Lumma Stealer 分析

IOB - Indicator of Behavior (588)

时间轴

语言

en466
ru32
zh18
es14
de12

国家/地区

us238
ru72
cn62
de34
gb26

演员

活动

利益

时间轴

类型

供应商

产品

Microsoft Windows26
WordPress12
Invision Power Board6
Apache HTTP Server4
Fortinet FortiOS4

漏洞

#漏洞BaseTemp0day今天修正EPSSCTICVE
1Yclas form.php 跨网站脚本3.53.4$0-$5k$0-$5kNot DefinedNot Defined0.000730.00CVE-2021-38710
2Atmail Remote Code Execution9.89.4$0-$5k$0-$5kNot DefinedOfficial Fix0.002510.04CVE-2013-5033
3eSyndicat eSyndicat Directory magic_quotes_gpc cron.php 内存损坏7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.006960.02CVE-2006-2578
4eSyndiCat Esyndicat Directory news.php SQL注入7.37.3$0-$5k$0-$5kHighUnavailable0.006030.02CVE-2007-3811
5eSyndicat Directory Software suggest-listing.php 跨网站脚本3.53.5$0-$5k$0-$5kNot DefinedNot Defined0.000000.03
6Moxa MGate MB3270 弱身份验证9.89.4$0-$5k$0-$5kNot DefinedOfficial Fix0.002500.00CVE-2016-5804
7OpenSSH Authentication Username 信息公开5.34.8$5k-$25k$0-$5kHighOfficial Fix0.107370.13CVE-2016-6210
8Joomla CMS com_easyblog SQL注入6.36.1$5k-$25k$5k-$25kNot DefinedNot Defined0.000000.22
9Phplinkdirectory PHP Link Directory conf_users_edit.php 跨网站请求伪造6.36.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.005260.13CVE-2011-0643
10Microsoft Windows IIS Server Remote Code Execution9.88.9$25k-$100k$5k-$25kUnprovenOfficial Fix0.001330.04CVE-2023-36434
11Palo Alto PAN-OS GlobalProtect Clientless VPN 内存损坏8.88.6$0-$5k$0-$5kNot DefinedOfficial Fix0.001120.03CVE-2021-3056
12WordPress SQL注入6.86.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.004670.03CVE-2022-21664
13Storytlr 跨网站脚本4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.001930.06CVE-2014-100038
14RealNetworks RealServer Port 7070 Service 拒绝服务7.57.3$0-$5k$0-$5kNot DefinedWorkaround0.021160.05CVE-2000-0272
15Papoo kontakt.php SQL注入6.36.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.05
16Joomla SQL注入6.36.3$5k-$25k$5k-$25kNot DefinedNot Defined0.001420.02CVE-2022-23797
17Storytlr 跨网站脚本4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.001290.13CVE-2014-100037
18Logs Plugin Controller.php actionStream 信息公开4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.004110.00CVE-2022-23409
19VeronaLabs wp-statistics Plugin API Endpoint Blind SQL注入8.58.4$0-$5k$0-$5kNot DefinedOfficial Fix0.002500.00CVE-2019-13275
20Microsoft Windows Themes 信息公开5.95.6$25k-$100k$5k-$25kUnprovenOfficial Fix0.000640.04CVE-2024-21320

IOC - Indicator of Compromise (41)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP地址Hostname参与者活动Identified类型可信度
15.42.92.179hosted-by.yeezyhost.netLumma Stealer2023-12-10verified
25.161.155.121static.121.155.161.5.clients.your-server.deLumma Stealer2022-09-22verified
323.254.225.133hwsrv-1067631.hostwindsdns.comLumma Stealer2023-04-09verified
445.8.146.130vm1266137.stark-industries.solutionsLumma Stealer2023-05-07verified
545.8.146.213vm1266137.stark-industries.solutionsLumma Stealer2023-05-07verified
645.8.146.227vm1266137.stark-industries.solutionsLumma Stealer2023-05-07verified
745.15.25.190Lumma Stealer2023-05-25verified
877.73.134.68Lumma Stealer2023-01-13verified
978.46.190.160static.160.190.46.78.clients.your-server.deLumma Stealer2023-05-25verified
10XX.XXX.XXX.XXXxxxxxxxxxxx-xxxx.xxxx.xxxxxxxXxxxx Xxxxxxx2023-04-22verified
11XX.XX.XX.XXXxxxxxxx.xxxxx.xxxx.xxxxxxxXxxxx Xxxxxxx2023-10-12verified
12XX.XXX.XXX.XXxxxxxxxx.xxxXxxxx Xxxxxxx2023-04-10verified
13XX.XXX.XXX.XXXxxxxx-xxx.xxxXxxxx Xxxxxxx2023-04-07verified
14XX.XXX.XXX.XXXxxxxxxxxxx.xxxxxx-xx-xxxxx.xxxXxxxx Xxxxxxx2023-04-09verified
15XX.XXX.XX.XXXxxxx Xxxxxxx2023-03-04verified
16XX.XXX.XX.XXXxxx.xxxxxxx.xxXxxxx Xxxxxxx2023-04-30verified
17XX.XXX.XXX.XXXXxxxx Xxxxxxx2023-05-30verified
18XX.XX.XXX.XXXXxxxx Xxxxxxx2024-01-09verified
19XX.XXX.XX.XXXXxxxx Xxxxxxx2023-06-22verified
20XX.XXX.XXX.XXXxxxx Xxxxxxx2023-04-30verified
21XX.XXX.XXX.XXXxxxx Xxxxxxx2023-06-04verified
22XX.XXX.XXX.XXxx-xxxx.xxxxxxxxx.xxxXxxxx Xxxxxxx2023-06-03verified
23XX.XXX.XX.XXXxxxxxx.xxx.xx.xxx.xx.xxxxxxx.xxxx-xxxxxx.xxXxxxx Xxxxxxx2023-12-11verified
24XXX.XX.XX.XXXxxxx Xxxxxxx2024-02-27verified
25XXX.XX.XX.XXXXxxxx Xxxxxxx2023-11-27verified
26XXX.XX.XX.XXXXxxxx Xxxxxxx2023-11-22verified
27XXX.XXX.XXX.XXXXxxxx Xxxxxxx2023-04-22verified
28XXX.XX.XXX.XXXxxxxxx.xxx.xxx.xx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxx Xxxxxxx2023-01-13verified
29XXX.XX.XXX.XXXxxxxxx.xxx.xxx.xx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxx Xxxxxxx2023-01-13verified
30XXX.XXX.X.XXxxxxxx.xx.x.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxx Xxxxxxx2023-05-25verified
31XXX.XX.XXX.XXXxxxx Xxxxxxx2023-11-09verified
32XXX.XX.XXX.XXxxxx Xxxxxxx2023-11-22verified
33XXX.XX.XXX.XXXXxxxx Xxxxxxx2023-05-07verified
34XXX.XXX.XXX.XXXXxxxx Xxxxxxx2024-01-29verified
35XXX.XXX.XXX.XXXxxxxx-xxxxxxx.xxxxxxxxxxxx.xxxXxxxx Xxxxxxx2023-04-22verified
36XXX.XXX.XXX.XXXxxxxx.xxxxxxxXxxxx Xxxxxxx2023-05-25verified
37XXX.XXX.XX.Xxxxxxxxxxx.xxxxxx-xx-xxxxx.xxxXxxxx Xxxxxxx2024-03-04verified
38XXX.XXX.XXX.XXxxxxx-xxxxx.xxxxxxx.xxxxXxxxx Xxxxxxx2022-09-22verified
39XXX.XX.XXX.XXXxxxxx.xxxxxXxxxx Xxxxxxx2023-06-17verified
40XXX.XX.XX.XXxxxxxxx-xxxxxxx.xxx.xxXxxxx Xxxxxxx2022-09-22verified
41XXX.XXX.XX.XXXXxxxx Xxxxxxx2023-11-12verified

TTP - Tactics, Techniques, Procedures (20)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (282)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID分类Indicator类型可信度
1File/advanced-tools/nova/bin/netwatchpredictive
2File/api/baskets/{name}predictive
3File/api/profilepredictive
4File/api/RecordingList/DownloadRecord?file=predictive
5File/apply.cgipredictive
6File/cgi-bin-sdb/predictive
7File/dataset/data/{id}predictive
8File/debug/pprofpredictive
9File/etc/grafana/grafana.inipredictive
10File/film-rating.phppredictive
11File/forum/away.phppredictive
12File/forum/PostPrivateMessagepredictive
13File/index.phppredictive
14File/librarian/bookdetails.phppredictive
15File/nova/bin/igmp-proxypredictive
16File/orrs/admin/?page=user/manage_userpredictive
17File/pages/processlogin.phppredictive
18File/php/ping.phppredictive
19File/rapi/read_urlpredictive
20File/scripts/unlock_tasks.phppredictive
21File/student/bookdetails.phppredictive
22File/SysInfo1.htmpredictive
23File/sysinfo_json.cgipredictive
24File/system/user/modules/mod_users/controller.phppredictive
25File/uncpath/predictive
26File/usr/local/psa/admin/sbin/wrapperpredictive
27File/wp-admin/admin-post.php?es_skip=1&option_namepredictive
28File123flashchat.phppredictive
29Fileaccount.asppredictive
30Fileaddguest.cgipredictive
31Fileadmin.jcomments.phppredictive
32Fileadmin.phppredictive
33Fileadmin/?page=system_infopredictive
34Fileadmin/conf_users_edit.phppredictive
35Filexxxxx/xxxxxxxxxxxxx/xxxxxx.xxxpredictive
36Filexxxxx/xxxxxxxxx/xxxx_xxxxxxx.xxxpredictive
37Filexxxxx/xxxxxxx/xxxxx/xx_xxxxxxx_xxxx.xxxpredictive
38Filexxxxxxxxx-xxxxxxx.xxxpredictive
39Filexxxx.xxxpredictive
40Filexxxxx_xxxxxx.xxxpredictive
41Filexxxxxxxx.xxxpredictive
42Filexxxxxxx/xxxx.xxxpredictive
43Filexxxxxx.xxxpredictive
44Filexx_xxxxx_xxxxx.xxxpredictive
45Filexxxxxxx-xxxxxx-xxxxxx.xxxpredictive
46Filexxxxpredictive
47Filexxxxxxxx.xxxpredictive
48Filexxxxxxxx_xxxx.xxxpredictive
49Filexxx-xxx/xxxxxxx.xxpredictive
50Filexxx-xxx/xx_xxxxxx_xxxxxx.xxxpredictive
51Filexxxxx.xxxxx.xxxpredictive
52Filexxxxxx/xxx.xpredictive
53Filexxxxxx.xxx.xxxpredictive
54Filexxxxxxx.xxxpredictive
55Filexxxxxxx/xxxxxx/xxxxxx.xxxpredictive
56Filexxxxxxxxxx.xxxpredictive
57Filexxxxx\xxxxx\xxxxx.xxxx.xxxpredictive
58Filexxxx.xxxpredictive
59Filexxxxxxxxx.xxx.xxxpredictive
60Filexxxxx/xxxxx.xxxpredictive
61Filexxxx_xxxxx.xxxpredictive
62Filexxxxx.xxxpredictive
63Filexxxxx/xxxxxxx.xxpredictive
64Filexxxxxxx.xxxpredictive
65Filexxxxxx.xxxpredictive
66Filexxxxxxxxxxxxxxx.xxxpredictive
67Filexxxxxxxx.xxxpredictive
68Filexxxxxxxxx/xxxxxxxxx.xxxpredictive
69Filexxxxxxx/xxxxx/xxxxx/xxxxxx-xxx.xpredictive
70Filexxxxx.xxxpredictive
71Filexxxxx/xxxxxxxx.xxxpredictive
72Filexxxxxx_xxxx.xxxpredictive
73Filexxxxxxxxxxxx.xxxpredictive
74Filexx/xx-xx.xpredictive
75Filexx/xxxxx/xxxxxxx.xpredictive
76Filexxxxxxx.xxxpredictive
77Filexxx/xxxx_xxxx.xpredictive
78Filexxxxxxxxxxxx_xxxx.xxxpredictive
79Filexxxxxx/xxxxxpredictive
80Filexxxxxx/xxxxxxxxxxxpredictive
81Filexxxx_xxxxxx.xpredictive
82Filexxxx_xxxxxxx.xxx.xxxpredictive
83Filexxxxxx.xxxpredictive
84Filexxxx.xxxpredictive
85Filexxxx/xxxxxxx.xpredictive
86Filexxxxxxxx_xxxx.xxxpredictive
87Filexxxxx_xxxxxx.xxxpredictive
88Filexxx/xxxxxxxxx.xxx.xxxpredictive
89Filexxxxxxx.xxxpredictive
90Filexxxxxxxx/xxxxx-xxxxxx-xxxx-xxxxxxx.xxxpredictive
91Filexxxxxxxx/xxxxxxxx/xxxxx-xxxxxxxx-xxxxx.xxxpredictive
92Filexxxxxxxx/xxxxxxxxxx/xxxxx-xx-xxxxxxxxx-xxxxxxxx.xxxpredictive
93Filexxxxx.xxxxpredictive
94Filexxxxx.xxxpredictive
95Filexxxxx.xxx?xxx=xxxx&xxx=xxxxxxxxpredictive
96Filexxxxxxx/xxxxxx.xxxpredictive
97Filexxxxxxx/xxxx/xxxx.xxxpredictive
98Filexxxxxxxxx.xxxpredictive
99Filexxxxxxxxxx.xxxpredictive
100Filexxxx_xxxx.xxxpredictive
101Filexxxxxxx.xxxpredictive
102Filexxxx.xxxpredictive
103Filexxxxx.xxxpredictive
104Filexxxxx.xxxpredictive
105Filexxxx/xxxxxxxxx/xxxxxx/xxxxxxxxxxxxxxxxxxxxx.xxxpredictive
106Filexxxx/xxxxx.xxxpredictive
107Filexxxx/xxxxxxx_xxxx.xpredictive
108Filexxx/xxx.xxxpredictive
109Filexxxxxxx/xxxx/xxxx.xxxxx.xxxxxxxxxx.xxxpredictive
110Filexxxxxxx/xxx_xxxxxxxx.xxxpredictive
111Filexxx_xxxxxxxx.xxxpredictive
112Filexxxx-xxxxxx.xxxpredictive
113Filexxxx.xxxpredictive
114Filexxxxxxxx.xxxpredictive
115Filexxx_xxxx.xxxpredictive
116Filexxxxx.xxxpredictive
117Filexxxxxxx-xxxx.xxxpredictive
118Filexxx-xxx/?x=xxxxxxx_xxxxxpredictive
119Filexxxxxxx/xxxxxxx/xxx/xxxxxxxxxx.xxx?xxxxxx=xxxxxxxxxxpredictive
120Filexxxxxxxx.xxxpredictive
121Filexxxxx/xxxxxxx.xxxpredictive
122Filexxxxx.xxxpredictive
123Filexxxxxx.xpredictive
124Filexxxx.xxxpredictive
125Filexxxxx.xxxpredictive
126Filexxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]predictive
127Filexxxxxx-xxxxxxx-xxxxx.xxxpredictive
128Filexxxxxxxx.xxxpredictive
129Filexxxx_xxxx_xxxxxx.xxxpredictive
130Filexxxxxx.xxpredictive
131Filexxxxxx.xxxpredictive
132Filexxxxxx_xxx_xxxxxx.xxxpredictive
133Filexxxx.xxxpredictive
134Filexxxxx/xxxxx.xxxpredictive
135Filexxxxx.xxxpredictive
136Filexxxxx_xxxxx.xxxpredictive
137Filexxxxxxxx.xxxpredictive
138Filexxxxxxx-xxxxxxx.xxxpredictive
139Filexxxxxxxxx/xxxxx/xxxx/xxx_xxxxxxx/xxxxxxx/xxxxxxx.xxxpredictive
140Filexxxxx-xxxx.xxxpredictive
141Filexxxx-xxxxxxxx.xxxpredictive
142Filexxxxxxxxx.xxxpredictive
143Filexxx.xxxpredictive
144Filexxxxxxxxxxx_xxxxx.xxxpredictive
145Filexxxxxx.xxxpredictive
146Filexxxx/xxx/xxxx-xxxxx.xxxpredictive
147Filexxxx-xxxxxxx-xxxxxx.xxxpredictive
148Filexxxx/xxxxxxxxxxxx.xxxpredictive
149Filexxxxxxxxxxpredictive
150Filexxxx_xxxx.xxxpredictive
151Filexxxx_xxxxxxx.xxxpredictive
152Filexxxxxxx/xxxxx.xxxpredictive
153Filexxx/xxxxxxx.xxxpredictive
154Filexxxxxxxx.xxxpredictive
155Filexx-xxxxxxxx/xxxxx-xx-xxxxx.xxxpredictive
156Filexx-xxxxxxxx/xxxxxxxx/xxxxxxx/xxxxxxxxxxxxxxxx.xxxpredictive
157Filexxxxxx.xxxpredictive
158File\xxxxxxxxx\x\xxx_xxxx.xxxpredictive
159File~/.xxxxxxxpredictive
160Libraryxxxxxx[xxxxxx_xxxxpredictive
161Libraryxxx/xx/xxxxx/xxxxxxxxxx/xxxx.xxpredictive
162Libraryxxx/xxxxxxxx.xxpredictive
163Libraryxxx/xxxxxxxx/xxxx.xxxpredictive
164Libraryxxxxxxx_xxxxxx_xxxxxxxpredictive
165Argumentxxxpredictive
166Argumentxxxxxxpredictive
167Argumentxxpredictive
168Argumentxxxxxxx_xxxxpredictive
169Argumentxxxxxx_xxxxpredictive
170Argumentxxxxxxxxpredictive
171Argumentxxxx_xxxpredictive
172Argumentxxx_xxxpredictive
173Argumentxxxpredictive
174Argumentxxxxxxxxpredictive
175Argumentxxxxxpredictive
176Argumentxxx_xxpredictive
177Argumentxxxpredictive
178Argumentxxxx_xxpredictive
179Argumentxxxxxxxpredictive
180Argumentxxxxxxpredictive
181Argumentxxxxxxxxxxpredictive
182Argumentxxxxxx[xxxxxx_xxxx]predictive
183Argumentxxxxxx[xxx_xxxx_xxxx]predictive
184Argumentxxxxxxxpredictive
185Argumentxxxxxpredictive
186Argumentxxxxxxxxxxpredictive
187Argumentxxxxxxxxxxxxxxxxxpredictive
188Argumentxxxxxpredictive
189Argumentxxxxxxxxxxx/xxxxxxxx/xxx/xxxxxpredictive
190Argumentxxxxxx_xxpredictive
191Argumentxxxxxxxxxxxxpredictive
192Argumentxxxxxxxpredictive
193Argumentxxxxxxxxxpredictive
194Argumentxxxx_xxxxxxxxpredictive
195Argumentxxxxxpredictive
196Argumentxxxxxpredictive
197Argumentxxxxxpredictive
198Argumentxxxxxxxxpredictive
199Argumentxxxxxxpredictive
200Argumentxx_xxxxpredictive
201Argumentxxxxxxxpredictive
202Argumentxxpredictive
203Argumentxxxxxxxxpredictive
204Argumentxxxxpredictive
205Argumentxxxpredictive
206Argumentxxxxpredictive
207Argumentxxpredictive
208Argumentxxpredictive
209Argumentxxxxx/xxxxpredictive
210Argumentxxxxx.xxx?xxxxxx=xxx_xxxxxxx/xxxx=xxxxxxx/xx=x/xxxxxxxx=xxxxxpredictive
211Argumentxxxxpredictive
212Argumentxxxxpredictive
213Argumentxxxxxxxx[xx]predictive
214Argumentxxxxxxxpredictive
215Argumentxxxxpredictive
216Argumentxxxx_xxxxpredictive
217Argumentxxxxx_xxxxpredictive
218Argumentxxx_xxxxxxx_xxxpredictive
219Argumentxxx_xxxxpredictive
220Argumentxxxpredictive
221Argumentxx_xxxxxxxxpredictive
222Argumentxxxxxxxxx_xxxxxxxx_xxxxpredictive
223Argumentxxxxpredictive
224Argumentxxxxxpredictive
225Argumentxxxxpredictive
226Argumentxxxxxxxxpredictive
227Argumentxxxx_xx_xx_xxxpredictive
228Argumentxxxx_xx_xxxxxxpredictive
229Argumentxxxxx_xxxx_xxxxpredictive
230Argumentxxxxxpredictive
231Argumentxxxxxxxxpredictive
232Argumentxxxxxxx_xxpredictive
233Argumentxx_xxpredictive
234Argumentxxxxxxx/xxxxxpredictive
235Argumentxxxxxxxx_xx_xxpredictive
236Argumentxxxxxxxxpredictive
237Argumentxxxxxxxxxpredictive
238Argumentxxxxxxxpredictive
239Argumentxxxpredictive
240Argumentxxxxxxpredictive
241Argumentxxxxxx_xxxxxxpredictive
242Argumentxxxxxx_xxxpredictive
243Argumentxxxpredictive
244Argumentxxxx_xxpredictive
245Argumentxxxx_xxxxpredictive
246Argumentxxxxxx[]predictive
247Argumentxxpredictive
248Argumentxxxxxxx/xxxxxxxpredictive
249Argumentxxxxxxxx_xxxxxxxxpredictive
250Argumentxxxx_xxxxxx_xxxxpredictive
251Argumentxxxxxxxxxxpredictive
252Argumentxxxxxxxxxxxxxxxxxxxxxpredictive
253Argumentxxxxxpredictive
254Argumentxxxx_xxpredictive
255Argumentxxxpredictive
256Argumentxxxpredictive
257Argumentxxxxpredictive
258Argumentxxxxxxxxxpredictive
259Argumentxxxxxxxxpredictive
260Argumentxxxxxxxx/xxxxxxxxpredictive
261Argumentxxxx_xxxxpredictive
262Argumentxxxx/xx/xxxx/xxxpredictive
263Argumentxxpredictive
264Argumentxxxxpredictive
265Argumentxxxxpredictive
266Input Value' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)-- xxxxpredictive
267Input Value'xx''='predictive
268Input Value.%xx.../.%xx.../predictive
269Input Value..predictive
270Input Value../../../../../xxx/xxx/xxxxx/xxxx/xxxxxxxx/xxxxx/xxx.xxxpredictive
271Input Value//////////...predictive
272Input Valuex" xxxxxxxxxxx=xxxxxx(xxxxxx) xxx="predictive
273Input Value::$xxxxpredictive
274Input Valuexxxxxxx -xxxpredictive
275Input Valuexxxxxxxxxxpredictive
276Input Value\xxx../../../../xxx/xxxxxxpredictive
277Network Portxxxxpredictive
278Network Portxxxxpredictive
279Network Portxxxx xxxxpredictive
280Network Portxxx/xxxpredictive
281Network Portxxx/xxxpredictive
282Network Portxxx/xxxxpredictive

参考 (21)

The following list contains external sources which discuss the actor and the associated activities:

Do you want to use VulDB in your project?

Use the official API to access entries easily!