXX.XXX.X.XX		Xxxxxxxxx	2023-04-25	verified	高
23	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxxx.xxxxxxxx.xxx	Xxxxxxxxx	2022-04-07	verified	高
24	XXX.XXX.XXX.XX		Xxxxxxxxx	2022-09-24	verified	高
25	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxxxxxxx.xxxxxxxxxxxx.xxx	Xxxxxxxxx	2022-09-07	verified	高
26	XXX.XXX.XXX.XX	xxxxxxxx.xx-xxx-xxx-xxx.xx	Xxxxxxxxx	2022-09-07	verified	高
27	XXX.XXX.XX.XX	xxxxxxxx.xxxx.xxx	Xxxxxxxxx	2023-01-24	verified	高
28	XXX.XX.XX.XXX		Xxxxxxxxx	2022-09-07	verified	高
29	XXX.XX.XX.XXX	xxx-xx-xx-xxx.xxx.xxxxxxxxxxx.xxx	Xxxxxxxxx	2021-12-06	verified	高
30	XXX.XX.X.XXX	xx-xxx.xx.x.xxx.xxxxxxxxx.xxx	Xxxxxxxxx	2022-04-07	verified	高
31	XXX.XX.X.XXX	xx-xxx.xx.x.xxx.xxxxxxxxx.xxx	Xxxxxxxxx	2022-04-07	verified	高
32	XXX.XXX.XX.XX	xxxxxxx-xxx.xxxxxx.xxx	Xxxxxxxxx	2022-04-13	verified	高

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	分类	漏洞	访问向量	类型	可信度
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	高
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	高
3	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	高
4	TXXXX	CAPEC-122	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
5	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
6	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	高
7	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	高
8	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	高
9	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
10	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	高
11	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高

IOA - Indicator of Attack (47)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	分类	Indicator	类型	可信度
1	File	/admin/departments/view_department.php	predictive	高
2	File	/cgi-bin/cstecgi.cgi	predictive	高
3	File	/pages/processlogin.php	predictive	高
4	File	/SCRIPTPATH/index.php	predictive	高
5	File	admin/index.php	predictive	高
6	File	auth-gss2.c	predictive	中
7	File	xxxxxxx.xxx	predictive	中
8	File	xxxxxxxx.xxx	predictive	中
9	File	xxx-xxx/xxxxx/xxxxx.xxx	predictive	高
10	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	高
11	File	xxxxxxx.xxxx	predictive	中
12	File	xxxxxxxxxxxxxxxx.xxx	predictive	高
13	File	xxxxxxxxxx.xxx	predictive	高
14	File	xxx/xxxxxx.xxx	predictive	高
15	File	xxxxx.xxx	predictive	中
16	File	xxxx_xxxx.xxx	predictive	高
17	File	xxx?xxxx.xxx	predictive	中
18	File	xxxx.x	predictive	低
19	File	xxxx.xxx	predictive	中
20	File	xxxxxxxxxx.xxx	predictive	高
21	File	xxxxxxxx.xxx	predictive	中
22	File	xxx/xxxxxxx/xxxxxx/xxxx/xxxxx/xxxxxxx/xxxxxx/xxxxx/xxx%xxxxxxxxxxxxx.xx.xxx	predictive	高
23	File	xxxx-xxxxxx.x	predictive	高
24	File	xxxx_xxxxxxx_xxxxxxxx.xxx	predictive	高
25	File	xxx/xxxxxxx.x	predictive	高
26	File	xxxxxx\xxxxxxxx\xx_xxxxx_xxxxxxx.xxx	predictive	高
27	Library	/xxx/xxx/xxxx.xxx	predictive	高
28	Argument	xxxxxxxx	predictive	中
29	Argument	xxxxx	predictive	低
30	Argument	xxxx	predictive	低
31	Argument	xxx	predictive	低
32	Argument	xxx_xx	predictive	低
33	Argument	xx_xx	predictive	低
34	Argument	xxxx_xx	predictive	低
35	Argument	xxxxxxx-xxxxxx	predictive	高
36	Argument	xxxx_xxxxxx	predictive	中
37	Argument	xx	predictive	低
38	Argument	xxxx_xxxx	predictive	中
39	Argument	xx	predictive	低
40	Argument	xxxxx	predictive	低
41	Argument	xx_xxxx	predictive	低
42	Argument	xxxxxxx	predictive	低
43	Argument	xxxx	predictive	低
44	Argument	xxx	predictive	低
45	Argument	xxxx	predictive	低
46	Input Value	=x' xxx xxxx=xxxx xxx 'xxxx'='xxxx	predictive	高
47	Input Value	xxx?xxxx.xxx	predictive	中

参考 (10)

The following list contains external sources which discuss the actor and the associated activities:

◂ 上一步一览下一步 ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!