ScanBox 分析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (97)

语言

en	84
zh	10
jp	2
ja	2

国家/地区

cn	54
us	34
th	8
ca	2

演员

ScanBox	10
Emotet	1
PhotoLoader	1
Shuckworm	1
UAC-0010	1

利益

类型

Not Defined	46
Content Management System	12
Operating System	8
Web Server	6
Network Attached Storage Software	4

供应商

Not Defined	28
Apple	6
Microsoft	6
Oracle	6
Apache	4

产品

WordPress	4
Microsoft IIS	4
Apple Mac OS X Server	4
WoltLab Burning Book	2
J-Pierre Dezelus Les Visiteurs	2

漏洞

#	漏洞	Base	Temp	0day	今天	易	修正	CTI	EPSS	CVE
1	October CMS fromData 竞争条件	6.8	6.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00405	CVE-2022-24800
2	DeDeCMS recommend.php SQL注入	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.02324	CVE-2017-17731
3	Fortinet FortiOS/FortiPAM/FortiProxy HTTP Request 内存损坏	9.8	9.6	$25k-$100k	$25k-$100k	Not Defined	Official Fix	0.06	0.00091	CVE-2023-42789
4	Oracle Identity Management Suite Apache Log4j 权限升级	9.8	9.7	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.02	0.81948	CVE-2017-5645
5	VMware Cloud Director Privilege Escalation	7.2	6.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.00252	CVE-2022-22966
6	Google Android Lockscreen KeyguardServiceWrapper.java 竞争条件	2.0	1.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00042	CVE-2022-20006
7	Boa Webserver GET wapopen 目录遍历	6.4	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.03	0.73540	CVE-2017-9833
8	Microsoft ASP.NET Forms Authentication 目录遍历	9.8	9.4	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.93976	CVE-2004-0847
9	Oracle MySQL Enterprise Monitor Monitoring 目录遍历	9.1	8.9	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.04	0.00127	CVE-2022-37865
10	SpringBlade SQL注入	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.00171	CVE-2022-27360
11	Cuppa CMS File Manager copy 权限升级	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.00205	CVE-2022-25401
12	JCK Editor links.php SQL注入	8.5	8.3	$0-$5k	$0-$5k	High	Not Defined	0.02	0.81623	CVE-2018-17254
13	Yii Yii2 目录遍历	7.6	7.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00091	CVE-2015-5467
14	Umbraco FeedProxy.aspx.cs Page_Load 权限升级	7.7	7.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	0.00511	CVE-2015-8813
15	WPS Hide Login Plugin Secret Login Page options.php 权限升级	6.9	6.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05	0.02933	CVE-2021-24917
16	jeecg-boot 信息公开	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00703	CVE-2021-37304
17	SSH SSH-1 Protocol 弱加密	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05	0.00258	CVE-2001-1473
18	Linux Kernel nftables nft_byteorder.c nft_byteorder 内存损坏	6.5	6.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	0.00046	CVE-2023-35001
19	emlog index.php 信息公开	5.5	5.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02	0.00300	CVE-2021-3293
20	Linux Kernel DECnet Socket 拒绝服务	5.4	5.2	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00	0.00504	CVE-2023-3338

IOC - Indicator of Compromise (26)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP地址	Hostname	参与者	Identified	类型	可信度
1	1.9.5.38		ScanBox	2020-12-24	verified	高
2	45.77.237.243	45.77.237.243.vultrusercontent.com	ScanBox	2024-02-16	verified	高
3	50.2.24.211		ScanBox	2020-12-24	verified	高
4	66.197.231.62		ScanBox	2021-01-01	verified	高
5	69.197.146.80		ScanBox	2021-01-01	verified	高
6	69.197.183.142	us-mci1-16.renders.prerender.io	ScanBox	2021-01-01	verified	高
7	XX.XXX.XXX.XXX		Xxxxxxx	2021-01-01	verified	高
8	XX.XXX.XXX.XXX		Xxxxxxx	2021-01-01	verified	高
9	XX.XXX.XXX.XXX	xx-xxxx-xx.xxxxxxx.xxxxxxxxx.xx	Xxxxxxx	2021-01-01	verified	高
10	XX.XX.XXX.XXX	xxxxxxxxxxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	2020-12-24	verified	高
11	XXX.XX.XXX.XXX		Xxxxxxx	2020-12-24	verified	高
12	XXX.XXX.XXX.XXX		Xxxxxxx	2020-12-24	verified	高
13	XXX.XX.XX.XXX		Xxxxxxx	2020-12-24	verified	高
14	XXX.XX.XX.XXX		Xxxxxxx	2021-01-01	verified	高
15	XXX.XX.XX.XXX		Xxxxxxx	2024-02-16	verified	高
16	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx	2024-02-16	verified	高
17	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	2024-02-16	verified	高
18	XXX.XXX.XXX.XX	xx.xx.xxxx.xxxxxx.xxxxxxxxx.xxx	Xxxxxxx	2020-12-24	verified	高
19	XXX.XX.XX.XXX	xxxxxxx.xxxxxxxxxxxxxx.xx.xx	Xxxxxxx	2021-01-01	verified	高
20	XXX.XX.XXX.XXX	xxx-xx-xxx-x.xx.xxx.xxxxx-xxxxx.xxxxxxxxxx.xxx	Xxxxxxx	2021-01-01	verified	高
21	XXX.XX.XX.X	xxx-xx-xx-x.xx.xxxxxx.xxxxx-xxxxxx.xxxxxxxxxx.xxx	Xxxxxxx	2021-01-01	verified	高
22	XXX.XX.XXX.XXX	xxx-xx-xxx-x.xx.xxxxxx.xxxxx-xxxxx.xxxxxxxxxx.xxx	Xxxxxxx	2021-01-01	verified	高
23	XXX.XXX.XX.XX	x.x.xxxxx.xx	Xxxxxxx	2021-01-01	verified	高
24	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx	2024-02-16	verified	高
25	XXX.X.XXX.XX		Xxxxxxx	2021-01-01	verified	高
26	XXX.X.XXX.XX		Xxxxxxx	2021-01-01	verified	高

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	漏洞	访问向量	类型	可信度
1	T1006	CWE-22, CWE-23	Path Traversal	predictive	高
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	高
3	T1059	CWE-94	Argument Injection	predictive	高
4	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	高
5	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	高
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
8	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	高
9	TXXXX	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	高
10	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	高
12	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	高
13	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
14	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	高
15	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高

IOA - Indicator of Attack (83)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	分类	Indicator	类型	可信度
1	File	/cgi-bin/wapopen	predictive	高
2	File	/proc/self/setgroups	predictive	高
3	File	/secure/QueryComponent!Default.jspa	predictive	高
4	File	/userRpm/PingIframeRpm.htm	predictive	高
5	File	/webman/info.cgi	predictive	高
6	File	/wp-admin/options.php	predictive	高
7	File	adclick.php	predictive	中
8	File	addentry.php	predictive	中
9	File	and/or	predictive	低
10	File	xxxxxx.xxxxxx.xxx	predictive	高
11	File	xxx.xxx	predictive	低
12	File	xxxxxx.x	predictive	中
13	File	xxx-xxx/xxxxxx	predictive	高
14	File	xxxxxx.xxx.xxx	predictive	高
15	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	高
16	File	xxxx-xxxxx.xxx	predictive	高
17	File	xxxxxxxxx.xxx.xxx	predictive	高
18	File	xxxxxxx.xxx	predictive	中
19	File	xxxxxxxxxxxx_xxxx.xxx	predictive	高
20	File	xxxxxxx/xxxxxxxxxxx.xxx	predictive	高
21	File	xxx/xxxxxx.xxx	predictive	高
22	File	xxxxx.xxx	predictive	中
23	File	xxxx_xxxx.xxx	predictive	高
24	File	xxx.xxxx	predictive	中
25	File	xxxxxxxxx/xxxxxxx/xxxxx.xxx	predictive	高
26	File	xxxxxx/xxx/xxxxxxxx.x	predictive	高
27	File	xxxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	高
28	File	xxxxxx.xxx	predictive	中
29	File	xxx/xxxxxxxxx.xx	predictive	高
30	File	xxxxxx.xxx	predictive	中
31	File	xxx/xxx/xx_xxx.x	predictive	高
32	File	xxx/xxxxxxxxx/xxx_xxxxxxxxx.x	predictive	高
33	File	xxxxxxx.xxx	predictive	中
34	File	xxxxxxxxxx.xxx	predictive	高
35	File	xxxx/xxxxxxxxx.xxx	predictive	高
36	File	xxxxx.xxx	predictive	中
37	File	xxxxxxxxxxxxxxx.xxx	predictive	高
38	File	xxxxxxxxxxxxxxxxxx.xxx	predictive	高
39	File	xxxxxxxx.xxx	predictive	中
40	File	xxxxxxxxxxxxxxx.xxx	predictive	高
41	File	x/xxxxx.xxx	predictive	中
42	File	xxx_xxxx_xxxxxx.xxx	predictive	高
43	File	xxxxxxx.xxx/xxxxxxx.xxxxxxxxxxxx/xxxxxxx/xxxxxxxxx/xxxxxxxxx.xxxx.xx	predictive	高
44	File	xxxx-xxxxxxx.xxx	predictive	高
45	File	xxxx.xxxxx.xxxxxx	predictive	高
46	File	xx-xxxxx.xxx	predictive	中
47	Library	xxx/xxxxxxxxx.xx	predictive	高
48	Library	xxxx.xxxxx	predictive	中
49	Argument	$_xxxxx	predictive	低
50	Argument	xxxxx_xxxx	predictive	中
51	Argument	xxxxxxxx	predictive	中
52	Argument	xxxxxxxx	predictive	中
53	Argument	xxxxxxxxxx	predictive	中
54	Argument	xxxxx	predictive	低
55	Argument	xxxx_xx	predictive	低
56	Argument	xxxxxxxxxxxxxxxx	predictive	高
57	Argument	x_xx	predictive	低
58	Argument	xxxxxxxxxx	predictive	中
59	Argument	xxxxxxxx	predictive	中
60	Argument	xxxx	predictive	低
61	Argument	xxxx/xxxxxx/xxx	predictive	高
62	Argument	xx	predictive	低
63	Argument	xxxxxxxx	predictive	中
64	Argument	xxx_xxxxxxx_xxx	predictive	高
65	Argument	xxxx/xxxxxxxx/xxx/xxx/xxxxxxxx/xxxxxxx	predictive	高
66	Argument	xxxxxxxxxxxxxxxxxxxxxxx	predictive	高
67	Argument	xxxxxx	predictive	低
68	Argument	xxxx	predictive	低
69	Argument	xxxxxxxx	predictive	中
70	Argument	xxxxxx	predictive	低
71	Argument	xxxx_xxxxx	predictive	中
72	Argument	xxxxxxxxxx_xxxx	predictive	高
73	Argument	xxxxxxxxxxx	predictive	中
74	Argument	xxxx	predictive	低
75	Argument	xxxxxx	predictive	低
76	Argument	xxxxxxxxx: x	predictive	中
77	Argument	xxx	predictive	低
78	Argument	xxxxxx	predictive	低
79	Argument	xxxxxxxx	predictive	中
80	Argument	xxxxxxxx/xxxxxxxx	predictive	高
81	Argument	xxxx	predictive	低
82	Input Value	../..	predictive	低
83	Network Port	xxx/xxxx	predictive	中

参考 (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ 上一步一览下一步 ▸

Do you need the next level of professionalism?

Upgrade your account now!