Update
This commit is contained in:
parent
7622f0a54f
commit
5dbba81936
|
@ -63,12 +63,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 3 more TTP items available. Please use our online service to access the data.
|
||||
There are 15 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -107,8 +108,7 @@ ID | Type | Indicator | Confidence
|
|||
29 | File | `admin/pageUploadCSV.php` | High
|
||||
30 | File | `ajax_udf.php` | Medium
|
||||
31 | File | `AppCompatCache.exe` | High
|
||||
32 | File | `application.js.php` | High
|
||||
33 | ... | ... | ...
|
||||
32 | ... | ... | ...
|
||||
|
||||
There are 277 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
|
|
|
@ -19,7 +19,7 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
* [CN](https://vuldb.com/?country.cn)
|
||||
* ...
|
||||
|
||||
There are 4 more country items available. Please use our online service to access the data.
|
||||
There are 5 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
|
|
@ -42,12 +42,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264 | Execution with Unnecessary Privileges | High
|
||||
3 | T1211 | CWE-254 | 7PK Security Features | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
3 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 1 more TTP items available. Please use our online service to access the data.
|
||||
There are 6 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -24,7 +24,7 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
* [US](https://vuldb.com/?country.us)
|
||||
* ...
|
||||
|
||||
There are 4 more country items available. Please use our online service to access the data.
|
||||
There are 3 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -111,13 +111,13 @@ ID | Type | Indicator | Confidence
|
|||
6 | File | `/medical/inventories.php` | High
|
||||
7 | File | `/mgmt/tm/util/bash` | High
|
||||
8 | File | `/monitoring` | Medium
|
||||
9 | File | `/plugins/servlet/audit/resource` | High
|
||||
10 | File | `/plugins/servlet/project-config/PROJECT/roles` | High
|
||||
11 | File | `/REBOOTSYSTEM` | High
|
||||
12 | File | `/replication` | Medium
|
||||
13 | File | `/reports/rwservlet` | High
|
||||
14 | File | `/RestAPI` | Medium
|
||||
15 | File | `/tmp` | Low
|
||||
9 | File | `/plugin/LiveChat/getChat.json.php` | High
|
||||
10 | File | `/plugins/servlet/audit/resource` | High
|
||||
11 | File | `/plugins/servlet/project-config/PROJECT/roles` | High
|
||||
12 | File | `/REBOOTSYSTEM` | High
|
||||
13 | File | `/replication` | Medium
|
||||
14 | File | `/reports/rwservlet` | High
|
||||
15 | File | `/RestAPI` | Medium
|
||||
16 | File | `/tmp/speedtest_urls.xml` | High
|
||||
17 | File | `/tmp/zarafa-vacation-*` | High
|
||||
18 | File | `/uncpath/` | Medium
|
||||
|
@ -127,15 +127,14 @@ ID | Type | Indicator | Confidence
|
|||
22 | File | `/var/run/watchman.pid` | High
|
||||
23 | File | `/wp-json/wc/v3/webhooks` | High
|
||||
24 | File | `admin-ajax.php?action=get_wdtable order[0][dir]` | High
|
||||
25 | File | `admin/app/mediamanager` | High
|
||||
26 | File | `admin\model\catalog\download.php` | High
|
||||
27 | File | `afr.php` | Low
|
||||
28 | File | `apcupsd.pid` | Medium
|
||||
29 | File | `api/it-recht-kanzlei/api-it-recht-kanzlei.php` | High
|
||||
30 | File | `api/sms/send-sms` | High
|
||||
31 | ... | ... | ...
|
||||
25 | File | `AdxDSrv.exe` | Medium
|
||||
26 | File | `afr.php` | Low
|
||||
27 | File | `apcupsd.pid` | Medium
|
||||
28 | File | `api/it-recht-kanzlei/api-it-recht-kanzlei.php` | High
|
||||
29 | File | `api/sms/send-sms` | High
|
||||
30 | ... | ... | ...
|
||||
|
||||
There are 263 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 258 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -20,11 +20,11 @@ There are 1 more campaign items available. Please use our online service to acce
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with APT29:
|
||||
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* ...
|
||||
|
||||
There are 21 more country items available. Please use our online service to access the data.
|
||||
There are 16 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -67,7 +67,8 @@ ID | Technique | Weakness | Description | Confidence
|
|||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 18 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
|
@ -83,38 +84,34 @@ ID | Type | Indicator | Confidence
|
|||
4 | File | `/admin/login.php` | High
|
||||
5 | File | `/admin/produts/controller.php` | High
|
||||
6 | File | `/Ap4RtpAtom.cpp` | High
|
||||
7 | File | `/bcms/admin/?page=user/list` | High
|
||||
8 | File | `/bsms/?page=manage_account` | High
|
||||
9 | File | `/cgi-bin/login.cgi` | High
|
||||
10 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
11 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
12 | File | `/dashboard/reports/logs/view` | High
|
||||
13 | File | `/debug/pprof` | Medium
|
||||
14 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
15 | File | `/fuel/sitevariables/delete/4` | High
|
||||
16 | File | `/goform/aspForm` | High
|
||||
17 | File | `/hocms/classes/Master.php?f=delete_collection` | High
|
||||
18 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
19 | File | `/index/jobfairol/show/` | High
|
||||
20 | File | `/librarian/bookdetails.php` | High
|
||||
21 | File | `/mgmt/tm/util/bash` | High
|
||||
22 | File | `/monitoring` | Medium
|
||||
23 | File | `/ms/cms/content/list.do` | High
|
||||
24 | File | `/new` | Low
|
||||
25 | File | `/orms/` | Low
|
||||
26 | File | `/plesk-site-preview/` | High
|
||||
27 | File | `/proc/<pid>/status` | High
|
||||
28 | File | `/public/plugins/` | High
|
||||
29 | File | `/school/model/get_admin_profile.php` | High
|
||||
30 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
31 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
32 | File | `/simple_chat_bot/admin/?page=user/manage_user` | High
|
||||
33 | File | `/src/main/java/com/dotmarketing/filters/CMSFilter.java` | High
|
||||
34 | File | `/student-grading-system/rms.php?page=grade` | High
|
||||
35 | File | `/timeline2.php` | High
|
||||
36 | ... | ... | ...
|
||||
7 | File | `/app/options.py` | High
|
||||
8 | File | `/bcms/admin/?page=user/list` | High
|
||||
9 | File | `/bsms/?page=manage_account` | High
|
||||
10 | File | `/cgi-bin/login.cgi` | High
|
||||
11 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
12 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
13 | File | `/dashboard/reports/logs/view` | High
|
||||
14 | File | `/debug/pprof` | Medium
|
||||
15 | File | `/etc/hosts` | Medium
|
||||
16 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
17 | File | `/fuel/sitevariables/delete/4` | High
|
||||
18 | File | `/goform/aspForm` | High
|
||||
19 | File | `/hocms/classes/Master.php?f=delete_collection` | High
|
||||
20 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
21 | File | `/index/jobfairol/show/` | High
|
||||
22 | File | `/librarian/bookdetails.php` | High
|
||||
23 | File | `/mgmt/tm/util/bash` | High
|
||||
24 | File | `/ms/cms/content/list.do` | High
|
||||
25 | File | `/new` | Low
|
||||
26 | File | `/orms/` | Low
|
||||
27 | File | `/plesk-site-preview/` | High
|
||||
28 | File | `/proc/<PID>/mem` | High
|
||||
29 | File | `/proc/<pid>/status` | High
|
||||
30 | File | `/public/plugins/` | High
|
||||
31 | File | `/school/model/get_admin_profile.php` | High
|
||||
32 | ... | ... | ...
|
||||
|
||||
There are 304 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 273 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -30,7 +30,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1222 | CWE-275 | Permission Issues | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
3 | T1068 | CWE-269 | Execution with Unnecessary Privileges | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 5 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -50,12 +50,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 6 more TTP items available. Please use our online service to access the data.
|
||||
There are 18 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -17,8 +17,8 @@ The following _campaigns_ are known and can be associated with APT33:
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with APT33:
|
||||
|
||||
* [PT](https://vuldb.com/?country.pt)
|
||||
* [FR](https://vuldb.com/?country.fr)
|
||||
* [SV](https://vuldb.com/?country.sv)
|
||||
* [DE](https://vuldb.com/?country.de)
|
||||
* ...
|
||||
|
||||
There are 7 more country items available. Please use our online service to access the data.
|
||||
|
@ -55,12 +55,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
2 | T1040 | CWE-294, CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 16 more TTP items available. Please use our online service to access the data.
|
||||
There are 17 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -68,40 +68,36 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `../FILEDIR` | Medium
|
||||
2 | File | `/(((a\2)|(a*)\g</-1>/))*/` | High
|
||||
3 | File | `/admin/?page=system_info/contact_info` | High
|
||||
4 | File | `/admin/add_post.php` | High
|
||||
5 | File | `/admin/conferences/list/` | High
|
||||
6 | File | `/admin/dl_sendmail.php` | High
|
||||
7 | File | `/admin/featured.php` | High
|
||||
8 | File | `/admin/general.cgi` | High
|
||||
9 | File | `/admin/general/change-lang` | High
|
||||
10 | File | `/admin/renewaldue.php` | High
|
||||
11 | File | `/admin/showbad.php` | High
|
||||
12 | File | `/admin/ztliuyan_sendmail.php` | High
|
||||
13 | File | `/ajax/config_rollback/` | High
|
||||
14 | File | `/ajax/remove_sniffer_raw_log/` | High
|
||||
15 | File | `/Ap4RtpAtom.cpp` | High
|
||||
16 | File | `/bcms/admin/?page=reports/daily_sales_report` | High
|
||||
17 | File | `/bsms/?page=manage_account` | High
|
||||
18 | File | `/car-rental-management-system/admin/manage_booking.php` | High
|
||||
19 | File | `/car-rental-management-system/admin/manage_user.php` | High
|
||||
20 | File | `/category.php` | High
|
||||
21 | File | `/cgi-bin` | Medium
|
||||
22 | File | `/checklogin.jsp` | High
|
||||
23 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
24 | File | `/classes/Master.php?f=delete_schedule` | High
|
||||
25 | File | `/dashboard/blocks/stacks/view_details/` | High
|
||||
26 | File | `/ffos/admin/sales/receipt.php` | High
|
||||
27 | File | `/goform/aspForm` | High
|
||||
28 | File | `/goform/RgDhcp` | High
|
||||
29 | File | `/goform/RgUrlBlock.asp` | High
|
||||
30 | File | `/hprms/admin/rooms/manage_room.php` | High
|
||||
31 | File | `/hprms/admin/rooms/view_room.php` | High
|
||||
32 | ... | ... | ...
|
||||
1 | File | `/(((a\2)|(a*)\g</-1>/))*/` | High
|
||||
2 | File | `/admin/conferences/list/` | High
|
||||
3 | File | `/admin/dl_sendmail.php` | High
|
||||
4 | File | `/admin/featured.php` | High
|
||||
5 | File | `/admin/general.cgi` | High
|
||||
6 | File | `/admin/general/change-lang` | High
|
||||
7 | File | `/admin/renewaldue.php` | High
|
||||
8 | File | `/admin/showbad.php` | High
|
||||
9 | File | `/admin/ztliuyan_sendmail.php` | High
|
||||
10 | File | `/ajax/config_rollback/` | High
|
||||
11 | File | `/ajax/remove_sniffer_raw_log/` | High
|
||||
12 | File | `/bsms/?page=manage_account` | High
|
||||
13 | File | `/category.php` | High
|
||||
14 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
15 | File | `/ci_spms/admin/category` | High
|
||||
16 | File | `/classes/Master.php?f=delete_schedule` | High
|
||||
17 | File | `/dashboard/blocks/stacks/view_details/` | High
|
||||
18 | File | `/dashboard/menu-list.php` | High
|
||||
19 | File | `/dev/pts/` | Medium
|
||||
20 | File | `/ffos/classes/Master.php?f=save_category` | High
|
||||
21 | File | `/film-rating.php` | High
|
||||
22 | File | `/jfinal_cms/system/dict/list` | High
|
||||
23 | File | `/list` | Low
|
||||
24 | File | `/mnotice.php?id=2` | High
|
||||
25 | File | `/orrs/admin/reservations/view_details.php` | High
|
||||
26 | File | `/pms/admin/actions/manage_action.php` | High
|
||||
27 | File | `/pms/admin/inmates/view_inmate.php` | High
|
||||
28 | ... | ... | ...
|
||||
|
||||
There are 277 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 240 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -20,7 +20,7 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
* [RU](https://vuldb.com/?country.ru)
|
||||
* ...
|
||||
|
||||
There are 13 more country items available. Please use our online service to access the data.
|
||||
There are 14 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -50,12 +50,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 5 more TTP items available. Please use our online service to access the data.
|
||||
There are 16 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -63,36 +64,41 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/etc/sudoers` | Medium
|
||||
2 | File | `/forum/away.php` | High
|
||||
3 | File | `/inc/HTTPClient.php` | High
|
||||
4 | File | `/out.php` | Medium
|
||||
5 | File | `/products/details.asp` | High
|
||||
6 | File | `/service/upload` | High
|
||||
7 | File | `/uncpath/` | Medium
|
||||
8 | File | `adclick.php` | Medium
|
||||
9 | File | `add_comment.php` | High
|
||||
10 | File | `admin/system_manage/save.html` | High
|
||||
11 | File | `admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list` | High
|
||||
12 | File | `administrator/components/com_media/helpers/media.php` | High
|
||||
13 | File | `arm/t7xx/r5p0/mali_kbase_core_linux.c` | High
|
||||
14 | File | `awstats.pl` | Medium
|
||||
15 | File | `books.php` | Medium
|
||||
16 | File | `bridge/yabbse.inc.php` | High
|
||||
17 | File | `cachemgr.cgi` | Medium
|
||||
18 | File | `captcha.php` | Medium
|
||||
19 | File | `catagorie.php` | High
|
||||
20 | File | `category.php` | Medium
|
||||
21 | File | `cgi-bin/` | Medium
|
||||
22 | File | `cgi-bin/cmh/webcam.sh` | High
|
||||
23 | File | `channels/chan_skinny.c` | High
|
||||
24 | File | `clwarn.cgi` | Medium
|
||||
25 | File | `coders/dcm.c` | Medium
|
||||
26 | File | `comment_add.asp` | High
|
||||
27 | File | `content.php` | Medium
|
||||
28 | ... | ... | ...
|
||||
1 | File | `/admin` | Low
|
||||
2 | File | `/admin/conferences/get-all-status/` | High
|
||||
3 | File | `/admin/conferences/list/` | High
|
||||
4 | File | `/admin/countrymanagement.php` | High
|
||||
5 | File | `/admin/general/change-lang` | High
|
||||
6 | File | `/admin/group/list/` | High
|
||||
7 | File | `/admin/renewaldue.php` | High
|
||||
8 | File | `/admin/usermanagement.php` | High
|
||||
9 | File | `/backups/` | Medium
|
||||
10 | File | `/catcompany.php` | High
|
||||
11 | File | `/etc/sudoers` | Medium
|
||||
12 | File | `/forum/away.php` | High
|
||||
13 | File | `/front/roomtype-details.php` | High
|
||||
14 | File | `/inc/HTTPClient.php` | High
|
||||
15 | File | `/lists/admin/` | High
|
||||
16 | File | `/mcategory.php` | High
|
||||
17 | File | `/out.php` | Medium
|
||||
18 | File | `/products/details.asp` | High
|
||||
19 | File | `/real-estate-script/search_property.php` | High
|
||||
20 | File | `/service/upload` | High
|
||||
21 | File | `/sitemagic/index.php` | High
|
||||
22 | File | `/siteminderagent/pwcgi/smpwservicescgi.exe` | High
|
||||
23 | File | `/TeleoptiWFM/Administration/GetOneTenant` | High
|
||||
24 | File | `/uncpath/` | Medium
|
||||
25 | File | `/var/run/watchman.pid` | High
|
||||
26 | File | `/wbg/core/_includes/authorization.inc.php` | High
|
||||
27 | File | `/wolfcms/?/admin/user/add` | High
|
||||
28 | File | `adclick.php` | Medium
|
||||
29 | File | `add_comment.php` | High
|
||||
30 | File | `admin/app/mediamanager` | High
|
||||
31 | File | `admin/manage-ticket.php` | High
|
||||
32 | File | `admin/system_manage/save.html` | High
|
||||
33 | ... | ... | ...
|
||||
|
||||
There are 236 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 279 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -41,9 +41,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264 | Execution with Unnecessary Privileges | High
|
||||
3 | T1600 | CWE-310 | Cryptographic Issues | High
|
||||
1 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
2 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
3 | T1068 | CWE-264 | Execution with Unnecessary Privileges | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 4 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -34,7 +34,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
1 | T1055 | CWE-74 | Injection | High
|
||||
2 | T1068 | CWE-264, CWE-269, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1505 | CWE-89 | SQL Injection | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 3 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -16,10 +16,10 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [RU](https://vuldb.com/?country.ru)
|
||||
* [IR](https://vuldb.com/?country.ir)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* ...
|
||||
|
||||
There are 19 more country items available. Please use our online service to access the data.
|
||||
There are 20 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -40,12 +40,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1211 | CWE-254 | 7PK Security Features | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 2 more TTP items available. Please use our online service to access the data.
|
||||
There are 14 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -55,15 +56,16 @@ ID | Type | Indicator | Confidence
|
|||
-- | ---- | --------- | ----------
|
||||
1 | File | `//etc/RT2870STA.dat` | High
|
||||
2 | File | `/admin/index.php?id=themes&action=edit_template&filename=blog` | High
|
||||
3 | File | `/cwp_{SESSION_HASH}/admin/loader_ajax.php` | High
|
||||
4 | File | `/jquery_file_upload/server/php/index.php` | High
|
||||
5 | File | `/magnoliaPublic/travel/members/login.html` | High
|
||||
6 | File | `/Main_AdmStatus_Content.asp` | High
|
||||
7 | File | `/server-status` | High
|
||||
8 | File | `/uncpath/` | Medium
|
||||
9 | ... | ... | ...
|
||||
3 | File | `/bin/boa` | Medium
|
||||
4 | File | `/cwp_{SESSION_HASH}/admin/loader_ajax.php` | High
|
||||
5 | File | `/jquery_file_upload/server/php/index.php` | High
|
||||
6 | File | `/magnoliaPublic/travel/members/login.html` | High
|
||||
7 | File | `/Main_AdmStatus_Content.asp` | High
|
||||
8 | File | `/server-status` | High
|
||||
9 | File | `/uncpath/` | Medium
|
||||
10 | ... | ... | ...
|
||||
|
||||
There are 63 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 70 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -121,7 +121,7 @@ ID | Type | Indicator | Confidence
|
|||
43 | File | `admin.php/comments/batchdel/` | High
|
||||
44 | ... | ... | ...
|
||||
|
||||
There are 379 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 382 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -35,9 +35,10 @@ ID | IP address | Hostname | Campaign | Confidence
|
|||
6 | [45.156.25.78](https://vuldb.com/?ip.45.156.25.78) | - | - | High
|
||||
7 | [50.17.5.224](https://vuldb.com/?ip.50.17.5.224) | ec2-50-17-5-224.compute-1.amazonaws.com | - | Medium
|
||||
8 | [51.68.128.171](https://vuldb.com/?ip.51.68.128.171) | ip171.ip-51-68-128.eu | - | High
|
||||
9 | ... | ... | ... | ...
|
||||
9 | [51.89.183.99](https://vuldb.com/?ip.51.89.183.99) | 90.eri1.ovh.abcd.network | - | High
|
||||
10 | ... | ... | ... | ...
|
||||
|
||||
There are 30 more IOC items available. Please use our online service to access the data.
|
||||
There are 34 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
|
@ -101,10 +102,9 @@ ID | Type | Indicator | Confidence
|
|||
40 | File | `books.php` | Medium
|
||||
41 | File | `btif_hd.cc` | Medium
|
||||
42 | File | `cart.php` | Medium
|
||||
43 | File | `cart_add.php` | Medium
|
||||
44 | ... | ... | ...
|
||||
43 | ... | ... | ...
|
||||
|
||||
There are 384 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 376 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
@ -119,6 +119,10 @@ The following list contains _external sources_ which discuss the actor and the a
|
|||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-09-07%20Agent%20Tesla%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-09-17%20Agent%20Tesla%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-09-20%20Agent%20Tesla%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-10-14%20Agent%20Tesla%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-04-22%20AgentTesla%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-04-22%20AgentTesla%20IOCs%20Rd2
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-20%20Agent%20Tesla%20IOCs
|
||||
* https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/AgentTesla/IOCs
|
||||
* https://services.global.ntt/en-us/insights/blog/discovering-a-new-agent-tesla-malware-sample
|
||||
* https://www.fortinet.com/blog/threat-research/phishing-campaign-targeting-korean-to-deliver-agent-tesla-new-variant
|
||||
|
|
|
@ -37,6 +37,10 @@ ID | Technique | Weakness | Description | Confidence
|
|||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1202 | CWE-77 | Command Injection | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 4 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -34,8 +34,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
1 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
2 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
3 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 3 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -34,12 +34,14 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-250, CWE-264, CWE-266, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23, CWE-24 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 9 more TTP items available. Please use our online service to access the data.
|
||||
There are 20 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -52,50 +54,51 @@ ID | Type | Indicator | Confidence
|
|||
3 | File | `/.ssh/authorized_keys` | High
|
||||
4 | File | `/admin/default.asp` | High
|
||||
5 | File | `/ajax/networking/get_netcfg.php` | High
|
||||
6 | File | `/assets/ctx` | Medium
|
||||
7 | File | `/cgi-bin/login_action.cgi` | High
|
||||
8 | File | `/cgi-bin/supervisor/PwdGrp.cgi` | High
|
||||
9 | File | `/checkLogin.cgi` | High
|
||||
10 | File | `/cms/print.php` | High
|
||||
11 | File | `/concat?/%2557EB-INF/web.xml` | High
|
||||
12 | File | `/Content/Template/root/reverse-shell.aspx` | High
|
||||
13 | File | `/data/remove` | Medium
|
||||
14 | File | `/etc/passwd` | Medium
|
||||
15 | File | `/goforms/rlminfo` | High
|
||||
16 | File | `/login` | Low
|
||||
17 | File | `/navigate/navigate_download.php` | High
|
||||
18 | File | `/ocwbs/admin/?page=user/manage_user` | High
|
||||
19 | File | `/ofrs/admin/?page=user/manage_user` | High
|
||||
20 | File | `/oputilsServlet` | High
|
||||
21 | File | `/out.php` | Medium
|
||||
22 | File | `/owa/auth/logon.aspx` | High
|
||||
23 | File | `/p` | Low
|
||||
24 | File | `/password.html` | High
|
||||
25 | File | `/proc/ioports` | High
|
||||
26 | File | `/property-list/property_view.php` | High
|
||||
27 | File | `/ptms/classes/Users.php` | High
|
||||
28 | File | `/rest` | Low
|
||||
29 | File | `/rest/api/2/search` | High
|
||||
30 | File | `/s/` | Low
|
||||
31 | File | `/scripts/cpan_config` | High
|
||||
32 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
33 | File | `/services/system/setup.json` | High
|
||||
34 | File | `/uncpath/` | Medium
|
||||
35 | File | `/vloggers_merch/?p=view_product` | High
|
||||
36 | File | `/webconsole/APIController` | High
|
||||
37 | File | `/websocket/exec` | High
|
||||
38 | File | `/wp-admin/admin-ajax.php` | High
|
||||
39 | File | `/wp-json` | Medium
|
||||
40 | File | `/wp-json/oembed/1.0/embed?url` | High
|
||||
41 | File | `/_next` | Low
|
||||
42 | File | `4.edu.php\conn\function.php` | High
|
||||
43 | File | `14all.cgi/14all-1.1.cgi/traffic.cgi/mrtg.cgi` | High
|
||||
44 | File | `adclick.php` | Medium
|
||||
45 | File | `addentry.php` | Medium
|
||||
46 | File | `admin/category.inc.php` | High
|
||||
47 | ... | ... | ...
|
||||
6 | File | `/app/options.py` | High
|
||||
7 | File | `/assets/ctx` | Medium
|
||||
8 | File | `/cgi-bin/login_action.cgi` | High
|
||||
9 | File | `/cgi-bin/supervisor/PwdGrp.cgi` | High
|
||||
10 | File | `/checkLogin.cgi` | High
|
||||
11 | File | `/ci_spms/admin/category` | High
|
||||
12 | File | `/ci_spms/admin/search/searching/` | High
|
||||
13 | File | `/classes/Master.php?f=delete_train` | High
|
||||
14 | File | `/cms/print.php` | High
|
||||
15 | File | `/concat?/%2557EB-INF/web.xml` | High
|
||||
16 | File | `/Content/Template/root/reverse-shell.aspx` | High
|
||||
17 | File | `/data/remove` | Medium
|
||||
18 | File | `/etc/passwd` | Medium
|
||||
19 | File | `/goforms/rlminfo` | High
|
||||
20 | File | `/login` | Low
|
||||
21 | File | `/navigate/navigate_download.php` | High
|
||||
22 | File | `/ocwbs/admin/?page=user/manage_user` | High
|
||||
23 | File | `/ofrs/admin/?page=user/manage_user` | High
|
||||
24 | File | `/oputilsServlet` | High
|
||||
25 | File | `/owa/auth/logon.aspx` | High
|
||||
26 | File | `/p` | Low
|
||||
27 | File | `/password.html` | High
|
||||
28 | File | `/proc/ioports` | High
|
||||
29 | File | `/property-list/property_view.php` | High
|
||||
30 | File | `/ptms/classes/Users.php` | High
|
||||
31 | File | `/rest` | Low
|
||||
32 | File | `/rest/api/2/search` | High
|
||||
33 | File | `/s/` | Low
|
||||
34 | File | `/scripts/cpan_config` | High
|
||||
35 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
36 | File | `/services/system/setup.json` | High
|
||||
37 | File | `/spip.php` | Medium
|
||||
38 | File | `/uncpath/` | Medium
|
||||
39 | File | `/vloggers_merch/?p=view_product` | High
|
||||
40 | File | `/webconsole/APIController` | High
|
||||
41 | File | `/websocket/exec` | High
|
||||
42 | File | `/wp-admin/admin-ajax.php` | High
|
||||
43 | File | `/wp-json` | Medium
|
||||
44 | File | `/wp-json/oembed/1.0/embed?url` | High
|
||||
45 | File | `/_next` | Low
|
||||
46 | File | `4.edu.php\conn\function.php` | High
|
||||
47 | File | `14all.cgi/14all-1.1.cgi/traffic.cgi/mrtg.cgi` | High
|
||||
48 | ... | ... | ...
|
||||
|
||||
There are 407 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 412 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -56,9 +56,11 @@ ID | IP address | Hostname | Campaign | Confidence
|
|||
26 | [40.112.72.205](https://vuldb.com/?ip.40.112.72.205) | - | - | High
|
||||
27 | [40.113.200.201](https://vuldb.com/?ip.40.113.200.201) | - | - | High
|
||||
28 | [45.14.226.23](https://vuldb.com/?ip.45.14.226.23) | - | - | High
|
||||
29 | ... | ... | ... | ...
|
||||
29 | [45.71.112.70](https://vuldb.com/?ip.45.71.112.70) | host-45-71-112-70.nedetel.net | - | High
|
||||
30 | [45.76.254.23](https://vuldb.com/?ip.45.76.254.23) | 45.76.254.23.vultr.com | - | Medium
|
||||
31 | ... | ... | ... | ...
|
||||
|
||||
There are 112 more IOC items available. Please use our online service to access the data.
|
||||
There are 121 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
|
@ -66,12 +68,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1552 | CWE-319, CWE-522 | Unprotected Storage of Credentials | High
|
||||
1 | T1006 | CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 1 more TTP items available. Please use our online service to access the data.
|
||||
There are 11 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -100,10 +102,16 @@ The following list contains _external sources_ which discuss the actor and the a
|
|||
* https://blog.talosintelligence.com/2021/05/threat-roundup-0514-0521.html
|
||||
* https://blog.talosintelligence.com/2022/02/threat-roundup-0211-0218.html
|
||||
* https://blog.talosintelligence.com/2022/03/threat-roundup-0311-0318.html
|
||||
* https://blogs.infoblox.com/cyber-threat-intelligence/ransomware-attacks-target-healthcare-sector/
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-08-16%20BazarLoader%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-08-17%20BazarLoader%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-09-03%20BazarLoader%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-09-08%20BazarCall%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-10-12%20BazarLoader%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-10-13%20BazarLoader%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-11-18%20BazarLoader%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-12-02%20BazarLoader%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-01-24%20Bazarloader%20IOCs
|
||||
* https://isc.sans.edu/forums/diary/April+2021+Forensic+Quiz+Answers+and+Analysis/27308/
|
||||
* https://isc.sans.edu/forums/diary/Stolen+Images+Evidence+Campaign+Continues+Pushing+BazarLoader+Malware/27816/
|
||||
* https://isc.sans.edu/forums/diary/TA551+Shathak+continues+pushing+BazarLoader+infections+lead+to+Cobalt+Strike/27738/
|
||||
|
|
|
@ -36,6 +36,9 @@ ID | Technique | Weakness | Description | Confidence
|
|||
1 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264 | Execution with Unnecessary Privileges | High
|
||||
3 | T1548.002 | CWE-285 | Improper Authorization | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 1 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -39,12 +39,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 3 more TTP items available. Please use our online service to access the data.
|
||||
There are 13 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -34,12 +34,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-266, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 6 more TTP items available. Please use our online service to access the data.
|
||||
There are 16 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -73,7 +74,7 @@ ID | Type | Indicator | Confidence
|
|||
24 | File | `authent.php4` | Medium
|
||||
25 | ... | ... | ...
|
||||
|
||||
There are 212 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 213 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -27,6 +27,16 @@ ID | IP address | Hostname | Campaign | Confidence
|
|||
1 | [62.171.157.185](https://vuldb.com/?ip.62.171.157.185) | vmi479022.contaboserver.net | Afghanistan and India | High
|
||||
2 | [95.111.241.233](https://vuldb.com/?ip.95.111.241.233) | vmi698587.contaboserver.net | Afghanistan and India | High
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
_Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK techniques used by _Bunse_. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1055 | CWE-74 | Injection | High
|
||||
2 | T1505 | CWE-89 | SQL Injection | High
|
||||
3 | T1592 | CWE-200 | Configuration | High
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
These _indicators of attack_ (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Bunse. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
|
|
@ -73,12 +73,14 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-250, CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-307, CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 6 more TTP items available. Please use our online service to access the data.
|
||||
There are 19 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -124,7 +126,7 @@ ID | Type | Indicator | Confidence
|
|||
36 | File | `admin/conf_users_edit.php` | High
|
||||
37 | ... | ... | ...
|
||||
|
||||
There are 318 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 321 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -41,7 +41,8 @@ ID | Technique | Weakness | Description | Confidence
|
|||
2 | T1040 | CWE-294 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 18 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
|
@ -82,7 +83,7 @@ ID | Type | Indicator | Confidence
|
|||
29 | File | `admin.php` | Medium
|
||||
30 | ... | ... | ...
|
||||
|
||||
There are 257 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 259 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -15,12 +15,12 @@ The following _campaigns_ are known and can be associated with Charming Kitten:
|
|||
|
||||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Charming Kitten:
|
||||
|
||||
* [NL](https://vuldb.com/?country.nl)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [NL](https://vuldb.com/?country.nl)
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* ...
|
||||
|
||||
There are 18 more country items available. Please use our online service to access the data.
|
||||
There are 17 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -60,12 +60,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-266, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-307, CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 6 more TTP items available. Please use our online service to access the data.
|
||||
There are 16 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -73,38 +74,40 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `.travis.yml` | Medium
|
||||
2 | File | `//proc/kcore` | Medium
|
||||
3 | File | `/Ap4RtpAtom.cpp` | High
|
||||
4 | File | `/bcms/admin/?page=user/list` | High
|
||||
5 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
6 | File | `/debug/pprof` | Medium
|
||||
7 | File | `/file?action=download&file` | High
|
||||
8 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
9 | File | `/fuel/sitevariables/delete/4` | High
|
||||
10 | File | `/mgmt/tm/util/bash` | High
|
||||
11 | File | `/monitoring` | Medium
|
||||
12 | File | `/new` | Low
|
||||
13 | File | `/plugins/servlet/audit/resource` | High
|
||||
14 | File | `/plugins/servlet/project-config/PROJECT/roles` | High
|
||||
15 | File | `/proc/<pid>/status` | High
|
||||
16 | File | `/public/plugins/` | High
|
||||
17 | File | `/replication` | Medium
|
||||
18 | File | `/RestAPI` | Medium
|
||||
19 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
20 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
21 | File | `/simple_chat_bot/admin/?page=user/manage_user` | High
|
||||
22 | File | `/src/main/java/com/dotmarketing/filters/CMSFilter.java` | High
|
||||
23 | File | `/tmp` | Low
|
||||
24 | File | `/tmp/zarafa-vacation-*` | High
|
||||
25 | File | `/uncpath/` | Medium
|
||||
26 | File | `/upload` | Low
|
||||
27 | File | `/var/log/nginx` | High
|
||||
28 | File | `/views/directive/sys/SysConfigDataDirective.java` | High
|
||||
29 | File | `/wp-json/wc/v3/webhooks` | High
|
||||
30 | ... | ... | ...
|
||||
1 | File | `//proc/kcore` | Medium
|
||||
2 | File | `/Ap4RtpAtom.cpp` | High
|
||||
3 | File | `/bcms/admin/?page=user/list` | High
|
||||
4 | File | `/bsms/?page=manage_account` | High
|
||||
5 | File | `/cgi-bin/login.cgi` | High
|
||||
6 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
7 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
8 | File | `/core/conditions/AbstractWrapper.java` | High
|
||||
9 | File | `/dashboard/reports/logs/view` | High
|
||||
10 | File | `/debug/pprof` | Medium
|
||||
11 | File | `/file?action=download&file` | High
|
||||
12 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
13 | File | `/fuel/sitevariables/delete/4` | High
|
||||
14 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
15 | File | `/index/jobfairol/show/` | High
|
||||
16 | File | `/librarian/bookdetails.php` | High
|
||||
17 | File | `/mgmt/tm/util/bash` | High
|
||||
18 | File | `/monitoring` | Medium
|
||||
19 | File | `/new` | Low
|
||||
20 | File | `/plugin/LiveChat/getChat.json.php` | High
|
||||
21 | File | `/plugins/servlet/audit/resource` | High
|
||||
22 | File | `/plugins/servlet/project-config/PROJECT/roles` | High
|
||||
23 | File | `/proc/<pid>/status` | High
|
||||
24 | File | `/public/plugins/` | High
|
||||
25 | File | `/RestAPI` | Medium
|
||||
26 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
27 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
28 | File | `/simple_chat_bot/admin/?page=user/manage_user` | High
|
||||
29 | File | `/src/main/java/com/dotmarketing/filters/CMSFilter.java` | High
|
||||
30 | File | `/tmp` | Low
|
||||
31 | File | `/tmp/zarafa-vacation-*` | High
|
||||
32 | ... | ... | ...
|
||||
|
||||
There are 254 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 270 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -10,7 +10,7 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [SV](https://vuldb.com/?country.sv)
|
||||
* [IT](https://vuldb.com/?country.it)
|
||||
* [AR](https://vuldb.com/?country.ar)
|
||||
* ...
|
||||
|
||||
There are 8 more country items available. Please use our online service to access the data.
|
||||
|
@ -58,36 +58,37 @@ ID | Type | Indicator | Confidence
|
|||
6 | File | `/admin/reports.php` | High
|
||||
7 | File | `/admin/service/stop/` | High
|
||||
8 | File | `/admin/usermanagement.php` | High
|
||||
9 | File | `/administrator/alerts/alertLightbox.php` | High
|
||||
9 | File | `/app/options.py` | High
|
||||
10 | File | `/bcms/admin/courts/view_court.php` | High
|
||||
11 | File | `/category.php` | High
|
||||
12 | File | `/CommunitySSORedirect.jsp` | High
|
||||
13 | File | `/config` | Low
|
||||
14 | File | `/ctpms/admin/individuals/update_status.php` | High
|
||||
15 | File | `/filemanager/upload/drop` | High
|
||||
16 | File | `/freelance/resume_list` | High
|
||||
17 | File | `/goform/aspForm` | High
|
||||
18 | File | `/goform/saveParentControlInfo` | High
|
||||
19 | File | `/goform/SetClientState` | High
|
||||
20 | File | `/goform/setDeviceSettings` | High
|
||||
21 | File | `/help/treecontent.jsp` | High
|
||||
22 | File | `/home/jobfairol/resumelist` | High
|
||||
23 | File | `/hprms/admin/rooms/view_room.php` | High
|
||||
24 | File | `/hprms/classes/Master.php?f=delete_message` | High
|
||||
25 | File | `/images/background/1.php` | High
|
||||
26 | File | `/index.php?p=admin/actions/users/send-password-reset-email` | High
|
||||
27 | File | `/ip/car-rental-management-system/admin/ajax.php?action=login` | High
|
||||
28 | File | `/lists/admin/` | High
|
||||
29 | File | `/modules/mindmap/index.php` | High
|
||||
30 | File | `/ocwbs/admin/?page=bookings/view_details` | High
|
||||
31 | File | `/ocwbs/admin/?page=user/manage_user` | High
|
||||
32 | File | `/ocwbs/admin/services/manage_service.php` | High
|
||||
33 | File | `/ocwbs/classes/Master.php?f=delete_booking` | High
|
||||
34 | File | `/ocwbs/classes/Master.php?f=delete_vehicle` | High
|
||||
35 | File | `/odfs/classes/Master.php?f=save_category` | High
|
||||
36 | ... | ... | ...
|
||||
12 | File | `/ci_spms/admin/search/searching/` | High
|
||||
13 | File | `/CommunitySSORedirect.jsp` | High
|
||||
14 | File | `/config` | Low
|
||||
15 | File | `/ctpms/admin/individuals/update_status.php` | High
|
||||
16 | File | `/filemanager/upload/drop` | High
|
||||
17 | File | `/freelance/resume_list` | High
|
||||
18 | File | `/goform/aspForm` | High
|
||||
19 | File | `/goform/saveParentControlInfo` | High
|
||||
20 | File | `/goform/SetClientState` | High
|
||||
21 | File | `/goform/setDeviceSettings` | High
|
||||
22 | File | `/help/treecontent.jsp` | High
|
||||
23 | File | `/home/jobfairol/resumelist` | High
|
||||
24 | File | `/hprms/admin/rooms/view_room.php` | High
|
||||
25 | File | `/hprms/classes/Master.php?f=delete_message` | High
|
||||
26 | File | `/images/background/1.php` | High
|
||||
27 | File | `/index.php?p=admin/actions/users/send-password-reset-email` | High
|
||||
28 | File | `/ip/car-rental-management-system/admin/ajax.php?action=login` | High
|
||||
29 | File | `/lists/admin/` | High
|
||||
30 | File | `/modules/mindmap/index.php` | High
|
||||
31 | File | `/ocwbs/admin/?page=bookings/view_details` | High
|
||||
32 | File | `/ocwbs/admin/?page=user/manage_user` | High
|
||||
33 | File | `/ocwbs/admin/services/manage_service.php` | High
|
||||
34 | File | `/ocwbs/classes/Master.php?f=delete_booking` | High
|
||||
35 | File | `/ocwbs/classes/Master.php?f=delete_vehicle` | High
|
||||
36 | File | `/odfs/classes/Master.php?f=save_category` | High
|
||||
37 | ... | ... | ...
|
||||
|
||||
There are 304 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 318 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -10,10 +10,10 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [JP](https://vuldb.com/?country.jp)
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* ...
|
||||
|
||||
There are 9 more country items available. Please use our online service to access the data.
|
||||
There are 15 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -31,20 +31,22 @@ ID | IP address | Hostname | Campaign | Confidence
|
|||
8 | [23.160.193.55](https://vuldb.com/?ip.23.160.193.55) | unknown.ip-xfer.net | - | High
|
||||
9 | [23.227.194.86](https://vuldb.com/?ip.23.227.194.86) | 23-227-194-86.static.hvvc.us | - | High
|
||||
10 | [23.227.199.10](https://vuldb.com/?ip.23.227.199.10) | 23-227-199-10.static.hvvc.us | - | High
|
||||
11 | [37.0.8.252](https://vuldb.com/?ip.37.0.8.252) | - | - | High
|
||||
12 | [37.120.198.225](https://vuldb.com/?ip.37.120.198.225) | - | - | High
|
||||
13 | [45.15.131.96](https://vuldb.com/?ip.45.15.131.96) | - | - | High
|
||||
14 | [45.66.158.14](https://vuldb.com/?ip.45.66.158.14) | 14.158-66-45.rdns.scalabledns.com | - | High
|
||||
15 | [45.134.26.174](https://vuldb.com/?ip.45.134.26.174) | - | - | High
|
||||
16 | [45.144.29.185](https://vuldb.com/?ip.45.144.29.185) | master.pisyandriy.com | - | High
|
||||
17 | [45.197.132.72](https://vuldb.com/?ip.45.197.132.72) | - | - | High
|
||||
18 | [46.165.254.166](https://vuldb.com/?ip.46.165.254.166) | - | - | High
|
||||
19 | [51.15.76.60](https://vuldb.com/?ip.51.15.76.60) | 60-76-15-51.instances.scw.cloud | - | High
|
||||
20 | [51.68.91.152](https://vuldb.com/?ip.51.68.91.152) | - | - | High
|
||||
21 | [51.68.93.185](https://vuldb.com/?ip.51.68.93.185) | - | - | High
|
||||
22 | ... | ... | ... | ...
|
||||
11 | [23.229.36.43](https://vuldb.com/?ip.23.229.36.43) | bet5jn-day-43.bettertisholiday.com | - | High
|
||||
12 | [23.236.174.190](https://vuldb.com/?ip.23.236.174.190) | - | - | High
|
||||
13 | [37.0.8.252](https://vuldb.com/?ip.37.0.8.252) | - | - | High
|
||||
14 | [37.120.198.225](https://vuldb.com/?ip.37.120.198.225) | - | - | High
|
||||
15 | [45.15.131.96](https://vuldb.com/?ip.45.15.131.96) | - | - | High
|
||||
16 | [45.66.158.14](https://vuldb.com/?ip.45.66.158.14) | 14.158-66-45.rdns.scalabledns.com | - | High
|
||||
17 | [45.134.26.174](https://vuldb.com/?ip.45.134.26.174) | - | - | High
|
||||
18 | [45.144.29.185](https://vuldb.com/?ip.45.144.29.185) | master.pisyandriy.com | - | High
|
||||
19 | [45.197.132.72](https://vuldb.com/?ip.45.197.132.72) | - | - | High
|
||||
20 | [46.165.254.166](https://vuldb.com/?ip.46.165.254.166) | - | - | High
|
||||
21 | [51.15.76.60](https://vuldb.com/?ip.51.15.76.60) | 60-76-15-51.instances.scw.cloud | - | High
|
||||
22 | [51.68.91.152](https://vuldb.com/?ip.51.68.91.152) | - | - | High
|
||||
23 | [51.68.93.185](https://vuldb.com/?ip.51.68.93.185) | - | - | High
|
||||
24 | ... | ... | ... | ...
|
||||
|
||||
There are 85 more IOC items available. Please use our online service to access the data.
|
||||
There are 94 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
|
@ -52,14 +54,14 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23, CWE-425 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294, CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23, CWE-24, CWE-36, CWE-425 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 22 more TTP items available. Please use our online service to access the data.
|
||||
There are 18 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -67,48 +69,41 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `.htaccess` | Medium
|
||||
2 | File | `/.dbus-keyrings` | High
|
||||
3 | File | `//proc/kcore` | Medium
|
||||
4 | File | `/acms/classes/Master.php?f=delete_img` | High
|
||||
5 | File | `/admin.php/Label/page_del` | High
|
||||
6 | File | `/admin.php/vod/admin/topic/del` | High
|
||||
7 | File | `/admin/dl_sendmail.php` | High
|
||||
8 | File | `/admin/dl_sendsms.php` | High
|
||||
9 | File | `/admin/edit_admin_details.php?id=admin` | High
|
||||
10 | File | `/admin/generalsettings.php` | High
|
||||
11 | File | `/admin/payment.php` | High
|
||||
12 | File | `/admin/reports.php` | High
|
||||
13 | File | `/admin_page/all-files-update-ajax.php` | High
|
||||
14 | File | `/api/part_categories` | High
|
||||
15 | File | `/api/programs/orgUnits?programs` | High
|
||||
16 | File | `/api/students/me/courses/` | High
|
||||
17 | File | `/api/user/userData?userCode=admin` | High
|
||||
18 | File | `/Applications/Utilities/Terminal` | High
|
||||
19 | File | `/asms/classes/Master.php?f=delete_product` | High
|
||||
20 | File | `/asms/classes/Master.php?f=save_product` | High
|
||||
21 | File | `/bcms/admin/?page=reports/daily_court_rental_report` | High
|
||||
22 | File | `/bsms/?page=manage_account` | High
|
||||
23 | File | `/cgi-bin/kerbynet` | High
|
||||
24 | File | `/checklogin.jsp` | High
|
||||
25 | File | `/classes/master.php?f=delete_facility` | High
|
||||
26 | File | `/classes/Master.php?f=delete_reservation` | High
|
||||
27 | File | `/classes/Master.php?f=delete_schedule` | High
|
||||
28 | File | `/College_Management_System/admin/display-teacher.php` | High
|
||||
29 | File | `/company` | Medium
|
||||
30 | File | `/company/service/increment/add/im` | High
|
||||
31 | File | `/ctpms/admin/?page=applications/view_application` | High
|
||||
32 | File | `/ctpms/admin/?page=individuals/view_individual` | High
|
||||
33 | File | `/ctpms/admin/individuals/update_status.php` | High
|
||||
34 | File | `/dashboard/system/express/entities/forms/save_control/[GUID]` | High
|
||||
35 | File | `/dms/admin/reports/daily_collection_report.php` | High
|
||||
36 | File | `/ecrire` | Low
|
||||
37 | File | `/forum/away.php` | High
|
||||
38 | File | `/goform/aspForm` | High
|
||||
39 | File | `/goform/saveParentControlInfo` | High
|
||||
40 | ... | ... | ...
|
||||
1 | File | `.forward` | Medium
|
||||
2 | File | `.htaccess` | Medium
|
||||
3 | File | `/.dbus-keyrings` | High
|
||||
4 | File | `//proc/kcore` | Medium
|
||||
5 | File | `/admin/conferences/list/` | High
|
||||
6 | File | `/admin/dl_sendmail.php` | High
|
||||
7 | File | `/admin/edit_admin_details.php?id=admin` | High
|
||||
8 | File | `/admin/generalsettings.php` | High
|
||||
9 | File | `/admin/payment.php` | High
|
||||
10 | File | `/admin/reports.php` | High
|
||||
11 | File | `/AgilePointServer/Extension/FetchUsingEncodedData` | High
|
||||
12 | File | `/api/part_categories` | High
|
||||
13 | File | `/api/user/userData?userCode=admin` | High
|
||||
14 | File | `/app/options.py` | High
|
||||
15 | File | `/bsms/?page=manage_account` | High
|
||||
16 | File | `/cgi-bin/kerbynet` | High
|
||||
17 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
18 | File | `/ci_spms/admin/category` | High
|
||||
19 | File | `/ci_spms/admin/search/searching/` | High
|
||||
20 | File | `/ci_ssms/index.php/orders/create` | High
|
||||
21 | File | `/classes/Master.php?f=delete_reservation` | High
|
||||
22 | File | `/classes/Master.php?f=delete_schedule` | High
|
||||
23 | File | `/classes/Master.php?f=delete_train` | High
|
||||
24 | File | `/company` | Medium
|
||||
25 | File | `/company/service/increment/add/im` | High
|
||||
26 | File | `/dashboard/menu-list.php` | High
|
||||
27 | File | `/dashboard/system/express/entities/forms/save_control/[GUID]` | High
|
||||
28 | File | `/ffos/classes/Master.php?f=save_category` | High
|
||||
29 | File | `/forum/away.php` | High
|
||||
30 | File | `/goform/aspForm` | High
|
||||
31 | File | `/home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf` | High
|
||||
32 | File | `/index/notice/show` | High
|
||||
33 | ... | ... | ...
|
||||
|
||||
There are 340 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 279 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
@ -119,6 +114,7 @@ The following list contains _external sources_ which discuss the actor and the a
|
|||
* https://blog.cyble.com/2022/05/20/malware-campaign-targets-infosec-community-threat-actor-uses-fake-proof-of-concept-to-deliver-cobalt-strike-beacon/
|
||||
* https://blog.morphisec.com/log4j-exploit-targets-vulnerable-unifi-network-applications
|
||||
* https://blog.talosintelligence.com/2020/06/indigodrop-maldocs-cobalt-strike.html
|
||||
* https://blogs.infoblox.com/cyber-threat-intelligence/nobelium-campaigns-and-malware/
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-08-17%20Hancitor%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-08-18%20Hancitor%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-08-26%20Hancitor%20IOCs
|
||||
|
@ -133,9 +129,19 @@ The following list contains _external sources_ which discuss the actor and the a
|
|||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-09-22%20Hancitor%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-09-23%20Hancitor%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-09-29%20Hancitor%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-10-07%20Hancitor%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-10-19%20Hancitor%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-10-27%20Hancitor%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-11-03%20Hancitor%20IOC
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-11-10%20Hancitor%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-11-23%20Hancitor%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-11-30%20Hancitor%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-12-01%20Hancitor%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-12-15%20Hancitor%20IOCs
|
||||
* https://isc.sans.edu/forums/diary/April+2021+Forensic+Quiz+Answers+and+Analysis/27308/
|
||||
* https://isc.sans.edu/forums/diary/Attackers+Exploiting+WebLogic+Servers+via+CVE202014882+to+install+Cobalt+Strike/26752/
|
||||
* https://isc.sans.edu/forums/diary/Case+Study+Cobalt+Strike+Server+Lives+on+After+Its+Domain+Is+Suspended/28804/
|
||||
* https://isc.sans.edu/forums/diary/Emotet+infection+with+Cobalt+Strike/28824/
|
||||
* https://isc.sans.edu/forums/diary/Example+of+Cobalt+Strike+from+Emotet+infection/28318/
|
||||
* https://isc.sans.edu/forums/diary/Excel+spreadsheets+push+SystemBC+malware/27060/
|
||||
* https://isc.sans.edu/forums/diary/June+2021+Forensic+Contest+Answers+and+Analysis/27582/
|
||||
|
|
|
@ -15,12 +15,12 @@ The following _campaigns_ are known and can be associated with Conti:
|
|||
|
||||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Conti:
|
||||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [NL](https://vuldb.com/?country.nl)
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* ...
|
||||
|
||||
There are 20 more country items available. Please use our online service to access the data.
|
||||
There are 17 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -530,7 +530,7 @@ ID | Technique | Weakness | Description | Confidence
|
|||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 17 more TTP items available. Please use our online service to access the data.
|
||||
There are 16 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -541,38 +541,34 @@ ID | Type | Indicator | Confidence
|
|||
1 | File | `//proc/kcore` | Medium
|
||||
2 | File | `/admin/` | Low
|
||||
3 | File | `/admin/communitymanagement.php` | High
|
||||
4 | File | `/admin/contenttemp` | High
|
||||
5 | File | `/admin/extended` | High
|
||||
6 | File | `/admin/featured.php` | High
|
||||
7 | File | `/admin/generalsettings.php` | High
|
||||
8 | File | `/admin/newsletter1.php` | High
|
||||
9 | File | `/admin/payment.php` | High
|
||||
10 | File | `/admin/user/UserAdmin.do` | High
|
||||
11 | File | `/admin/usermanagement.php` | High
|
||||
12 | File | `/Ap4RtpAtom.cpp` | High
|
||||
13 | File | `/api/crontab` | Medium
|
||||
4 | File | `/admin/extended` | High
|
||||
5 | File | `/admin/featured.php` | High
|
||||
6 | File | `/admin/generalsettings.php` | High
|
||||
7 | File | `/admin/newsletter1.php` | High
|
||||
8 | File | `/admin/payment.php` | High
|
||||
9 | File | `/admin/usermanagement.php` | High
|
||||
10 | File | `/Ap4RtpAtom.cpp` | High
|
||||
11 | File | `/api/addusers` | High
|
||||
12 | File | `/app/options.py` | High
|
||||
13 | File | `/application/common.php#action_log` | High
|
||||
14 | File | `/bcms/admin/?page=user/list` | High
|
||||
15 | File | `/bsms/?page=manage_account` | High
|
||||
16 | File | `/cgi-bin/login.cgi` | High
|
||||
17 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
18 | File | `/controller/Index.php` | High
|
||||
19 | File | `/core/conditions/AbstractWrapper.java` | High
|
||||
20 | File | `/dashboard/reports/logs/view` | High
|
||||
21 | File | `/debug/pprof` | Medium
|
||||
22 | File | `/designer/add/layout` | High
|
||||
23 | File | `/devices/acurite.c` | High
|
||||
24 | File | `/example/editor` | High
|
||||
25 | File | `/filemanager/upload/drop` | High
|
||||
26 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
27 | File | `/fuel/sitevariables/delete/4` | High
|
||||
28 | File | `/goform/login_process` | High
|
||||
29 | File | `/goform/rlmswitchr_process` | High
|
||||
30 | File | `/goforms/rlminfo` | High
|
||||
31 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
32 | File | `/include/chart_generator.php` | High
|
||||
33 | ... | ... | ...
|
||||
18 | File | `/core/conditions/AbstractWrapper.java` | High
|
||||
19 | File | `/dashboard/reports/logs/view` | High
|
||||
20 | File | `/debug/pprof` | Medium
|
||||
21 | File | `/designer/add/layout` | High
|
||||
22 | File | `/etc/hosts` | Medium
|
||||
23 | File | `/filemanager/upload/drop` | High
|
||||
24 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
25 | File | `/fuel/sitevariables/delete/4` | High
|
||||
26 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
27 | File | `/index/jobfairol/show/` | High
|
||||
28 | File | `/librarian/bookdetails.php` | High
|
||||
29 | ... | ... | ...
|
||||
|
||||
There are 277 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 244 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -15,8 +15,8 @@ The following _campaigns_ are known and can be associated with CopyKittens:
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with CopyKittens:
|
||||
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [SV](https://vuldb.com/?country.sv)
|
||||
* [PT](https://vuldb.com/?country.pt)
|
||||
* [AR](https://vuldb.com/?country.ar)
|
||||
* ...
|
||||
|
||||
There are 8 more country items available. Please use our online service to access the data.
|
||||
|
@ -54,14 +54,14 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
1 | T1006 | CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294, CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 20 more TTP items available. Please use our online service to access the data.
|
||||
There are 21 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -75,33 +75,33 @@ ID | Type | Indicator | Confidence
|
|||
4 | File | `/admin.php/vod/admin/topic/del` | High
|
||||
5 | File | `/admin/conferences/list/` | High
|
||||
6 | File | `/admin/deluser.php` | High
|
||||
7 | File | `/admin/edit.php` | High
|
||||
8 | File | `/admin/edit_admin_details.php?id=admin` | High
|
||||
9 | File | `/admin/googleads.php` | High
|
||||
10 | File | `/admin/new-content` | High
|
||||
11 | File | `/admin/operations/tax.php` | High
|
||||
12 | File | `/admin/payment.php` | High
|
||||
13 | File | `/admin/scheprofile.cgi` | High
|
||||
14 | File | `/admin/weixin.php` | High
|
||||
15 | File | `/apps/acs-commons/content/page-compare.html` | High
|
||||
16 | File | `/base/SysEveMenuAuthPointMapper.xml` | High
|
||||
17 | File | `/bcms/admin/courts/manage_court.php` | High
|
||||
18 | File | `/bcms/classes/Master.php?f=save_court_rental` | High
|
||||
19 | File | `/car-rental-management-system/admin/manage_booking.php` | High
|
||||
20 | File | `/catcompany.php` | High
|
||||
21 | File | `/cgi-bin/kerbynet` | High
|
||||
22 | File | `/classes/Users.php?f=save` | High
|
||||
23 | File | `/cms/classes/Master.php?f=delete_client` | High
|
||||
24 | File | `/config` | Low
|
||||
25 | File | `/defaultui/player/modern.html` | High
|
||||
26 | File | `/ffos/admin/categories/manage_category.php` | High
|
||||
27 | File | `/ffos/admin/menus/view_menu.php` | High
|
||||
28 | File | `/gaia-job-admin/user/add` | High
|
||||
29 | File | `/goform/aspForm` | High
|
||||
30 | File | `/goform/setNetworkLan` | High
|
||||
31 | File | `/goform/SetSysTimeCfg` | High
|
||||
32 | File | `/html/Solar_Ftp.php` | High
|
||||
33 | File | `/lists/admin/` | High
|
||||
7 | File | `/admin/edit_admin_details.php?id=admin` | High
|
||||
8 | File | `/admin/googleads.php` | High
|
||||
9 | File | `/admin/new-content` | High
|
||||
10 | File | `/admin/operations/tax.php` | High
|
||||
11 | File | `/admin/payment.php` | High
|
||||
12 | File | `/admin/scheprofile.cgi` | High
|
||||
13 | File | `/base/SysEveMenuAuthPointMapper.xml` | High
|
||||
14 | File | `/bcms/admin/courts/manage_court.php` | High
|
||||
15 | File | `/bcms/classes/Master.php?f=save_court_rental` | High
|
||||
16 | File | `/car-rental-management-system/admin/manage_booking.php` | High
|
||||
17 | File | `/catcompany.php` | High
|
||||
18 | File | `/cgi-bin/kerbynet` | High
|
||||
19 | File | `/cgi-bin/readfile.tcl` | High
|
||||
20 | File | `/classes/Users.php?f=save` | High
|
||||
21 | File | `/cms/classes/Master.php?f=delete_client` | High
|
||||
22 | File | `/config` | Low
|
||||
23 | File | `/defaultui/player/modern.html` | High
|
||||
24 | File | `/ffos/admin/categories/manage_category.php` | High
|
||||
25 | File | `/ffos/admin/menus/view_menu.php` | High
|
||||
26 | File | `/gaia-job-admin/user/add` | High
|
||||
27 | File | `/goform/aspForm` | High
|
||||
28 | File | `/goform/setNetworkLan` | High
|
||||
29 | File | `/goform/SetSysTimeCfg` | High
|
||||
30 | File | `/html/Solar_Ftp.php` | High
|
||||
31 | File | `/isms/admin/stocks/view_stock.php` | High
|
||||
32 | File | `/lists/admin/` | High
|
||||
33 | File | `/mtms/admin/?page=transaction/send` | High
|
||||
34 | ... | ... | ...
|
||||
|
||||
There are 287 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
|
|
@ -23,6 +23,32 @@ ID | IP address | Hostname | Campaign | Confidence
|
|||
|
||||
There are 13 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
_Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK techniques used by _Cryptbot_. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
2 | T1202 | CWE-77 | Command Injection | High
|
||||
3 | T1600 | CWE-326 | J2EE Misconfiguration: Data Transmission Without Encryption | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 1 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
These _indicators of attack_ (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Cryptbot. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/ci_spms/admin/search/searching/` | High
|
||||
2 | Argument | `langType` | Medium
|
||||
3 | Argument | `search` | Low
|
||||
4 | ... | ... | ...
|
||||
|
||||
There are 1 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
The following list contains _external sources_ which discuss the actor and the associated activities:
|
||||
|
|
|
@ -36,12 +36,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-266, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1548.002 | CWE-285 | Improper Authorization | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-22, CWE-425 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 4 more TTP items available. Please use our online service to access the data.
|
||||
There are 14 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -15,8 +15,8 @@ The following _campaigns_ are known and can be associated with DEV-0322:
|
|||
|
||||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with DEV-0322:
|
||||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -56,7 +56,7 @@ ID | Type | Indicator | Confidence
|
|||
4 | File | `data/gbconfiguration.dat` | High
|
||||
5 | ... | ... | ...
|
||||
|
||||
There are 33 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 34 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -34,8 +34,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264 | Execution with Unnecessary Privileges | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
3 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 5 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -17,6 +17,9 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
* [US](https://vuldb.com/?country.us)
|
||||
* [CA](https://vuldb.com/?country.ca)
|
||||
* [DZ](https://vuldb.com/?country.dz)
|
||||
* ...
|
||||
|
||||
There are 1 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -55,7 +58,7 @@ ID | Type | Indicator | Confidence
|
|||
3 | File | `fs/aio.c` | Medium
|
||||
4 | ... | ... | ...
|
||||
|
||||
There are 15 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 16 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -9,11 +9,11 @@ _Live data_ and more _analysis capabilities_ are available at [https://vuldb.com
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Dofoil:
|
||||
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* ...
|
||||
|
||||
There are 22 more country items available. Please use our online service to access the data.
|
||||
There are 20 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -43,12 +43,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-266, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23, CWE-425 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 4 more TTP items available. Please use our online service to access the data.
|
||||
There are 17 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -56,40 +57,36 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/?module=users§ion=cpanel&page=list` | High
|
||||
2 | File | `/bcms/admin/?page=user/list` | High
|
||||
3 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
4 | File | `/debug/pprof` | Medium
|
||||
5 | File | `/export` | Low
|
||||
6 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
7 | File | `/mgmt/tm/util/bash` | High
|
||||
8 | File | `/monitoring` | Medium
|
||||
9 | File | `/new` | Low
|
||||
10 | File | `/proc/<pid>/status` | High
|
||||
11 | File | `/public/plugins/` | High
|
||||
12 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
13 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
14 | File | `/simple_chat_bot/admin/?page=user/manage_user` | High
|
||||
15 | File | `/src/main/java/com/dotmarketing/filters/CMSFilter.java` | High
|
||||
16 | File | `/tmp` | Low
|
||||
17 | File | `/uncpath/` | Medium
|
||||
18 | File | `/views/directive/sys/SysConfigDataDirective.java` | High
|
||||
19 | File | `/wp-content/plugins/updraftplus/admin.php` | High
|
||||
20 | File | `/wp-json/wc/v3/webhooks` | High
|
||||
21 | File | `14all.cgi/14all-1.1.cgi/traffic.cgi/mrtg.cgi` | High
|
||||
22 | File | `AccountManagerService.java` | High
|
||||
23 | File | `actions/CompanyDetailsSave.php` | High
|
||||
24 | File | `ActiveServices.java` | High
|
||||
25 | File | `ActivityManagerService.java` | High
|
||||
26 | File | `admin.php` | Medium
|
||||
27 | File | `admin/?n=user&c=admin_user&a=doGetUserInfo` | High
|
||||
28 | File | `admin/add-glossary.php` | High
|
||||
29 | File | `admin/conf_users_edit.php` | High
|
||||
30 | File | `admin/edit-comments.php` | High
|
||||
31 | File | `admin/src/containers/InputModalStepperProvider/index.js` | High
|
||||
32 | ... | ... | ...
|
||||
1 | File | `//proc/kcore` | Medium
|
||||
2 | File | `/Ap4RtpAtom.cpp` | High
|
||||
3 | File | `/app/options.py` | High
|
||||
4 | File | `/bcms/admin/?page=user/list` | High
|
||||
5 | File | `/bsms/?page=manage_account` | High
|
||||
6 | File | `/cgi-bin/login.cgi` | High
|
||||
7 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
8 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
9 | File | `/dashboard/reports/logs/view` | High
|
||||
10 | File | `/debug/pprof` | Medium
|
||||
11 | File | `/etc/hosts` | Medium
|
||||
12 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
13 | File | `/fuel/sitevariables/delete/4` | High
|
||||
14 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
15 | File | `/index/jobfairol/show/` | High
|
||||
16 | File | `/librarian/bookdetails.php` | High
|
||||
17 | File | `/mgmt/tm/util/bash` | High
|
||||
18 | File | `/monitoring` | Medium
|
||||
19 | File | `/new` | Low
|
||||
20 | File | `/proc/<PID>/mem` | High
|
||||
21 | File | `/proc/<pid>/status` | High
|
||||
22 | File | `/public/plugins/` | High
|
||||
23 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
24 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
25 | File | `/simple_chat_bot/admin/?page=user/manage_user` | High
|
||||
26 | File | `/src/main/java/com/dotmarketing/filters/CMSFilter.java` | High
|
||||
27 | File | `/tmp` | Low
|
||||
28 | ... | ... | ...
|
||||
|
||||
There are 269 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 237 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -30,6 +30,7 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
2 | T1592 | CWE-200 | Configuration | High
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -27,378 +27,413 @@ ID | IP address | Hostname | Campaign | Confidence
|
|||
4 | [1.234.21.73](https://vuldb.com/?ip.1.234.21.73) | - | - | High
|
||||
5 | [2.47.112.152](https://vuldb.com/?ip.2.47.112.152) | net-2-47-112-152.cust.vodafonedsl.it | - | High
|
||||
6 | [2.58.16.86](https://vuldb.com/?ip.2.58.16.86) | - | - | High
|
||||
7 | [2.58.16.89](https://vuldb.com/?ip.2.58.16.89) | - | - | High
|
||||
8 | [2.82.75.215](https://vuldb.com/?ip.2.82.75.215) | bl21-75-215.dsl.telepac.pt | - | High
|
||||
9 | [5.2.75.167](https://vuldb.com/?ip.5.2.75.167) | coms.a9v34.com.cn | - | High
|
||||
10 | [5.2.84.232](https://vuldb.com/?ip.5.2.84.232) | momos.alastyr.com | - | High
|
||||
11 | [5.2.136.90](https://vuldb.com/?ip.5.2.136.90) | static-5-2-136-90.rdsnet.ro | - | High
|
||||
12 | [5.2.182.7](https://vuldb.com/?ip.5.2.182.7) | static-5-2-182-7.rdsnet.ro | - | High
|
||||
13 | [5.2.212.254](https://vuldb.com/?ip.5.2.212.254) | static-5-2-212-254.rdsnet.ro | - | High
|
||||
14 | [5.9.49.12](https://vuldb.com/?ip.5.9.49.12) | static.12.49.9.5.clients.your-server.de | - | High
|
||||
15 | [5.9.116.246](https://vuldb.com/?ip.5.9.116.246) | static.246.116.9.5.clients.your-server.de | - | High
|
||||
16 | [5.9.128.163](https://vuldb.com/?ip.5.9.128.163) | static.163.128.9.5.clients.your-server.de | - | High
|
||||
17 | [5.9.189.24](https://vuldb.com/?ip.5.9.189.24) | static.24.189.9.5.clients.your-server.de | - | High
|
||||
18 | [5.12.246.155](https://vuldb.com/?ip.5.12.246.155) | 5-12-246-155.residential.rdsnet.ro | - | High
|
||||
19 | [5.35.249.46](https://vuldb.com/?ip.5.35.249.46) | rs250366.rs.hosteurope.de | - | High
|
||||
20 | [5.39.69.166](https://vuldb.com/?ip.5.39.69.166) | ns340204.ip-5-39-69.eu | - | High
|
||||
21 | [5.39.84.48](https://vuldb.com/?ip.5.39.84.48) | ns3126815.ip-5-39-84.eu | - | High
|
||||
22 | [5.39.91.110](https://vuldb.com/?ip.5.39.91.110) | ns3278366.ip-5-39-91.eu | - | High
|
||||
23 | [5.45.108.146](https://vuldb.com/?ip.5.45.108.146) | cosmo.jumpingcrab.com | - | High
|
||||
24 | [5.56.56.146](https://vuldb.com/?ip.5.56.56.146) | sites1.tucomunidad.cloud | - | High
|
||||
25 | [5.79.70.250](https://vuldb.com/?ip.5.79.70.250) | - | - | High
|
||||
26 | [5.89.33.136](https://vuldb.com/?ip.5.89.33.136) | net-5-89-33-136.cust.vodafonedsl.it | - | High
|
||||
27 | [5.101.138.188](https://vuldb.com/?ip.5.101.138.188) | uk.mthservers.com | - | High
|
||||
28 | [5.159.57.195](https://vuldb.com/?ip.5.159.57.195) | www-riedle.transfermarkt.de | - | High
|
||||
29 | [5.196.35.138](https://vuldb.com/?ip.5.196.35.138) | vps10.open-techno.net | - | High
|
||||
30 | [5.196.73.150](https://vuldb.com/?ip.5.196.73.150) | ns3000085.ip-5-196-73.eu | - | High
|
||||
31 | [5.196.133.206](https://vuldb.com/?ip.5.196.133.206) | pixelfed.hosnet.fr | - | High
|
||||
32 | [5.230.193.41](https://vuldb.com/?ip.5.230.193.41) | casagarcia-web.sys.netzfabrik.eu | - | High
|
||||
33 | [8.4.9.137](https://vuldb.com/?ip.8.4.9.137) | onlinehorizons.net | - | High
|
||||
34 | [8.247.6.134](https://vuldb.com/?ip.8.247.6.134) | - | - | High
|
||||
35 | [8.248.153.254](https://vuldb.com/?ip.8.248.153.254) | - | - | High
|
||||
36 | [8.248.163.254](https://vuldb.com/?ip.8.248.163.254) | - | - | High
|
||||
37 | [8.249.219.254](https://vuldb.com/?ip.8.249.219.254) | - | - | High
|
||||
38 | [8.249.241.254](https://vuldb.com/?ip.8.249.241.254) | - | - | High
|
||||
39 | [8.253.45.214](https://vuldb.com/?ip.8.253.45.214) | - | - | High
|
||||
40 | [8.253.131.121](https://vuldb.com/?ip.8.253.131.121) | - | - | High
|
||||
41 | [12.6.148.4](https://vuldb.com/?ip.12.6.148.4) | mail.carters.com | - | High
|
||||
42 | [12.6.183.21](https://vuldb.com/?ip.12.6.183.21) | - | - | High
|
||||
43 | [12.32.68.154](https://vuldb.com/?ip.12.32.68.154) | mail.sealscoinc.com | - | High
|
||||
44 | [12.149.72.170](https://vuldb.com/?ip.12.149.72.170) | - | - | High
|
||||
45 | [12.162.84.2](https://vuldb.com/?ip.12.162.84.2) | - | - | High
|
||||
46 | [12.163.208.58](https://vuldb.com/?ip.12.163.208.58) | - | - | High
|
||||
47 | [12.182.146.226](https://vuldb.com/?ip.12.182.146.226) | - | - | High
|
||||
48 | [12.184.217.101](https://vuldb.com/?ip.12.184.217.101) | - | - | High
|
||||
49 | [12.222.134.10](https://vuldb.com/?ip.12.222.134.10) | - | - | High
|
||||
50 | [12.238.114.130](https://vuldb.com/?ip.12.238.114.130) | - | - | High
|
||||
51 | [13.107.21.200](https://vuldb.com/?ip.13.107.21.200) | - | - | High
|
||||
52 | [14.49.39.215](https://vuldb.com/?ip.14.49.39.215) | - | - | High
|
||||
53 | [17.36.205.74](https://vuldb.com/?ip.17.36.205.74) | - | - | High
|
||||
54 | [17.56.136.171](https://vuldb.com/?ip.17.56.136.171) | p74-smtp.mail.icloud.com | - | High
|
||||
55 | [18.209.113.128](https://vuldb.com/?ip.18.209.113.128) | ec2-18-209-113-128.compute-1.amazonaws.com | - | Medium
|
||||
56 | [18.211.9.206](https://vuldb.com/?ip.18.211.9.206) | ec2-18-211-9-206.compute-1.amazonaws.com | - | Medium
|
||||
57 | [18.217.99.164](https://vuldb.com/?ip.18.217.99.164) | ec2-18-217-99-164.us-east-2.compute.amazonaws.com | - | Medium
|
||||
58 | [23.3.13.88](https://vuldb.com/?ip.23.3.13.88) | a23-3-13-88.deploy.static.akamaitechnologies.com | - | High
|
||||
59 | [23.3.13.146](https://vuldb.com/?ip.23.3.13.146) | a23-3-13-146.deploy.static.akamaitechnologies.com | - | High
|
||||
60 | [23.3.13.153](https://vuldb.com/?ip.23.3.13.153) | a23-3-13-153.deploy.static.akamaitechnologies.com | - | High
|
||||
61 | [23.3.13.154](https://vuldb.com/?ip.23.3.13.154) | a23-3-13-154.deploy.static.akamaitechnologies.com | - | High
|
||||
62 | [23.5.231.225](https://vuldb.com/?ip.23.5.231.225) | a23-5-231-225.deploy.static.akamaitechnologies.com | - | High
|
||||
63 | [23.6.65.194](https://vuldb.com/?ip.23.6.65.194) | a23-6-65-194.deploy.static.akamaitechnologies.com | - | High
|
||||
64 | [23.6.69.99](https://vuldb.com/?ip.23.6.69.99) | a23-6-69-99.deploy.static.akamaitechnologies.com | - | High
|
||||
65 | [23.36.85.183](https://vuldb.com/?ip.23.36.85.183) | a23-36-85-183.deploy.static.akamaitechnologies.com | - | High
|
||||
66 | [23.41.248.194](https://vuldb.com/?ip.23.41.248.194) | a23-41-248-194.deploy.static.akamaitechnologies.com | - | High
|
||||
67 | [23.46.53.71](https://vuldb.com/?ip.23.46.53.71) | a23-46-53-71.deploy.static.akamaitechnologies.com | - | High
|
||||
68 | [23.46.238.193](https://vuldb.com/?ip.23.46.238.193) | a23-46-238-193.deploy.static.akamaitechnologies.com | - | High
|
||||
69 | [23.46.238.194](https://vuldb.com/?ip.23.46.238.194) | a23-46-238-194.deploy.static.akamaitechnologies.com | - | High
|
||||
70 | [23.46.238.232](https://vuldb.com/?ip.23.46.238.232) | a23-46-238-232.deploy.static.akamaitechnologies.com | - | High
|
||||
71 | [23.52.7.20](https://vuldb.com/?ip.23.52.7.20) | a23-52-7-20.deploy.static.akamaitechnologies.com | - | High
|
||||
72 | [23.67.200.172](https://vuldb.com/?ip.23.67.200.172) | a23-67-200-172.deploy.static.akamaitechnologies.com | - | High
|
||||
73 | [23.67.202.10](https://vuldb.com/?ip.23.67.202.10) | a23-67-202-10.deploy.static.akamaitechnologies.com | - | High
|
||||
74 | [23.95.95.18](https://vuldb.com/?ip.23.95.95.18) | 23-95-95-18-host.colocrossing.com | - | High
|
||||
75 | [23.111.156.118](https://vuldb.com/?ip.23.111.156.118) | 23-111-156-118.static.hvvc.us | - | High
|
||||
76 | [23.197.19.180](https://vuldb.com/?ip.23.197.19.180) | a23-197-19-180.deploy.static.akamaitechnologies.com | - | High
|
||||
77 | [23.199.63.11](https://vuldb.com/?ip.23.199.63.11) | a23-199-63-11.deploy.static.akamaitechnologies.com | - | High
|
||||
78 | [23.199.71.185](https://vuldb.com/?ip.23.199.71.185) | a23-199-71-185.deploy.static.akamaitechnologies.com | - | High
|
||||
79 | [23.218.127.164](https://vuldb.com/?ip.23.218.127.164) | a23-218-127-164.deploy.static.akamaitechnologies.com | - | High
|
||||
80 | [23.218.141.31](https://vuldb.com/?ip.23.218.141.31) | a23-218-141-31.deploy.static.akamaitechnologies.com | - | High
|
||||
81 | [23.221.50.122](https://vuldb.com/?ip.23.221.50.122) | a23-221-50-122.deploy.static.akamaitechnologies.com | - | High
|
||||
82 | [23.227.38.64](https://vuldb.com/?ip.23.227.38.64) | shops.myshopify.com | - | High
|
||||
83 | [23.229.115.217](https://vuldb.com/?ip.23.229.115.217) | - | - | High
|
||||
84 | [23.229.190.0](https://vuldb.com/?ip.23.229.190.0) | ip-23-229-190-0.ip.secureserver.net | - | High
|
||||
85 | [23.239.2.11](https://vuldb.com/?ip.23.239.2.11) | li683-11.members.linode.com | - | High
|
||||
86 | [23.254.203.51](https://vuldb.com/?ip.23.254.203.51) | hwsrv-779084.hostwindsdns.com | - | High
|
||||
87 | [24.40.239.62](https://vuldb.com/?ip.24.40.239.62) | 24-40-239-62.fidnet.com | - | High
|
||||
88 | [24.43.99.75](https://vuldb.com/?ip.24.43.99.75) | rrcs-24-43-99-75.west.biz.rr.com | - | High
|
||||
89 | [24.101.229.82](https://vuldb.com/?ip.24.101.229.82) | dynamic-acs-24-101-229-82.zoominternet.net | - | High
|
||||
90 | [24.116.40.208](https://vuldb.com/?ip.24.116.40.208) | 24-116-40-208.cpe.sparklight.net | - | High
|
||||
91 | [24.119.116.230](https://vuldb.com/?ip.24.119.116.230) | 24-119-116-230.cpe.sparklight.net | - | High
|
||||
92 | [24.121.176.48](https://vuldb.com/?ip.24.121.176.48) | 24-121-176-48.prkrcmtc01.com.sta.suddenlink.net | - | High
|
||||
93 | [24.137.76.62](https://vuldb.com/?ip.24.137.76.62) | host-24-137-76-62.public.eastlink.ca | - | High
|
||||
94 | [24.178.90.49](https://vuldb.com/?ip.24.178.90.49) | 024-178-090-049.res.spectrum.com | - | High
|
||||
95 | [24.179.13.119](https://vuldb.com/?ip.24.179.13.119) | 024-179-013-119.res.spectrum.com | - | High
|
||||
96 | [24.190.11.79](https://vuldb.com/?ip.24.190.11.79) | ool-18be0b4f.dyn.optonline.net | - | High
|
||||
97 | [24.201.79.34](https://vuldb.com/?ip.24.201.79.34) | modemcable034.79-201-24.mc.videotron.ca | - | High
|
||||
98 | [24.203.4.40](https://vuldb.com/?ip.24.203.4.40) | modemcable040.4-203-24.mc.videotron.ca | - | High
|
||||
99 | [24.217.117.217](https://vuldb.com/?ip.24.217.117.217) | 024-217-117-217.res.spectrum.com | - | High
|
||||
100 | [24.232.0.227](https://vuldb.com/?ip.24.232.0.227) | smtp.fibertel.com.ar | - | High
|
||||
101 | [24.232.228.233](https://vuldb.com/?ip.24.232.228.233) | OL233-228.fibertel.com.ar | - | High
|
||||
102 | [24.244.177.40](https://vuldb.com/?ip.24.244.177.40) | - | - | High
|
||||
103 | [27.50.89.209](https://vuldb.com/?ip.27.50.89.209) | 27-50-89-209.as45671.net | - | High
|
||||
104 | [27.78.27.110](https://vuldb.com/?ip.27.78.27.110) | localhost | - | High
|
||||
105 | [27.82.13.10](https://vuldb.com/?ip.27.82.13.10) | KD027082013010.ppp-bb.dion.ne.jp | - | High
|
||||
106 | [27.109.24.214](https://vuldb.com/?ip.27.109.24.214) | - | - | High
|
||||
107 | [27.114.9.93](https://vuldb.com/?ip.27.114.9.93) | i27-114-9-93.s41.a011.ap.plala.or.jp | - | High
|
||||
108 | [27.254.81.87](https://vuldb.com/?ip.27.254.81.87) | cloud-linux09.thaidata.net | - | High
|
||||
109 | [31.3.135.232](https://vuldb.com/?ip.31.3.135.232) | mirror.tillo.ch | - | High
|
||||
110 | [31.24.158.56](https://vuldb.com/?ip.31.24.158.56) | bm.servidoresdedicados.com | - | High
|
||||
111 | [31.167.248.50](https://vuldb.com/?ip.31.167.248.50) | - | - | High
|
||||
112 | [31.172.86.183](https://vuldb.com/?ip.31.172.86.183) | - | - | High
|
||||
113 | [34.117.59.81](https://vuldb.com/?ip.34.117.59.81) | 81.59.117.34.bc.googleusercontent.com | - | Medium
|
||||
114 | [34.192.19.33](https://vuldb.com/?ip.34.192.19.33) | ec2-34-192-19-33.compute-1.amazonaws.com | - | Medium
|
||||
115 | [35.184.245.68](https://vuldb.com/?ip.35.184.245.68) | 68.245.184.35.bc.googleusercontent.com | - | Medium
|
||||
116 | [35.190.87.116](https://vuldb.com/?ip.35.190.87.116) | 116.87.190.35.bc.googleusercontent.com | - | Medium
|
||||
117 | [35.203.98.50](https://vuldb.com/?ip.35.203.98.50) | 50.98.203.35.bc.googleusercontent.com | - | Medium
|
||||
118 | [35.213.151.141](https://vuldb.com/?ip.35.213.151.141) | 141.151.213.35.bc.googleusercontent.com | - | Medium
|
||||
119 | [35.214.151.75](https://vuldb.com/?ip.35.214.151.75) | 75.151.214.35.bc.googleusercontent.com | - | Medium
|
||||
120 | [36.91.44.183](https://vuldb.com/?ip.36.91.44.183) | - | - | High
|
||||
121 | [37.9.175.14](https://vuldb.com/?ip.37.9.175.14) | 14.175.9.37.in-addr.arpa.websupport.sk | - | High
|
||||
122 | [37.46.129.215](https://vuldb.com/?ip.37.46.129.215) | we-too.ru | - | High
|
||||
123 | [37.97.135.82](https://vuldb.com/?ip.37.97.135.82) | 37-97-135-82.colo.transip.net | - | High
|
||||
124 | [37.120.175.15](https://vuldb.com/?ip.37.120.175.15) | v220220112692175454.nicesrv.de | - | High
|
||||
125 | [37.139.21.175](https://vuldb.com/?ip.37.139.21.175) | 37.139.21.175-e2-8080-keep-up | - | High
|
||||
126 | [37.179.204.33](https://vuldb.com/?ip.37.179.204.33) | - | - | High
|
||||
127 | [37.187.4.178](https://vuldb.com/?ip.37.187.4.178) | ks2.kku.io | - | High
|
||||
128 | [37.187.5.82](https://vuldb.com/?ip.37.187.5.82) | ks3370412.kimsufi.com | - | High
|
||||
129 | [37.187.56.166](https://vuldb.com/?ip.37.187.56.166) | - | - | High
|
||||
130 | [37.187.57.57](https://vuldb.com/?ip.37.187.57.57) | ns3357940.ovh.net | - | High
|
||||
131 | [37.187.72.193](https://vuldb.com/?ip.37.187.72.193) | ns3362285.ip-37-187-72.eu | - | High
|
||||
132 | [37.187.161.206](https://vuldb.com/?ip.37.187.161.206) | toolbox.alabs.io | - | High
|
||||
133 | [37.205.9.252](https://vuldb.com/?ip.37.205.9.252) | s1.ithelp24.eu | - | High
|
||||
134 | [37.221.70.250](https://vuldb.com/?ip.37.221.70.250) | b2b-customer.inftele.net | - | High
|
||||
135 | [37.228.137.204](https://vuldb.com/?ip.37.228.137.204) | wiki.lmap.ir | - | High
|
||||
136 | [37.247.101.241](https://vuldb.com/?ip.37.247.101.241) | server241.turkwebdizayn.com | - | High
|
||||
137 | [40.97.124.18](https://vuldb.com/?ip.40.97.124.18) | - | - | High
|
||||
138 | [41.76.108.46](https://vuldb.com/?ip.41.76.108.46) | - | - | High
|
||||
139 | [41.169.20.147](https://vuldb.com/?ip.41.169.20.147) | - | - | High
|
||||
140 | [41.169.36.237](https://vuldb.com/?ip.41.169.36.237) | - | - | High
|
||||
141 | [41.185.28.84](https://vuldb.com/?ip.41.185.28.84) | brf01-nix01.wadns.net | - | High
|
||||
142 | [41.185.29.128](https://vuldb.com/?ip.41.185.29.128) | abp79-nix01.wadns.net | - | High
|
||||
143 | [41.190.32.8](https://vuldb.com/?ip.41.190.32.8) | smtp11.utande.co.zw | - | High
|
||||
144 | [41.203.62.170](https://vuldb.com/?ip.41.203.62.170) | - | - | High
|
||||
145 | [41.204.202.41](https://vuldb.com/?ip.41.204.202.41) | www41.cpt2.host-h.net | - | High
|
||||
146 | [41.231.225.139](https://vuldb.com/?ip.41.231.225.139) | - | - | High
|
||||
147 | [42.62.40.103](https://vuldb.com/?ip.42.62.40.103) | - | - | High
|
||||
148 | [43.229.62.186](https://vuldb.com/?ip.43.229.62.186) | rocket-cheese.bnr.la | - | High
|
||||
149 | [45.16.226.117](https://vuldb.com/?ip.45.16.226.117) | 45-16-226-117.lightspeed.sndgca.sbcglobal.net | - | High
|
||||
150 | [45.33.35.103](https://vuldb.com/?ip.45.33.35.103) | li985-103.members.linode.com | - | High
|
||||
151 | [45.33.54.74](https://vuldb.com/?ip.45.33.54.74) | li1004-74.members.linode.com | - | High
|
||||
152 | [45.33.77.42](https://vuldb.com/?ip.45.33.77.42) | li1023-42.members.linode.com | - | High
|
||||
153 | [45.46.37.97](https://vuldb.com/?ip.45.46.37.97) | cpe-45-46-37-97.maine.res.rr.com | - | High
|
||||
154 | [45.55.36.51](https://vuldb.com/?ip.45.55.36.51) | - | - | High
|
||||
155 | [45.55.82.2](https://vuldb.com/?ip.45.55.82.2) | - | - | High
|
||||
156 | [45.55.179.121](https://vuldb.com/?ip.45.55.179.121) | - | - | High
|
||||
157 | [45.55.219.163](https://vuldb.com/?ip.45.55.219.163) | - | - | High
|
||||
158 | [45.56.88.91](https://vuldb.com/?ip.45.56.88.91) | 45-56-88-91.ip.linodeusercontent.com | - | High
|
||||
159 | [45.56.127.75](https://vuldb.com/?ip.45.56.127.75) | li945-75.members.linode.com | - | High
|
||||
160 | [45.59.204.133](https://vuldb.com/?ip.45.59.204.133) | rrcs-45-59-204-133.west.biz.rr.com | - | High
|
||||
161 | [45.76.176.10](https://vuldb.com/?ip.45.76.176.10) | 45.76.176.10.vultrusercontent.com | - | High
|
||||
162 | [45.77.154.161](https://vuldb.com/?ip.45.77.154.161) | 45.77.154.161.vultrusercontent.com | - | High
|
||||
163 | [45.79.95.107](https://vuldb.com/?ip.45.79.95.107) | li1194-107.members.linode.com | - | High
|
||||
164 | [45.79.173.200](https://vuldb.com/?ip.45.79.173.200) | 45-79-173-200.ip.linodeusercontent.com | - | High
|
||||
165 | [45.79.188.67](https://vuldb.com/?ip.45.79.188.67) | li1287-67.members.linode.com | - | High
|
||||
166 | [45.80.148.200](https://vuldb.com/?ip.45.80.148.200) | - | - | High
|
||||
167 | [45.118.115.99](https://vuldb.com/?ip.45.118.115.99) | - | - | High
|
||||
168 | [45.118.135.203](https://vuldb.com/?ip.45.118.135.203) | 45-118-135-203.ip.linodeusercontent.com | - | High
|
||||
169 | [45.118.136.92](https://vuldb.com/?ip.45.118.136.92) | - | - | High
|
||||
170 | [45.119.83.237](https://vuldb.com/?ip.45.119.83.237) | - | - | High
|
||||
171 | [45.142.114.231](https://vuldb.com/?ip.45.142.114.231) | mail.dounutmail.de | - | High
|
||||
172 | [45.176.232.124](https://vuldb.com/?ip.45.176.232.124) | - | - | High
|
||||
173 | [45.230.45.171](https://vuldb.com/?ip.45.230.45.171) | - | - | High
|
||||
174 | [45.252.251.10](https://vuldb.com/?ip.45.252.251.10) | - | - | High
|
||||
175 | [46.4.100.178](https://vuldb.com/?ip.46.4.100.178) | support.wizard-shopservice.de | - | High
|
||||
176 | [46.4.192.185](https://vuldb.com/?ip.46.4.192.185) | static.185.192.4.46.clients.your-server.de | - | High
|
||||
177 | [46.28.111.142](https://vuldb.com/?ip.46.28.111.142) | enkindu.jsuchy.net | - | High
|
||||
178 | [46.30.213.132](https://vuldb.com/?ip.46.30.213.132) | - | - | High
|
||||
179 | [46.32.229.152](https://vuldb.com/?ip.46.32.229.152) | 094882.vps-10.com | - | High
|
||||
180 | [46.32.233.226](https://vuldb.com/?ip.46.32.233.226) | yetitoolusa.com | - | High
|
||||
181 | [46.38.238.8](https://vuldb.com/?ip.46.38.238.8) | v2202109122001163131.happysrv.de | - | High
|
||||
182 | [46.43.2.95](https://vuldb.com/?ip.46.43.2.95) | chris.default.cjenkinson.uk0.bigv.io | - | High
|
||||
183 | [46.49.124.53](https://vuldb.com/?ip.46.49.124.53) | - | - | High
|
||||
184 | [46.55.222.11](https://vuldb.com/?ip.46.55.222.11) | - | - | High
|
||||
185 | [46.101.58.37](https://vuldb.com/?ip.46.101.58.37) | 46.101.58.37-e1-8080 | - | High
|
||||
186 | [46.105.81.76](https://vuldb.com/?ip.46.105.81.76) | myu0.cylipo.sbs | - | High
|
||||
187 | [46.105.114.137](https://vuldb.com/?ip.46.105.114.137) | ns3188253.ip-46-105-114.eu | - | High
|
||||
188 | [46.105.131.68](https://vuldb.com/?ip.46.105.131.68) | http.adven.fr | - | High
|
||||
189 | [46.105.131.69](https://vuldb.com/?ip.46.105.131.69) | epouventaille.adven.fr | - | High
|
||||
190 | [46.105.131.79](https://vuldb.com/?ip.46.105.131.79) | relay.adven.fr | - | High
|
||||
191 | [46.105.131.87](https://vuldb.com/?ip.46.105.131.87) | pop.adven.fr | - | High
|
||||
192 | [46.105.236.18](https://vuldb.com/?ip.46.105.236.18) | - | - | High
|
||||
193 | [46.165.212.76](https://vuldb.com/?ip.46.165.212.76) | - | - | High
|
||||
194 | [46.165.254.206](https://vuldb.com/?ip.46.165.254.206) | - | - | High
|
||||
195 | [46.214.107.142](https://vuldb.com/?ip.46.214.107.142) | 46-214-107-142.next-gen.ro | - | High
|
||||
196 | [47.36.140.164](https://vuldb.com/?ip.47.36.140.164) | 047-036-140-164.res.spectrum.com | - | High
|
||||
197 | [47.52.19.221](https://vuldb.com/?ip.47.52.19.221) | - | - | High
|
||||
198 | [47.146.32.175](https://vuldb.com/?ip.47.146.32.175) | - | - | High
|
||||
199 | [47.146.39.147](https://vuldb.com/?ip.47.146.39.147) | - | - | High
|
||||
200 | [47.150.11.161](https://vuldb.com/?ip.47.150.11.161) | - | - | High
|
||||
201 | [47.188.131.94](https://vuldb.com/?ip.47.188.131.94) | - | - | High
|
||||
202 | [47.201.208.154](https://vuldb.com/?ip.47.201.208.154) | - | - | High
|
||||
203 | [47.246.24.225](https://vuldb.com/?ip.47.246.24.225) | - | - | High
|
||||
204 | [47.246.24.226](https://vuldb.com/?ip.47.246.24.226) | - | - | High
|
||||
205 | [47.246.24.230](https://vuldb.com/?ip.47.246.24.230) | - | - | High
|
||||
206 | [47.246.24.232](https://vuldb.com/?ip.47.246.24.232) | - | - | High
|
||||
207 | [49.12.121.47](https://vuldb.com/?ip.49.12.121.47) | filezilla-project.org | - | High
|
||||
208 | [49.50.209.131](https://vuldb.com/?ip.49.50.209.131) | 131.host-49-50-209.euba.megatel.co.nz | - | High
|
||||
209 | [49.212.135.76](https://vuldb.com/?ip.49.212.135.76) | os3-321-50322.vs.sakura.ne.jp | - | High
|
||||
210 | [49.212.155.94](https://vuldb.com/?ip.49.212.155.94) | os3-325-52340.vs.sakura.ne.jp | - | High
|
||||
211 | [50.22.35.194](https://vuldb.com/?ip.50.22.35.194) | c2.23.1632.ip4.static.sl-reverse.com | - | High
|
||||
212 | [50.23.248.182](https://vuldb.com/?ip.50.23.248.182) | b6.f8.1732.ip4.static.sl-reverse.com | - | High
|
||||
213 | [50.28.51.143](https://vuldb.com/?ip.50.28.51.143) | - | - | High
|
||||
214 | [50.30.40.196](https://vuldb.com/?ip.50.30.40.196) | usve255301.serverprofi24.com | - | High
|
||||
215 | [50.31.146.101](https://vuldb.com/?ip.50.31.146.101) | mail.brillinjurylaw.com | - | High
|
||||
216 | [50.31.174.165](https://vuldb.com/?ip.50.31.174.165) | priva28.privatednsorg.com | - | High
|
||||
217 | [50.56.135.44](https://vuldb.com/?ip.50.56.135.44) | - | - | High
|
||||
218 | [50.62.176.42](https://vuldb.com/?ip.50.62.176.42) | p3plcpnl0515.prod.phx3.secureserver.net | - | High
|
||||
219 | [50.62.176.244](https://vuldb.com/?ip.50.62.176.244) | p3plcpnl0728.prod.phx3.secureserver.net | - | High
|
||||
220 | [50.62.194.30](https://vuldb.com/?ip.50.62.194.30) | ip-50-62-194-30.ip.secureserver.net | - | High
|
||||
221 | [50.63.8.21](https://vuldb.com/?ip.50.63.8.21) | ip-50-63-8-21.ip.secureserver.net | - | High
|
||||
222 | [50.78.167.65](https://vuldb.com/?ip.50.78.167.65) | millcreek.cc | - | High
|
||||
223 | [50.87.59.65](https://vuldb.com/?ip.50.87.59.65) | 50-87-59-65.unifiedlayer.com | - | High
|
||||
224 | [50.87.144.137](https://vuldb.com/?ip.50.87.144.137) | gator3103.hostgator.com | - | High
|
||||
225 | [50.87.144.197](https://vuldb.com/?ip.50.87.144.197) | gator3161.hostgator.com | - | High
|
||||
226 | [50.87.150.177](https://vuldb.com/?ip.50.87.150.177) | 50-87-150-177.unifiedlayer.com | - | High
|
||||
227 | [50.91.114.38](https://vuldb.com/?ip.50.91.114.38) | 050-091-114-038.res.spectrum.com | - | High
|
||||
228 | [50.92.101.60](https://vuldb.com/?ip.50.92.101.60) | d50-92-101-60.bchsia.telus.net | - | High
|
||||
229 | [50.116.54.215](https://vuldb.com/?ip.50.116.54.215) | li440-215.members.linode.com | - | High
|
||||
230 | [50.116.78.109](https://vuldb.com/?ip.50.116.78.109) | intersearchmedia.com | - | High
|
||||
231 | [50.116.86.205](https://vuldb.com/?ip.50.116.86.205) | template3.domain.com | - | High
|
||||
232 | [50.121.220.50](https://vuldb.com/?ip.50.121.220.50) | static-50-121-220-50.clbg.wv.frontiernet.net | - | High
|
||||
233 | [50.245.107.73](https://vuldb.com/?ip.50.245.107.73) | 50-245-107-73-static.hfc.comcastbusiness.net | - | High
|
||||
234 | [51.15.4.22](https://vuldb.com/?ip.51.15.4.22) | 51-15-4-22.rev.poneytelecom.eu | - | High
|
||||
235 | [51.15.7.145](https://vuldb.com/?ip.51.15.7.145) | 51-15-7-145.rev.poneytelecom.eu | - | High
|
||||
236 | [51.38.124.206](https://vuldb.com/?ip.51.38.124.206) | 206.ip-51-38-124.eu | - | High
|
||||
237 | [51.38.201.19](https://vuldb.com/?ip.51.38.201.19) | ip19.ip-51-38-201.eu | - | High
|
||||
238 | [51.68.175.8](https://vuldb.com/?ip.51.68.175.8) | vps-9dba3732.vps.ovh.net | - | High
|
||||
239 | [51.68.220.244](https://vuldb.com/?ip.51.68.220.244) | vps-7a400d57.vps.ovh.net | - | High
|
||||
240 | [51.75.33.120](https://vuldb.com/?ip.51.75.33.120) | ip120.ip-51-75-33.eu | - | High
|
||||
241 | [51.75.33.127](https://vuldb.com/?ip.51.75.33.127) | ip127.ip-51-75-33.eu | - | High
|
||||
242 | [51.77.113.100](https://vuldb.com/?ip.51.77.113.100) | titan40.fastworldwideweb.com | - | High
|
||||
243 | [51.89.36.180](https://vuldb.com/?ip.51.89.36.180) | ip180.ip-51-89-36.eu | - | High
|
||||
244 | [51.89.199.141](https://vuldb.com/?ip.51.89.199.141) | ip141.ip-51-89-199.eu | - | High
|
||||
245 | [51.91.7.5](https://vuldb.com/?ip.51.91.7.5) | ns3147667.ip-51-91-7.eu | - | High
|
||||
246 | [51.91.76.89](https://vuldb.com/?ip.51.91.76.89) | 89.ip-51-91-76.eu | - | High
|
||||
247 | [51.159.23.217](https://vuldb.com/?ip.51.159.23.217) | jambold.co.uk | - | High
|
||||
248 | [51.159.35.157](https://vuldb.com/?ip.51.159.35.157) | 51-159-35-157.rev.poneytelecom.eu | - | High
|
||||
249 | [51.254.137.156](https://vuldb.com/?ip.51.254.137.156) | mail.unolan.net | - | High
|
||||
250 | [51.254.140.238](https://vuldb.com/?ip.51.254.140.238) | 238.ip-51-254-140.eu | - | High
|
||||
251 | [51.255.50.164](https://vuldb.com/?ip.51.255.50.164) | vps-b6cfe010.vps.ovh.net | - | High
|
||||
252 | [51.255.165.160](https://vuldb.com/?ip.51.255.165.160) | 160.ip-51-255-165.eu | - | High
|
||||
253 | [52.31.99.185](https://vuldb.com/?ip.52.31.99.185) | ec2-52-31-99-185.eu-west-1.compute.amazonaws.com | - | Medium
|
||||
254 | [52.66.202.63](https://vuldb.com/?ip.52.66.202.63) | ec2-52-66-202-63.ap-south-1.compute.amazonaws.com | - | Medium
|
||||
255 | [52.96.38.82](https://vuldb.com/?ip.52.96.38.82) | - | - | High
|
||||
256 | [52.96.40.242](https://vuldb.com/?ip.52.96.40.242) | - | - | High
|
||||
257 | [52.96.62.226](https://vuldb.com/?ip.52.96.62.226) | - | - | High
|
||||
258 | [54.36.185.60](https://vuldb.com/?ip.54.36.185.60) | ip60.ip-54-36-185.eu | - | High
|
||||
259 | [54.38.94.197](https://vuldb.com/?ip.54.38.94.197) | ns3140984.ip-54-38-94.eu | - | High
|
||||
260 | [54.38.143.245](https://vuldb.com/?ip.54.38.143.245) | tools.inovato.me | - | High
|
||||
261 | [54.88.144.211](https://vuldb.com/?ip.54.88.144.211) | va-smtp01.263.net | - | High
|
||||
262 | [58.27.215.3](https://vuldb.com/?ip.58.27.215.3) | 58-27-215-3.wateen.net | - | High
|
||||
263 | [58.94.58.13](https://vuldb.com/?ip.58.94.58.13) | i58-94-58-13.s41.a014.ap.plala.or.jp | - | High
|
||||
264 | [58.96.74.42](https://vuldb.com/?ip.58.96.74.42) | 42.74.96.58.static.exetel.com.au | - | High
|
||||
265 | [58.171.38.26](https://vuldb.com/?ip.58.171.38.26) | - | - | High
|
||||
266 | [58.216.16.130](https://vuldb.com/?ip.58.216.16.130) | - | - | High
|
||||
267 | [58.227.42.236](https://vuldb.com/?ip.58.227.42.236) | - | - | High
|
||||
268 | [59.110.18.236](https://vuldb.com/?ip.59.110.18.236) | - | - | High
|
||||
269 | [59.120.5.154](https://vuldb.com/?ip.59.120.5.154) | 59-120-5-154.hinet-ip.hinet.net | - | High
|
||||
270 | [59.124.1.19](https://vuldb.com/?ip.59.124.1.19) | 59-124-1-19.hinet-ip.hinet.net | - | High
|
||||
271 | [59.148.253.194](https://vuldb.com/?ip.59.148.253.194) | 059148253194.ctinets.com | - | High
|
||||
272 | [59.152.93.46](https://vuldb.com/?ip.59.152.93.46) | 46.93.152.59.zipnetltd.com | - | High
|
||||
273 | [60.36.166.212](https://vuldb.com/?ip.60.36.166.212) | imail.mail.plala.or.jp | - | High
|
||||
274 | [60.93.23.51](https://vuldb.com/?ip.60.93.23.51) | softbank060093023051.bbtec.net | - | High
|
||||
275 | [60.108.128.186](https://vuldb.com/?ip.60.108.128.186) | softbank060108128186.bbtec.net | - | High
|
||||
276 | [60.125.114.64](https://vuldb.com/?ip.60.125.114.64) | softbank060125114064.bbtec.net | - | High
|
||||
277 | [60.249.78.226](https://vuldb.com/?ip.60.249.78.226) | 60-249-78-226.hinet-ip.hinet.net | - | High
|
||||
278 | [61.19.246.238](https://vuldb.com/?ip.61.19.246.238) | - | - | High
|
||||
279 | [61.197.37.169](https://vuldb.com/?ip.61.197.37.169) | pl937.ag1001.nttpc.ne.jp | - | High
|
||||
280 | [62.28.40.155](https://vuldb.com/?ip.62.28.40.155) | exchange.ptasp.com | - | High
|
||||
281 | [62.30.7.67](https://vuldb.com/?ip.62.30.7.67) | 67.7-30-62.static.virginmediabusiness.co.uk | - | High
|
||||
282 | [62.75.141.82](https://vuldb.com/?ip.62.75.141.82) | static-ip-62-75-141-82.inaddr.ip-pool.com | - | High
|
||||
283 | [62.84.75.50](https://vuldb.com/?ip.62.84.75.50) | mail.saadegrp.com.lb | - | High
|
||||
284 | [62.141.45.103](https://vuldb.com/?ip.62.141.45.103) | vps2009743.fastwebserver.de | - | High
|
||||
285 | [62.149.128.42](https://vuldb.com/?ip.62.149.128.42) | imaps.aruba.it | - | High
|
||||
286 | [62.149.128.72](https://vuldb.com/?ip.62.149.128.72) | mxd4.aruba.it | - | High
|
||||
287 | [62.149.128.179](https://vuldb.com/?ip.62.149.128.179) | pop3s.aruba.it | - | High
|
||||
288 | [62.149.128.200](https://vuldb.com/?ip.62.149.128.200) | smtp1.aruba.it | - | High
|
||||
289 | [62.149.128.210](https://vuldb.com/?ip.62.149.128.210) | smtpa1.aruba.it | - | High
|
||||
290 | [62.149.152.151](https://vuldb.com/?ip.62.149.152.151) | - | - | High
|
||||
291 | [62.149.152.152](https://vuldb.com/?ip.62.149.152.152) | - | - | High
|
||||
292 | [62.149.157.55](https://vuldb.com/?ip.62.149.157.55) | - | - | High
|
||||
293 | [62.171.142.179](https://vuldb.com/?ip.62.171.142.179) | vmi499457.contaboserver.net | - | High
|
||||
294 | [62.171.178.147](https://vuldb.com/?ip.62.171.178.147) | vmi365451.contaboserver.net | - | High
|
||||
295 | [62.210.127.136](https://vuldb.com/?ip.62.210.127.136) | 62-210-127-136.rev.poneytelecom.eu | - | High
|
||||
296 | [62.212.34.102](https://vuldb.com/?ip.62.212.34.102) | - | - | High
|
||||
297 | [62.234.99.30](https://vuldb.com/?ip.62.234.99.30) | - | - | High
|
||||
298 | [63.142.253.122](https://vuldb.com/?ip.63.142.253.122) | - | - | High
|
||||
299 | [64.4.244.68](https://vuldb.com/?ip.64.4.244.68) | - | - | High
|
||||
300 | [64.26.60.221](https://vuldb.com/?ip.64.26.60.221) | pop5.csee.onr.siteprotect.com | - | High
|
||||
301 | [64.41.126.110](https://vuldb.com/?ip.64.41.126.110) | securesmtp.csee.siteprotect.com | - | High
|
||||
302 | [64.59.136.142](https://vuldb.com/?ip.64.59.136.142) | mail.shaw.ca | - | High
|
||||
303 | [64.60.82.82](https://vuldb.com/?ip.64.60.82.82) | 64-60-82-82.static-ip.telepacific.net | - | High
|
||||
304 | [64.71.36.11](https://vuldb.com/?ip.64.71.36.11) | - | - | High
|
||||
305 | [64.85.73.16](https://vuldb.com/?ip.64.85.73.16) | - | - | High
|
||||
306 | [64.88.202.250](https://vuldb.com/?ip.64.88.202.250) | - | - | High
|
||||
307 | [64.90.62.162](https://vuldb.com/?ip.64.90.62.162) | pop.dreamhost.com | - | High
|
||||
308 | [64.91.228.45](https://vuldb.com/?ip.64.91.228.45) | - | - | High
|
||||
309 | [64.98.36.5](https://vuldb.com/?ip.64.98.36.5) | mail.b.hostedemail.com | - | High
|
||||
310 | [64.98.36.173](https://vuldb.com/?ip.64.98.36.173) | mail.lawyers-mail.com | - | High
|
||||
311 | [64.183.73.122](https://vuldb.com/?ip.64.183.73.122) | rrcs-64-183-73-122.west.biz.rr.com | - | High
|
||||
312 | [64.190.63.136](https://vuldb.com/?ip.64.190.63.136) | - | - | High
|
||||
313 | [64.207.182.168](https://vuldb.com/?ip.64.207.182.168) | - | - | High
|
||||
314 | [64.250.117.68](https://vuldb.com/?ip.64.250.117.68) | smtp.movistarcloud.com.ve | - | High
|
||||
315 | [65.49.60.163](https://vuldb.com/?ip.65.49.60.163) | 65-49-60-163.ip.linodeusercontent.com | - | High
|
||||
316 | [65.55.72.183](https://vuldb.com/?ip.65.55.72.183) | origin.sn134w.snt134.mail.live.com | - | High
|
||||
317 | [65.182.102.90](https://vuldb.com/?ip.65.182.102.90) | mail.geantes.com | - | High
|
||||
318 | [65.254.228.100](https://vuldb.com/?ip.65.254.228.100) | customer.hostcentric.com | - | High
|
||||
319 | [66.23.200.58](https://vuldb.com/?ip.66.23.200.58) | - | - | High
|
||||
320 | [66.42.55.5](https://vuldb.com/?ip.66.42.55.5) | 66.42.55.5.vultrusercontent.com | - | High
|
||||
321 | [66.50.57.73](https://vuldb.com/?ip.66.50.57.73) | 66-50-57-73.prtc.net | - | High
|
||||
322 | [66.54.51.172](https://vuldb.com/?ip.66.54.51.172) | - | - | High
|
||||
323 | [66.71.241.102](https://vuldb.com/?ip.66.71.241.102) | mail.nixhost.net | - | High
|
||||
324 | [66.76.26.33](https://vuldb.com/?ip.66.76.26.33) | 66-76-26-33.hdsncmta01.com.sta.suddenlink.net | - | High
|
||||
325 | [66.96.134.1](https://vuldb.com/?ip.66.96.134.1) | 1.134.96.66.static.eigbox.net | - | High
|
||||
326 | [66.96.147.103](https://vuldb.com/?ip.66.96.147.103) | 103.147.96.66.static.eigbox.net | - | High
|
||||
327 | [66.96.147.110](https://vuldb.com/?ip.66.96.147.110) | 110.147.96.66.static.eigbox.net | - | High
|
||||
328 | [66.195.202.115](https://vuldb.com/?ip.66.195.202.115) | mail.navarac.com | - | High
|
||||
329 | [66.209.69.165](https://vuldb.com/?ip.66.209.69.165) | - | - | High
|
||||
330 | [66.216.234.131](https://vuldb.com/?ip.66.216.234.131) | 066-216-234-131.res.spectrum.com | - | High
|
||||
331 | [66.220.110.56](https://vuldb.com/?ip.66.220.110.56) | h66-220-110-56.bendor.broadband.dynamic.tds.net | - | High
|
||||
332 | [66.228.32.31](https://vuldb.com/?ip.66.228.32.31) | li282-31.members.linode.com | - | High
|
||||
333 | [66.228.45.129](https://vuldb.com/?ip.66.228.45.129) | li326-129.members.linode.com | - | High
|
||||
334 | [66.228.61.248](https://vuldb.com/?ip.66.228.61.248) | li318-248.members.linode.com | - | High
|
||||
335 | [67.19.105.107](https://vuldb.com/?ip.67.19.105.107) | ns2.datatrust.com.br | - | High
|
||||
336 | [67.68.235.25](https://vuldb.com/?ip.67.68.235.25) | bas10-montrealak-67-68-235-25.dsl.bell.ca | - | High
|
||||
337 | [67.163.161.107](https://vuldb.com/?ip.67.163.161.107) | c-67-163-161-107.hsd1.pa.comcast.net | - | High
|
||||
338 | [67.170.250.203](https://vuldb.com/?ip.67.170.250.203) | c-67-170-250-203.hsd1.ca.comcast.net | - | High
|
||||
339 | [67.177.71.77](https://vuldb.com/?ip.67.177.71.77) | c-67-177-71-77.hsd1.al.comcast.net | - | High
|
||||
340 | [67.195.197.75](https://vuldb.com/?ip.67.195.197.75) | p9ats-i.geo.vip.bf1.yahoo.com | - | High
|
||||
341 | [67.195.228.95](https://vuldb.com/?ip.67.195.228.95) | unknown.yahoo.com | - | High
|
||||
342 | [67.212.168.237](https://vuldb.com/?ip.67.212.168.237) | 237.168.212.67.unassigned.ord.singlehop.net | - | High
|
||||
343 | [67.216.131.134](https://vuldb.com/?ip.67.216.131.134) | 134.131.216.67.134.static.hargray.net | - | High
|
||||
344 | [67.222.2.148](https://vuldb.com/?ip.67.222.2.148) | - | - | High
|
||||
345 | [67.225.218.50](https://vuldb.com/?ip.67.225.218.50) | lb01.parklogic.com | - | High
|
||||
346 | [67.225.221.173](https://vuldb.com/?ip.67.225.221.173) | host.hddpool2.net | - | High
|
||||
347 | [67.225.229.55](https://vuldb.com/?ip.67.225.229.55) | - | - | High
|
||||
348 | [67.241.81.253](https://vuldb.com/?ip.67.241.81.253) | cpe-67-241-81-253.twcny.res.rr.com | - | High
|
||||
349 | [68.2.97.91](https://vuldb.com/?ip.68.2.97.91) | ip68-2-97-91.ph.ph.cox.net | - | High
|
||||
350 | [68.44.137.144](https://vuldb.com/?ip.68.44.137.144) | c-68-44-137-144.hsd1.in.comcast.net | - | High
|
||||
351 | [68.66.194.12](https://vuldb.com/?ip.68.66.194.12) | 68.66.194.12.static.a2webhosting.com | - | High
|
||||
352 | [68.66.248.6](https://vuldb.com/?ip.68.66.248.6) | nl1-ls1.a2hosting.com | - | High
|
||||
353 | [68.178.213.203](https://vuldb.com/?ip.68.178.213.203) | p3plibsmtp03-v01.prod.phx3.secureserver.net | - | High
|
||||
354 | [68.183.62.61](https://vuldb.com/?ip.68.183.62.61) | - | - | High
|
||||
355 | [68.183.170.114](https://vuldb.com/?ip.68.183.170.114) | 68.183.170.114-e1-8080-keep-up | - | High
|
||||
356 | [68.183.190.199](https://vuldb.com/?ip.68.183.190.199) | 68.183.190.199-e1-8080-keep-up | - | High
|
||||
357 | [69.16.228.14](https://vuldb.com/?ip.69.16.228.14) | kurt.duplika.com | - | High
|
||||
358 | [69.16.254.127](https://vuldb.com/?ip.69.16.254.127) | cloudvpsserver.etelligens.in | - | High
|
||||
359 | [69.17.170.58](https://vuldb.com/?ip.69.17.170.58) | unallocated-static.rogers.com | - | High
|
||||
360 | [69.43.168.200](https://vuldb.com/?ip.69.43.168.200) | ns0.imunplugged.com | - | High
|
||||
361 | [69.43.168.232](https://vuldb.com/?ip.69.43.168.232) | - | - | High
|
||||
362 | [69.45.19.251](https://vuldb.com/?ip.69.45.19.251) | coastinet.com | - | High
|
||||
363 | [69.61.0.198](https://vuldb.com/?ip.69.61.0.198) | alpha01.serverparlor.net | - | High
|
||||
364 | [69.147.92.11](https://vuldb.com/?ip.69.147.92.11) | e1.ycpi.vip.dca.yahoo.com | - | High
|
||||
365 | [69.147.92.12](https://vuldb.com/?ip.69.147.92.12) | e2.ycpi.vip.dca.yahoo.com | - | High
|
||||
366 | [69.156.240.33](https://vuldb.com/?ip.69.156.240.33) | smtp.transportalliance.ca | - | High
|
||||
367 | [69.163.33.82](https://vuldb.com/?ip.69.163.33.82) | - | - | High
|
||||
368 | [69.167.152.111](https://vuldb.com/?ip.69.167.152.111) | - | - | High
|
||||
369 | [69.168.106.36](https://vuldb.com/?ip.69.168.106.36) | mail.windstream.syn-alias.com | - | High
|
||||
370 | [69.175.31.212](https://vuldb.com/?ip.69.175.31.212) | 212.31.175.69.unassigned.ord.singlehop.net | - | High
|
||||
371 | [69.198.17.20](https://vuldb.com/?ip.69.198.17.20) | 69-198-17-20.customerip.birch.net | - | High
|
||||
372 | [69.198.17.49](https://vuldb.com/?ip.69.198.17.49) | 69-198-17-49.customerip.birch.net | - | High
|
||||
373 | [70.32.84.74](https://vuldb.com/?ip.70.32.84.74) | - | - | High
|
||||
374 | [70.32.89.105](https://vuldb.com/?ip.70.32.89.105) | parties-at-sea.com | - | High
|
||||
375 | [70.32.92.133](https://vuldb.com/?ip.70.32.92.133) | popdesigngroup.com | - | High
|
||||
376 | ... | ... | ... | ...
|
||||
7 | [2.58.16.87](https://vuldb.com/?ip.2.58.16.87) | - | - | High
|
||||
8 | [2.58.16.89](https://vuldb.com/?ip.2.58.16.89) | - | - | High
|
||||
9 | [2.82.75.215](https://vuldb.com/?ip.2.82.75.215) | bl21-75-215.dsl.telepac.pt | - | High
|
||||
10 | [5.2.75.167](https://vuldb.com/?ip.5.2.75.167) | coms.a9v34.com.cn | - | High
|
||||
11 | [5.2.84.232](https://vuldb.com/?ip.5.2.84.232) | momos.alastyr.com | - | High
|
||||
12 | [5.2.136.90](https://vuldb.com/?ip.5.2.136.90) | static-5-2-136-90.rdsnet.ro | - | High
|
||||
13 | [5.2.182.7](https://vuldb.com/?ip.5.2.182.7) | static-5-2-182-7.rdsnet.ro | - | High
|
||||
14 | [5.2.212.254](https://vuldb.com/?ip.5.2.212.254) | static-5-2-212-254.rdsnet.ro | - | High
|
||||
15 | [5.9.49.12](https://vuldb.com/?ip.5.9.49.12) | static.12.49.9.5.clients.your-server.de | - | High
|
||||
16 | [5.9.116.246](https://vuldb.com/?ip.5.9.116.246) | static.246.116.9.5.clients.your-server.de | - | High
|
||||
17 | [5.9.128.163](https://vuldb.com/?ip.5.9.128.163) | static.163.128.9.5.clients.your-server.de | - | High
|
||||
18 | [5.9.189.24](https://vuldb.com/?ip.5.9.189.24) | static.24.189.9.5.clients.your-server.de | - | High
|
||||
19 | [5.12.246.155](https://vuldb.com/?ip.5.12.246.155) | 5-12-246-155.residential.rdsnet.ro | - | High
|
||||
20 | [5.35.249.46](https://vuldb.com/?ip.5.35.249.46) | rs250366.rs.hosteurope.de | - | High
|
||||
21 | [5.39.69.166](https://vuldb.com/?ip.5.39.69.166) | ns340204.ip-5-39-69.eu | - | High
|
||||
22 | [5.39.84.48](https://vuldb.com/?ip.5.39.84.48) | ns3126815.ip-5-39-84.eu | - | High
|
||||
23 | [5.39.91.110](https://vuldb.com/?ip.5.39.91.110) | ns3278366.ip-5-39-91.eu | - | High
|
||||
24 | [5.45.108.146](https://vuldb.com/?ip.5.45.108.146) | cosmo.jumpingcrab.com | - | High
|
||||
25 | [5.56.56.146](https://vuldb.com/?ip.5.56.56.146) | sites1.tucomunidad.cloud | - | High
|
||||
26 | [5.56.132.177](https://vuldb.com/?ip.5.56.132.177) | asiatech.dn-server.com | - | High
|
||||
27 | [5.79.70.250](https://vuldb.com/?ip.5.79.70.250) | - | - | High
|
||||
28 | [5.89.33.136](https://vuldb.com/?ip.5.89.33.136) | net-5-89-33-136.cust.vodafonedsl.it | - | High
|
||||
29 | [5.101.138.188](https://vuldb.com/?ip.5.101.138.188) | uk.mthservers.com | - | High
|
||||
30 | [5.159.57.195](https://vuldb.com/?ip.5.159.57.195) | www-riedle.transfermarkt.de | - | High
|
||||
31 | [5.189.160.61](https://vuldb.com/?ip.5.189.160.61) | ip-61-160-189-5.static.contabo.net | - | High
|
||||
32 | [5.196.35.138](https://vuldb.com/?ip.5.196.35.138) | vps10.open-techno.net | - | High
|
||||
33 | [5.196.73.150](https://vuldb.com/?ip.5.196.73.150) | ns3000085.ip-5-196-73.eu | - | High
|
||||
34 | [5.196.133.206](https://vuldb.com/?ip.5.196.133.206) | pixelfed.hosnet.fr | - | High
|
||||
35 | [5.230.193.41](https://vuldb.com/?ip.5.230.193.41) | casagarcia-web.sys.netzfabrik.eu | - | High
|
||||
36 | [8.4.9.137](https://vuldb.com/?ip.8.4.9.137) | onlinehorizons.net | - | High
|
||||
37 | [8.9.11.48](https://vuldb.com/?ip.8.9.11.48) | 8.9.11.48.vultrusercontent.com | - | High
|
||||
38 | [8.247.6.134](https://vuldb.com/?ip.8.247.6.134) | - | - | High
|
||||
39 | [8.248.153.254](https://vuldb.com/?ip.8.248.153.254) | - | - | High
|
||||
40 | [8.248.163.254](https://vuldb.com/?ip.8.248.163.254) | - | - | High
|
||||
41 | [8.249.219.254](https://vuldb.com/?ip.8.249.219.254) | - | - | High
|
||||
42 | [8.249.241.254](https://vuldb.com/?ip.8.249.241.254) | - | - | High
|
||||
43 | [8.253.45.214](https://vuldb.com/?ip.8.253.45.214) | - | - | High
|
||||
44 | [8.253.131.121](https://vuldb.com/?ip.8.253.131.121) | - | - | High
|
||||
45 | [12.6.148.4](https://vuldb.com/?ip.12.6.148.4) | mail.carters.com | - | High
|
||||
46 | [12.6.183.21](https://vuldb.com/?ip.12.6.183.21) | - | - | High
|
||||
47 | [12.32.68.154](https://vuldb.com/?ip.12.32.68.154) | mail.sealscoinc.com | - | High
|
||||
48 | [12.149.72.170](https://vuldb.com/?ip.12.149.72.170) | - | - | High
|
||||
49 | [12.162.84.2](https://vuldb.com/?ip.12.162.84.2) | - | - | High
|
||||
50 | [12.163.208.58](https://vuldb.com/?ip.12.163.208.58) | - | - | High
|
||||
51 | [12.182.146.226](https://vuldb.com/?ip.12.182.146.226) | - | - | High
|
||||
52 | [12.184.217.101](https://vuldb.com/?ip.12.184.217.101) | - | - | High
|
||||
53 | [12.222.134.10](https://vuldb.com/?ip.12.222.134.10) | - | - | High
|
||||
54 | [12.238.114.130](https://vuldb.com/?ip.12.238.114.130) | - | - | High
|
||||
55 | [13.107.21.200](https://vuldb.com/?ip.13.107.21.200) | - | - | High
|
||||
56 | [14.49.39.215](https://vuldb.com/?ip.14.49.39.215) | - | - | High
|
||||
57 | [17.36.205.74](https://vuldb.com/?ip.17.36.205.74) | - | - | High
|
||||
58 | [17.56.136.171](https://vuldb.com/?ip.17.56.136.171) | p74-smtp.mail.icloud.com | - | High
|
||||
59 | [18.209.113.128](https://vuldb.com/?ip.18.209.113.128) | ec2-18-209-113-128.compute-1.amazonaws.com | - | Medium
|
||||
60 | [18.211.9.206](https://vuldb.com/?ip.18.211.9.206) | ec2-18-211-9-206.compute-1.amazonaws.com | - | Medium
|
||||
61 | [18.217.99.164](https://vuldb.com/?ip.18.217.99.164) | ec2-18-217-99-164.us-east-2.compute.amazonaws.com | - | Medium
|
||||
62 | [23.3.13.88](https://vuldb.com/?ip.23.3.13.88) | a23-3-13-88.deploy.static.akamaitechnologies.com | - | High
|
||||
63 | [23.3.13.146](https://vuldb.com/?ip.23.3.13.146) | a23-3-13-146.deploy.static.akamaitechnologies.com | - | High
|
||||
64 | [23.3.13.153](https://vuldb.com/?ip.23.3.13.153) | a23-3-13-153.deploy.static.akamaitechnologies.com | - | High
|
||||
65 | [23.3.13.154](https://vuldb.com/?ip.23.3.13.154) | a23-3-13-154.deploy.static.akamaitechnologies.com | - | High
|
||||
66 | [23.5.231.225](https://vuldb.com/?ip.23.5.231.225) | a23-5-231-225.deploy.static.akamaitechnologies.com | - | High
|
||||
67 | [23.6.65.194](https://vuldb.com/?ip.23.6.65.194) | a23-6-65-194.deploy.static.akamaitechnologies.com | - | High
|
||||
68 | [23.6.69.99](https://vuldb.com/?ip.23.6.69.99) | a23-6-69-99.deploy.static.akamaitechnologies.com | - | High
|
||||
69 | [23.36.85.183](https://vuldb.com/?ip.23.36.85.183) | a23-36-85-183.deploy.static.akamaitechnologies.com | - | High
|
||||
70 | [23.41.248.194](https://vuldb.com/?ip.23.41.248.194) | a23-41-248-194.deploy.static.akamaitechnologies.com | - | High
|
||||
71 | [23.46.53.71](https://vuldb.com/?ip.23.46.53.71) | a23-46-53-71.deploy.static.akamaitechnologies.com | - | High
|
||||
72 | [23.46.238.193](https://vuldb.com/?ip.23.46.238.193) | a23-46-238-193.deploy.static.akamaitechnologies.com | - | High
|
||||
73 | [23.46.238.194](https://vuldb.com/?ip.23.46.238.194) | a23-46-238-194.deploy.static.akamaitechnologies.com | - | High
|
||||
74 | [23.46.238.232](https://vuldb.com/?ip.23.46.238.232) | a23-46-238-232.deploy.static.akamaitechnologies.com | - | High
|
||||
75 | [23.52.7.20](https://vuldb.com/?ip.23.52.7.20) | a23-52-7-20.deploy.static.akamaitechnologies.com | - | High
|
||||
76 | [23.67.200.172](https://vuldb.com/?ip.23.67.200.172) | a23-67-200-172.deploy.static.akamaitechnologies.com | - | High
|
||||
77 | [23.67.202.10](https://vuldb.com/?ip.23.67.202.10) | a23-67-202-10.deploy.static.akamaitechnologies.com | - | High
|
||||
78 | [23.95.95.18](https://vuldb.com/?ip.23.95.95.18) | 23-95-95-18-host.colocrossing.com | - | High
|
||||
79 | [23.111.156.118](https://vuldb.com/?ip.23.111.156.118) | 23-111-156-118.static.hvvc.us | - | High
|
||||
80 | [23.197.19.180](https://vuldb.com/?ip.23.197.19.180) | a23-197-19-180.deploy.static.akamaitechnologies.com | - | High
|
||||
81 | [23.199.63.11](https://vuldb.com/?ip.23.199.63.11) | a23-199-63-11.deploy.static.akamaitechnologies.com | - | High
|
||||
82 | [23.199.71.185](https://vuldb.com/?ip.23.199.71.185) | a23-199-71-185.deploy.static.akamaitechnologies.com | - | High
|
||||
83 | [23.218.127.164](https://vuldb.com/?ip.23.218.127.164) | a23-218-127-164.deploy.static.akamaitechnologies.com | - | High
|
||||
84 | [23.218.141.31](https://vuldb.com/?ip.23.218.141.31) | a23-218-141-31.deploy.static.akamaitechnologies.com | - | High
|
||||
85 | [23.221.50.122](https://vuldb.com/?ip.23.221.50.122) | a23-221-50-122.deploy.static.akamaitechnologies.com | - | High
|
||||
86 | [23.227.38.64](https://vuldb.com/?ip.23.227.38.64) | shops.myshopify.com | - | High
|
||||
87 | [23.229.115.217](https://vuldb.com/?ip.23.229.115.217) | - | - | High
|
||||
88 | [23.229.190.0](https://vuldb.com/?ip.23.229.190.0) | ip-23-229-190-0.ip.secureserver.net | - | High
|
||||
89 | [23.239.0.12](https://vuldb.com/?ip.23.239.0.12) | li680-12.members.linode.com | - | High
|
||||
90 | [23.239.2.11](https://vuldb.com/?ip.23.239.2.11) | li683-11.members.linode.com | - | High
|
||||
91 | [23.246.204.126](https://vuldb.com/?ip.23.246.204.126) | 7e.cc.f617.ip4.static.sl-reverse.com | - | High
|
||||
92 | [23.254.203.51](https://vuldb.com/?ip.23.254.203.51) | hwsrv-779084.hostwindsdns.com | - | High
|
||||
93 | [24.40.239.62](https://vuldb.com/?ip.24.40.239.62) | 24-40-239-62.fidnet.com | - | High
|
||||
94 | [24.43.99.75](https://vuldb.com/?ip.24.43.99.75) | rrcs-24-43-99-75.west.biz.rr.com | - | High
|
||||
95 | [24.101.229.82](https://vuldb.com/?ip.24.101.229.82) | dynamic-acs-24-101-229-82.zoominternet.net | - | High
|
||||
96 | [24.116.40.208](https://vuldb.com/?ip.24.116.40.208) | 24-116-40-208.cpe.sparklight.net | - | High
|
||||
97 | [24.119.116.230](https://vuldb.com/?ip.24.119.116.230) | 24-119-116-230.cpe.sparklight.net | - | High
|
||||
98 | [24.121.176.48](https://vuldb.com/?ip.24.121.176.48) | 24-121-176-48.prkrcmtc01.com.sta.suddenlink.net | - | High
|
||||
99 | [24.137.76.62](https://vuldb.com/?ip.24.137.76.62) | host-24-137-76-62.public.eastlink.ca | - | High
|
||||
100 | [24.178.90.49](https://vuldb.com/?ip.24.178.90.49) | 024-178-090-049.res.spectrum.com | - | High
|
||||
101 | [24.179.13.119](https://vuldb.com/?ip.24.179.13.119) | 024-179-013-119.res.spectrum.com | - | High
|
||||
102 | [24.190.11.79](https://vuldb.com/?ip.24.190.11.79) | ool-18be0b4f.dyn.optonline.net | - | High
|
||||
103 | [24.201.79.34](https://vuldb.com/?ip.24.201.79.34) | modemcable034.79-201-24.mc.videotron.ca | - | High
|
||||
104 | [24.203.4.40](https://vuldb.com/?ip.24.203.4.40) | modemcable040.4-203-24.mc.videotron.ca | - | High
|
||||
105 | [24.217.117.217](https://vuldb.com/?ip.24.217.117.217) | 024-217-117-217.res.spectrum.com | - | High
|
||||
106 | [24.232.0.227](https://vuldb.com/?ip.24.232.0.227) | smtp.fibertel.com.ar | - | High
|
||||
107 | [24.232.228.233](https://vuldb.com/?ip.24.232.228.233) | OL233-228.fibertel.com.ar | - | High
|
||||
108 | [24.244.177.40](https://vuldb.com/?ip.24.244.177.40) | - | - | High
|
||||
109 | [27.50.89.209](https://vuldb.com/?ip.27.50.89.209) | 27-50-89-209.as45671.net | - | High
|
||||
110 | [27.54.89.58](https://vuldb.com/?ip.27.54.89.58) | vm-1m-r44.ipv4.per01.ds.network | - | High
|
||||
111 | [27.78.27.110](https://vuldb.com/?ip.27.78.27.110) | localhost | - | High
|
||||
112 | [27.82.13.10](https://vuldb.com/?ip.27.82.13.10) | KD027082013010.ppp-bb.dion.ne.jp | - | High
|
||||
113 | [27.109.24.214](https://vuldb.com/?ip.27.109.24.214) | - | - | High
|
||||
114 | [27.114.9.93](https://vuldb.com/?ip.27.114.9.93) | i27-114-9-93.s41.a011.ap.plala.or.jp | - | High
|
||||
115 | [27.254.81.87](https://vuldb.com/?ip.27.254.81.87) | cloud-linux09.thaidata.net | - | High
|
||||
116 | [31.3.135.232](https://vuldb.com/?ip.31.3.135.232) | mirror.tillo.ch | - | High
|
||||
117 | [31.22.4.160](https://vuldb.com/?ip.31.22.4.160) | sv.comparelight.com | - | High
|
||||
118 | [31.24.158.56](https://vuldb.com/?ip.31.24.158.56) | bm.servidoresdedicados.com | - | High
|
||||
119 | [31.167.248.50](https://vuldb.com/?ip.31.167.248.50) | - | - | High
|
||||
120 | [31.172.86.183](https://vuldb.com/?ip.31.172.86.183) | - | - | High
|
||||
121 | [31.207.89.74](https://vuldb.com/?ip.31.207.89.74) | - | - | High
|
||||
122 | [34.80.191.247](https://vuldb.com/?ip.34.80.191.247) | 247.191.80.34.bc.googleusercontent.com | - | Medium
|
||||
123 | [34.117.59.81](https://vuldb.com/?ip.34.117.59.81) | 81.59.117.34.bc.googleusercontent.com | - | Medium
|
||||
124 | [34.192.19.33](https://vuldb.com/?ip.34.192.19.33) | ec2-34-192-19-33.compute-1.amazonaws.com | - | Medium
|
||||
125 | [35.184.245.68](https://vuldb.com/?ip.35.184.245.68) | 68.245.184.35.bc.googleusercontent.com | - | Medium
|
||||
126 | [35.190.87.116](https://vuldb.com/?ip.35.190.87.116) | 116.87.190.35.bc.googleusercontent.com | - | Medium
|
||||
127 | [35.203.98.50](https://vuldb.com/?ip.35.203.98.50) | 50.98.203.35.bc.googleusercontent.com | - | Medium
|
||||
128 | [35.213.151.141](https://vuldb.com/?ip.35.213.151.141) | 141.151.213.35.bc.googleusercontent.com | - | Medium
|
||||
129 | [35.214.151.75](https://vuldb.com/?ip.35.214.151.75) | 75.151.214.35.bc.googleusercontent.com | - | Medium
|
||||
130 | [36.67.23.59](https://vuldb.com/?ip.36.67.23.59) | - | - | High
|
||||
131 | [36.91.44.183](https://vuldb.com/?ip.36.91.44.183) | - | - | High
|
||||
132 | [37.9.175.14](https://vuldb.com/?ip.37.9.175.14) | 14.175.9.37.in-addr.arpa.websupport.sk | - | High
|
||||
133 | [37.44.244.177](https://vuldb.com/?ip.37.44.244.177) | - | - | High
|
||||
134 | [37.46.129.215](https://vuldb.com/?ip.37.46.129.215) | we-too.ru | - | High
|
||||
135 | [37.59.209.141](https://vuldb.com/?ip.37.59.209.141) | - | - | High
|
||||
136 | [37.97.135.82](https://vuldb.com/?ip.37.97.135.82) | 37-97-135-82.colo.transip.net | - | High
|
||||
137 | [37.120.175.15](https://vuldb.com/?ip.37.120.175.15) | v220220112692175454.nicesrv.de | - | High
|
||||
138 | [37.139.21.175](https://vuldb.com/?ip.37.139.21.175) | 37.139.21.175-e2-8080-keep-up | - | High
|
||||
139 | [37.179.204.33](https://vuldb.com/?ip.37.179.204.33) | - | - | High
|
||||
140 | [37.187.4.178](https://vuldb.com/?ip.37.187.4.178) | ks2.kku.io | - | High
|
||||
141 | [37.187.5.82](https://vuldb.com/?ip.37.187.5.82) | ks3370412.kimsufi.com | - | High
|
||||
142 | [37.187.56.166](https://vuldb.com/?ip.37.187.56.166) | - | - | High
|
||||
143 | [37.187.57.57](https://vuldb.com/?ip.37.187.57.57) | ns3357940.ovh.net | - | High
|
||||
144 | [37.187.72.193](https://vuldb.com/?ip.37.187.72.193) | ns3362285.ip-37-187-72.eu | - | High
|
||||
145 | [37.187.115.122](https://vuldb.com/?ip.37.187.115.122) | ns328855.ip-37-187-115.eu | - | High
|
||||
146 | [37.187.161.206](https://vuldb.com/?ip.37.187.161.206) | toolbox.alabs.io | - | High
|
||||
147 | [37.205.9.252](https://vuldb.com/?ip.37.205.9.252) | s1.ithelp24.eu | - | High
|
||||
148 | [37.221.70.250](https://vuldb.com/?ip.37.221.70.250) | b2b-customer.inftele.net | - | High
|
||||
149 | [37.228.137.204](https://vuldb.com/?ip.37.228.137.204) | wiki.lmap.ir | - | High
|
||||
150 | [37.247.101.241](https://vuldb.com/?ip.37.247.101.241) | server241.turkwebdizayn.com | - | High
|
||||
151 | [40.97.124.18](https://vuldb.com/?ip.40.97.124.18) | - | - | High
|
||||
152 | [41.73.252.195](https://vuldb.com/?ip.41.73.252.195) | - | - | High
|
||||
153 | [41.76.108.46](https://vuldb.com/?ip.41.76.108.46) | - | - | High
|
||||
154 | [41.169.20.147](https://vuldb.com/?ip.41.169.20.147) | - | - | High
|
||||
155 | [41.169.36.237](https://vuldb.com/?ip.41.169.36.237) | - | - | High
|
||||
156 | [41.185.28.84](https://vuldb.com/?ip.41.185.28.84) | brf01-nix01.wadns.net | - | High
|
||||
157 | [41.185.29.128](https://vuldb.com/?ip.41.185.29.128) | abp79-nix01.wadns.net | - | High
|
||||
158 | [41.190.32.8](https://vuldb.com/?ip.41.190.32.8) | smtp11.utande.co.zw | - | High
|
||||
159 | [41.203.62.170](https://vuldb.com/?ip.41.203.62.170) | - | - | High
|
||||
160 | [41.204.202.41](https://vuldb.com/?ip.41.204.202.41) | www41.cpt2.host-h.net | - | High
|
||||
161 | [41.231.225.139](https://vuldb.com/?ip.41.231.225.139) | - | - | High
|
||||
162 | [42.62.40.103](https://vuldb.com/?ip.42.62.40.103) | - | - | High
|
||||
163 | [43.229.62.186](https://vuldb.com/?ip.43.229.62.186) | rocket-cheese.bnr.la | - | High
|
||||
164 | [45.16.226.117](https://vuldb.com/?ip.45.16.226.117) | 45-16-226-117.lightspeed.sndgca.sbcglobal.net | - | High
|
||||
165 | [45.33.35.103](https://vuldb.com/?ip.45.33.35.103) | li985-103.members.linode.com | - | High
|
||||
166 | [45.33.54.74](https://vuldb.com/?ip.45.33.54.74) | li1004-74.members.linode.com | - | High
|
||||
167 | [45.33.77.42](https://vuldb.com/?ip.45.33.77.42) | li1023-42.members.linode.com | - | High
|
||||
168 | [45.46.37.97](https://vuldb.com/?ip.45.46.37.97) | cpe-45-46-37-97.maine.res.rr.com | - | High
|
||||
169 | [45.55.36.51](https://vuldb.com/?ip.45.55.36.51) | - | - | High
|
||||
170 | [45.55.82.2](https://vuldb.com/?ip.45.55.82.2) | - | - | High
|
||||
171 | [45.55.179.121](https://vuldb.com/?ip.45.55.179.121) | - | - | High
|
||||
172 | [45.55.191.130](https://vuldb.com/?ip.45.55.191.130) | - | - | High
|
||||
173 | [45.55.219.163](https://vuldb.com/?ip.45.55.219.163) | - | - | High
|
||||
174 | [45.56.88.91](https://vuldb.com/?ip.45.56.88.91) | 45-56-88-91.ip.linodeusercontent.com | - | High
|
||||
175 | [45.56.127.75](https://vuldb.com/?ip.45.56.127.75) | li945-75.members.linode.com | - | High
|
||||
176 | [45.59.204.133](https://vuldb.com/?ip.45.59.204.133) | rrcs-45-59-204-133.west.biz.rr.com | - | High
|
||||
177 | [45.71.195.104](https://vuldb.com/?ip.45.71.195.104) | - | - | High
|
||||
178 | [45.76.1.145](https://vuldb.com/?ip.45.76.1.145) | 45.76.1.145.vultrusercontent.com | - | High
|
||||
179 | [45.76.159.214](https://vuldb.com/?ip.45.76.159.214) | 45.76.159.214.vultrusercontent.com | - | High
|
||||
180 | [45.76.176.10](https://vuldb.com/?ip.45.76.176.10) | 45.76.176.10.vultrusercontent.com | - | High
|
||||
181 | [45.76.181.158](https://vuldb.com/?ip.45.76.181.158) | 45.76.181.158.vultrusercontent.com | - | High
|
||||
182 | [45.77.154.161](https://vuldb.com/?ip.45.77.154.161) | 45.77.154.161.vultrusercontent.com | - | High
|
||||
183 | [45.79.95.107](https://vuldb.com/?ip.45.79.95.107) | li1194-107.members.linode.com | - | High
|
||||
184 | [45.79.173.200](https://vuldb.com/?ip.45.79.173.200) | 45-79-173-200.ip.linodeusercontent.com | - | High
|
||||
185 | [45.79.188.67](https://vuldb.com/?ip.45.79.188.67) | li1287-67.members.linode.com | - | High
|
||||
186 | [45.80.148.200](https://vuldb.com/?ip.45.80.148.200) | - | - | High
|
||||
187 | [45.118.115.99](https://vuldb.com/?ip.45.118.115.99) | - | - | High
|
||||
188 | [45.118.135.203](https://vuldb.com/?ip.45.118.135.203) | 45-118-135-203.ip.linodeusercontent.com | - | High
|
||||
189 | [45.118.136.92](https://vuldb.com/?ip.45.118.136.92) | - | - | High
|
||||
190 | [45.119.83.237](https://vuldb.com/?ip.45.119.83.237) | - | - | High
|
||||
191 | [45.138.98.34](https://vuldb.com/?ip.45.138.98.34) | xtream | - | High
|
||||
192 | [45.142.114.231](https://vuldb.com/?ip.45.142.114.231) | mail.dounutmail.de | - | High
|
||||
193 | [45.176.232.124](https://vuldb.com/?ip.45.176.232.124) | - | - | High
|
||||
194 | [45.176.232.125](https://vuldb.com/?ip.45.176.232.125) | - | - | High
|
||||
195 | [45.186.16.18](https://vuldb.com/?ip.45.186.16.18) | 45-186-16-18.winnet.com.br | - | High
|
||||
196 | [45.230.45.171](https://vuldb.com/?ip.45.230.45.171) | - | - | High
|
||||
197 | [45.235.8.30](https://vuldb.com/?ip.45.235.8.30) | - | - | High
|
||||
198 | [45.252.251.10](https://vuldb.com/?ip.45.252.251.10) | - | - | High
|
||||
199 | [46.4.100.178](https://vuldb.com/?ip.46.4.100.178) | support.wizard-shopservice.de | - | High
|
||||
200 | [46.4.192.185](https://vuldb.com/?ip.46.4.192.185) | static.185.192.4.46.clients.your-server.de | - | High
|
||||
201 | [46.28.111.142](https://vuldb.com/?ip.46.28.111.142) | enkindu.jsuchy.net | - | High
|
||||
202 | [46.30.213.132](https://vuldb.com/?ip.46.30.213.132) | - | - | High
|
||||
203 | [46.32.229.152](https://vuldb.com/?ip.46.32.229.152) | 094882.vps-10.com | - | High
|
||||
204 | [46.32.233.226](https://vuldb.com/?ip.46.32.233.226) | yetitoolusa.com | - | High
|
||||
205 | [46.38.238.8](https://vuldb.com/?ip.46.38.238.8) | v2202109122001163131.happysrv.de | - | High
|
||||
206 | [46.43.2.95](https://vuldb.com/?ip.46.43.2.95) | chris.default.cjenkinson.uk0.bigv.io | - | High
|
||||
207 | [46.49.124.53](https://vuldb.com/?ip.46.49.124.53) | - | - | High
|
||||
208 | [46.55.222.11](https://vuldb.com/?ip.46.55.222.11) | - | - | High
|
||||
209 | [46.101.58.37](https://vuldb.com/?ip.46.101.58.37) | 46.101.58.37-e1-8080 | - | High
|
||||
210 | [46.105.81.76](https://vuldb.com/?ip.46.105.81.76) | myu0.cylipo.sbs | - | High
|
||||
211 | [46.105.114.137](https://vuldb.com/?ip.46.105.114.137) | ns3188253.ip-46-105-114.eu | - | High
|
||||
212 | [46.105.131.68](https://vuldb.com/?ip.46.105.131.68) | http.adven.fr | - | High
|
||||
213 | [46.105.131.69](https://vuldb.com/?ip.46.105.131.69) | epouventaille.adven.fr | - | High
|
||||
214 | [46.105.131.79](https://vuldb.com/?ip.46.105.131.79) | relay.adven.fr | - | High
|
||||
215 | [46.105.131.87](https://vuldb.com/?ip.46.105.131.87) | pop.adven.fr | - | High
|
||||
216 | [46.105.236.18](https://vuldb.com/?ip.46.105.236.18) | - | - | High
|
||||
217 | [46.165.212.76](https://vuldb.com/?ip.46.165.212.76) | - | - | High
|
||||
218 | [46.165.254.206](https://vuldb.com/?ip.46.165.254.206) | - | - | High
|
||||
219 | [46.214.107.142](https://vuldb.com/?ip.46.214.107.142) | 46-214-107-142.next-gen.ro | - | High
|
||||
220 | [47.36.140.164](https://vuldb.com/?ip.47.36.140.164) | 047-036-140-164.res.spectrum.com | - | High
|
||||
221 | [47.52.19.221](https://vuldb.com/?ip.47.52.19.221) | - | - | High
|
||||
222 | [47.146.32.175](https://vuldb.com/?ip.47.146.32.175) | - | - | High
|
||||
223 | [47.146.39.147](https://vuldb.com/?ip.47.146.39.147) | - | - | High
|
||||
224 | [47.150.11.161](https://vuldb.com/?ip.47.150.11.161) | - | - | High
|
||||
225 | [47.188.131.94](https://vuldb.com/?ip.47.188.131.94) | - | - | High
|
||||
226 | [47.201.208.154](https://vuldb.com/?ip.47.201.208.154) | - | - | High
|
||||
227 | [47.246.24.225](https://vuldb.com/?ip.47.246.24.225) | - | - | High
|
||||
228 | [47.246.24.226](https://vuldb.com/?ip.47.246.24.226) | - | - | High
|
||||
229 | [47.246.24.230](https://vuldb.com/?ip.47.246.24.230) | - | - | High
|
||||
230 | [47.246.24.232](https://vuldb.com/?ip.47.246.24.232) | - | - | High
|
||||
231 | [49.12.121.47](https://vuldb.com/?ip.49.12.121.47) | filezilla-project.org | - | High
|
||||
232 | [49.50.209.131](https://vuldb.com/?ip.49.50.209.131) | 131.host-49-50-209.euba.megatel.co.nz | - | High
|
||||
233 | [49.212.135.76](https://vuldb.com/?ip.49.212.135.76) | os3-321-50322.vs.sakura.ne.jp | - | High
|
||||
234 | [49.212.155.94](https://vuldb.com/?ip.49.212.155.94) | os3-325-52340.vs.sakura.ne.jp | - | High
|
||||
235 | [50.22.35.194](https://vuldb.com/?ip.50.22.35.194) | c2.23.1632.ip4.static.sl-reverse.com | - | High
|
||||
236 | [50.23.248.182](https://vuldb.com/?ip.50.23.248.182) | b6.f8.1732.ip4.static.sl-reverse.com | - | High
|
||||
237 | [50.28.51.143](https://vuldb.com/?ip.50.28.51.143) | - | - | High
|
||||
238 | [50.30.40.196](https://vuldb.com/?ip.50.30.40.196) | usve255301.serverprofi24.com | - | High
|
||||
239 | [50.31.146.101](https://vuldb.com/?ip.50.31.146.101) | mail.brillinjurylaw.com | - | High
|
||||
240 | [50.31.174.165](https://vuldb.com/?ip.50.31.174.165) | priva28.privatednsorg.com | - | High
|
||||
241 | [50.56.135.44](https://vuldb.com/?ip.50.56.135.44) | - | - | High
|
||||
242 | [50.62.176.42](https://vuldb.com/?ip.50.62.176.42) | p3plcpnl0515.prod.phx3.secureserver.net | - | High
|
||||
243 | [50.62.176.244](https://vuldb.com/?ip.50.62.176.244) | p3plcpnl0728.prod.phx3.secureserver.net | - | High
|
||||
244 | [50.62.194.30](https://vuldb.com/?ip.50.62.194.30) | ip-50-62-194-30.ip.secureserver.net | - | High
|
||||
245 | [50.63.8.21](https://vuldb.com/?ip.50.63.8.21) | ip-50-63-8-21.ip.secureserver.net | - | High
|
||||
246 | [50.78.167.65](https://vuldb.com/?ip.50.78.167.65) | millcreek.cc | - | High
|
||||
247 | [50.87.59.65](https://vuldb.com/?ip.50.87.59.65) | 50-87-59-65.unifiedlayer.com | - | High
|
||||
248 | [50.87.144.137](https://vuldb.com/?ip.50.87.144.137) | gator3103.hostgator.com | - | High
|
||||
249 | [50.87.144.197](https://vuldb.com/?ip.50.87.144.197) | gator3161.hostgator.com | - | High
|
||||
250 | [50.87.150.177](https://vuldb.com/?ip.50.87.150.177) | 50-87-150-177.unifiedlayer.com | - | High
|
||||
251 | [50.91.114.38](https://vuldb.com/?ip.50.91.114.38) | 050-091-114-038.res.spectrum.com | - | High
|
||||
252 | [50.92.101.60](https://vuldb.com/?ip.50.92.101.60) | d50-92-101-60.bchsia.telus.net | - | High
|
||||
253 | [50.116.54.215](https://vuldb.com/?ip.50.116.54.215) | li440-215.members.linode.com | - | High
|
||||
254 | [50.116.78.109](https://vuldb.com/?ip.50.116.78.109) | intersearchmedia.com | - | High
|
||||
255 | [50.116.86.205](https://vuldb.com/?ip.50.116.86.205) | template3.domain.com | - | High
|
||||
256 | [50.121.220.50](https://vuldb.com/?ip.50.121.220.50) | static-50-121-220-50.clbg.wv.frontiernet.net | - | High
|
||||
257 | [50.245.107.73](https://vuldb.com/?ip.50.245.107.73) | 50-245-107-73-static.hfc.comcastbusiness.net | - | High
|
||||
258 | [51.15.4.22](https://vuldb.com/?ip.51.15.4.22) | 51-15-4-22.rev.poneytelecom.eu | - | High
|
||||
259 | [51.15.7.145](https://vuldb.com/?ip.51.15.7.145) | 51-15-7-145.rev.poneytelecom.eu | - | High
|
||||
260 | [51.38.71.0](https://vuldb.com/?ip.51.38.71.0) | 0.ip-51-38-71.eu | - | High
|
||||
261 | [51.38.124.206](https://vuldb.com/?ip.51.38.124.206) | 206.ip-51-38-124.eu | - | High
|
||||
262 | [51.38.201.19](https://vuldb.com/?ip.51.38.201.19) | ip19.ip-51-38-201.eu | - | High
|
||||
263 | [51.68.141.164](https://vuldb.com/?ip.51.68.141.164) | 164.ip-51-68-141.eu | - | High
|
||||
264 | [51.68.175.8](https://vuldb.com/?ip.51.68.175.8) | vps-9dba3732.vps.ovh.net | - | High
|
||||
265 | [51.68.220.244](https://vuldb.com/?ip.51.68.220.244) | vps-7a400d57.vps.ovh.net | - | High
|
||||
266 | [51.75.33.120](https://vuldb.com/?ip.51.75.33.120) | ip120.ip-51-75-33.eu | - | High
|
||||
267 | [51.75.33.127](https://vuldb.com/?ip.51.75.33.127) | ip127.ip-51-75-33.eu | - | High
|
||||
268 | [51.77.82.125](https://vuldb.com/?ip.51.77.82.125) | ip125.51-77-82.iproute.de | - | High
|
||||
269 | [51.77.113.100](https://vuldb.com/?ip.51.77.113.100) | titan40.fastworldwideweb.com | - | High
|
||||
270 | [51.89.36.180](https://vuldb.com/?ip.51.89.36.180) | ip180.ip-51-89-36.eu | - | High
|
||||
271 | [51.89.199.141](https://vuldb.com/?ip.51.89.199.141) | ip141.ip-51-89-199.eu | - | High
|
||||
272 | [51.91.7.5](https://vuldb.com/?ip.51.91.7.5) | ns3147667.ip-51-91-7.eu | - | High
|
||||
273 | [51.91.76.89](https://vuldb.com/?ip.51.91.76.89) | 89.ip-51-91-76.eu | - | High
|
||||
274 | [51.159.23.217](https://vuldb.com/?ip.51.159.23.217) | jambold.co.uk | - | High
|
||||
275 | [51.159.35.157](https://vuldb.com/?ip.51.159.35.157) | 51-159-35-157.rev.poneytelecom.eu | - | High
|
||||
276 | [51.161.73.194](https://vuldb.com/?ip.51.161.73.194) | ip194.ip-51-161-73.net | - | High
|
||||
277 | [51.210.242.234](https://vuldb.com/?ip.51.210.242.234) | vps-36767060.vps.ovh.net | - | High
|
||||
278 | [51.254.137.156](https://vuldb.com/?ip.51.254.137.156) | mail.unolan.net | - | High
|
||||
279 | [51.254.140.238](https://vuldb.com/?ip.51.254.140.238) | 238.ip-51-254-140.eu | - | High
|
||||
280 | [51.255.50.164](https://vuldb.com/?ip.51.255.50.164) | vps-b6cfe010.vps.ovh.net | - | High
|
||||
281 | [51.255.165.160](https://vuldb.com/?ip.51.255.165.160) | 160.ip-51-255-165.eu | - | High
|
||||
282 | [52.31.99.185](https://vuldb.com/?ip.52.31.99.185) | ec2-52-31-99-185.eu-west-1.compute.amazonaws.com | - | Medium
|
||||
283 | [52.66.202.63](https://vuldb.com/?ip.52.66.202.63) | ec2-52-66-202-63.ap-south-1.compute.amazonaws.com | - | Medium
|
||||
284 | [52.96.38.82](https://vuldb.com/?ip.52.96.38.82) | - | - | High
|
||||
285 | [52.96.40.242](https://vuldb.com/?ip.52.96.40.242) | - | - | High
|
||||
286 | [52.96.62.226](https://vuldb.com/?ip.52.96.62.226) | - | - | High
|
||||
287 | [54.36.185.60](https://vuldb.com/?ip.54.36.185.60) | ip60.ip-54-36-185.eu | - | High
|
||||
288 | [54.37.106.167](https://vuldb.com/?ip.54.37.106.167) | ip167.ip-54-37-106.eu | - | High
|
||||
289 | [54.37.228.122](https://vuldb.com/?ip.54.37.228.122) | 122.ip-54-37-228.eu | - | High
|
||||
290 | [54.38.94.197](https://vuldb.com/?ip.54.38.94.197) | ns3140984.ip-54-38-94.eu | - | High
|
||||
291 | [54.38.143.245](https://vuldb.com/?ip.54.38.143.245) | tools.inovato.me | - | High
|
||||
292 | [54.38.143.246](https://vuldb.com/?ip.54.38.143.246) | ip246.ip-54-38-143.eu | - | High
|
||||
293 | [54.38.242.185](https://vuldb.com/?ip.54.38.242.185) | vps-f3507bbf.vps.ovh.net | - | High
|
||||
294 | [54.88.144.211](https://vuldb.com/?ip.54.88.144.211) | va-smtp01.263.net | - | High
|
||||
295 | [58.27.215.3](https://vuldb.com/?ip.58.27.215.3) | 58-27-215-3.wateen.net | - | High
|
||||
296 | [58.94.58.13](https://vuldb.com/?ip.58.94.58.13) | i58-94-58-13.s41.a014.ap.plala.or.jp | - | High
|
||||
297 | [58.96.74.42](https://vuldb.com/?ip.58.96.74.42) | 42.74.96.58.static.exetel.com.au | - | High
|
||||
298 | [58.171.38.26](https://vuldb.com/?ip.58.171.38.26) | - | - | High
|
||||
299 | [58.216.16.130](https://vuldb.com/?ip.58.216.16.130) | - | - | High
|
||||
300 | [58.227.42.236](https://vuldb.com/?ip.58.227.42.236) | - | - | High
|
||||
301 | [59.110.18.236](https://vuldb.com/?ip.59.110.18.236) | - | - | High
|
||||
302 | [59.120.5.154](https://vuldb.com/?ip.59.120.5.154) | 59-120-5-154.hinet-ip.hinet.net | - | High
|
||||
303 | [59.124.1.19](https://vuldb.com/?ip.59.124.1.19) | 59-124-1-19.hinet-ip.hinet.net | - | High
|
||||
304 | [59.148.253.194](https://vuldb.com/?ip.59.148.253.194) | 059148253194.ctinets.com | - | High
|
||||
305 | [59.152.93.46](https://vuldb.com/?ip.59.152.93.46) | 46.93.152.59.zipnetltd.com | - | High
|
||||
306 | [60.36.166.212](https://vuldb.com/?ip.60.36.166.212) | imail.mail.plala.or.jp | - | High
|
||||
307 | [60.93.23.51](https://vuldb.com/?ip.60.93.23.51) | softbank060093023051.bbtec.net | - | High
|
||||
308 | [60.108.128.186](https://vuldb.com/?ip.60.108.128.186) | softbank060108128186.bbtec.net | - | High
|
||||
309 | [60.125.114.64](https://vuldb.com/?ip.60.125.114.64) | softbank060125114064.bbtec.net | - | High
|
||||
310 | [60.249.78.226](https://vuldb.com/?ip.60.249.78.226) | 60-249-78-226.hinet-ip.hinet.net | - | High
|
||||
311 | [61.19.246.238](https://vuldb.com/?ip.61.19.246.238) | - | - | High
|
||||
312 | [61.197.37.169](https://vuldb.com/?ip.61.197.37.169) | pl937.ag1001.nttpc.ne.jp | - | High
|
||||
313 | [62.28.40.155](https://vuldb.com/?ip.62.28.40.155) | exchange.ptasp.com | - | High
|
||||
314 | [62.30.7.67](https://vuldb.com/?ip.62.30.7.67) | 67.7-30-62.static.virginmediabusiness.co.uk | - | High
|
||||
315 | [62.75.141.82](https://vuldb.com/?ip.62.75.141.82) | static-ip-62-75-141-82.inaddr.ip-pool.com | - | High
|
||||
316 | [62.84.75.50](https://vuldb.com/?ip.62.84.75.50) | mail.saadegrp.com.lb | - | High
|
||||
317 | [62.141.45.103](https://vuldb.com/?ip.62.141.45.103) | vps2009743.fastwebserver.de | - | High
|
||||
318 | [62.149.128.42](https://vuldb.com/?ip.62.149.128.42) | imaps.aruba.it | - | High
|
||||
319 | [62.149.128.72](https://vuldb.com/?ip.62.149.128.72) | mxd4.aruba.it | - | High
|
||||
320 | [62.149.128.179](https://vuldb.com/?ip.62.149.128.179) | pop3s.aruba.it | - | High
|
||||
321 | [62.149.128.200](https://vuldb.com/?ip.62.149.128.200) | smtp1.aruba.it | - | High
|
||||
322 | [62.149.128.210](https://vuldb.com/?ip.62.149.128.210) | smtpa1.aruba.it | - | High
|
||||
323 | [62.149.152.151](https://vuldb.com/?ip.62.149.152.151) | - | - | High
|
||||
324 | [62.149.152.152](https://vuldb.com/?ip.62.149.152.152) | - | - | High
|
||||
325 | [62.149.157.55](https://vuldb.com/?ip.62.149.157.55) | - | - | High
|
||||
326 | [62.171.142.179](https://vuldb.com/?ip.62.171.142.179) | vmi499457.contaboserver.net | - | High
|
||||
327 | [62.171.178.147](https://vuldb.com/?ip.62.171.178.147) | vmi365451.contaboserver.net | - | High
|
||||
328 | [62.210.127.136](https://vuldb.com/?ip.62.210.127.136) | 62-210-127-136.rev.poneytelecom.eu | - | High
|
||||
329 | [62.212.34.102](https://vuldb.com/?ip.62.212.34.102) | - | - | High
|
||||
330 | [62.234.99.30](https://vuldb.com/?ip.62.234.99.30) | - | - | High
|
||||
331 | [63.142.253.122](https://vuldb.com/?ip.63.142.253.122) | - | - | High
|
||||
332 | [64.4.244.68](https://vuldb.com/?ip.64.4.244.68) | - | - | High
|
||||
333 | [64.26.60.221](https://vuldb.com/?ip.64.26.60.221) | pop5.csee.onr.siteprotect.com | - | High
|
||||
334 | [64.41.126.110](https://vuldb.com/?ip.64.41.126.110) | securesmtp.csee.siteprotect.com | - | High
|
||||
335 | [64.59.136.142](https://vuldb.com/?ip.64.59.136.142) | mail.shaw.ca | - | High
|
||||
336 | [64.60.82.82](https://vuldb.com/?ip.64.60.82.82) | 64-60-82-82.static-ip.telepacific.net | - | High
|
||||
337 | [64.71.36.11](https://vuldb.com/?ip.64.71.36.11) | - | - | High
|
||||
338 | [64.85.73.16](https://vuldb.com/?ip.64.85.73.16) | - | - | High
|
||||
339 | [64.88.202.250](https://vuldb.com/?ip.64.88.202.250) | - | - | High
|
||||
340 | [64.90.62.162](https://vuldb.com/?ip.64.90.62.162) | pop.dreamhost.com | - | High
|
||||
341 | [64.91.228.45](https://vuldb.com/?ip.64.91.228.45) | - | - | High
|
||||
342 | [64.98.36.5](https://vuldb.com/?ip.64.98.36.5) | mail.b.hostedemail.com | - | High
|
||||
343 | [64.98.36.173](https://vuldb.com/?ip.64.98.36.173) | mail.lawyers-mail.com | - | High
|
||||
344 | [64.183.73.122](https://vuldb.com/?ip.64.183.73.122) | rrcs-64-183-73-122.west.biz.rr.com | - | High
|
||||
345 | [64.190.63.136](https://vuldb.com/?ip.64.190.63.136) | - | - | High
|
||||
346 | [64.207.182.168](https://vuldb.com/?ip.64.207.182.168) | - | - | High
|
||||
347 | [64.227.55.231](https://vuldb.com/?ip.64.227.55.231) | - | - | High
|
||||
348 | [64.227.100.222](https://vuldb.com/?ip.64.227.100.222) | - | - | High
|
||||
349 | [64.250.117.68](https://vuldb.com/?ip.64.250.117.68) | smtp.movistarcloud.com.ve | - | High
|
||||
350 | [65.49.60.163](https://vuldb.com/?ip.65.49.60.163) | 65-49-60-163.ip.linodeusercontent.com | - | High
|
||||
351 | [65.55.72.183](https://vuldb.com/?ip.65.55.72.183) | origin.sn134w.snt134.mail.live.com | - | High
|
||||
352 | [65.182.102.90](https://vuldb.com/?ip.65.182.102.90) | mail.geantes.com | - | High
|
||||
353 | [65.254.228.100](https://vuldb.com/?ip.65.254.228.100) | customer.hostcentric.com | - | High
|
||||
354 | [66.23.200.58](https://vuldb.com/?ip.66.23.200.58) | - | - | High
|
||||
355 | [66.42.55.5](https://vuldb.com/?ip.66.42.55.5) | 66.42.55.5.vultrusercontent.com | - | High
|
||||
356 | [66.42.57.149](https://vuldb.com/?ip.66.42.57.149) | 66.42.57.149.vultrusercontent.com | - | High
|
||||
357 | [66.50.57.73](https://vuldb.com/?ip.66.50.57.73) | 66-50-57-73.prtc.net | - | High
|
||||
358 | [66.54.51.172](https://vuldb.com/?ip.66.54.51.172) | - | - | High
|
||||
359 | [66.71.241.102](https://vuldb.com/?ip.66.71.241.102) | mail.nixhost.net | - | High
|
||||
360 | [66.76.26.33](https://vuldb.com/?ip.66.76.26.33) | 66-76-26-33.hdsncmta01.com.sta.suddenlink.net | - | High
|
||||
361 | [66.96.134.1](https://vuldb.com/?ip.66.96.134.1) | 1.134.96.66.static.eigbox.net | - | High
|
||||
362 | [66.96.147.103](https://vuldb.com/?ip.66.96.147.103) | 103.147.96.66.static.eigbox.net | - | High
|
||||
363 | [66.96.147.110](https://vuldb.com/?ip.66.96.147.110) | 110.147.96.66.static.eigbox.net | - | High
|
||||
364 | [66.195.202.115](https://vuldb.com/?ip.66.195.202.115) | mail.navarac.com | - | High
|
||||
365 | [66.209.69.165](https://vuldb.com/?ip.66.209.69.165) | - | - | High
|
||||
366 | [66.216.234.131](https://vuldb.com/?ip.66.216.234.131) | 066-216-234-131.res.spectrum.com | - | High
|
||||
367 | [66.220.110.56](https://vuldb.com/?ip.66.220.110.56) | h66-220-110-56.bendor.broadband.dynamic.tds.net | - | High
|
||||
368 | [66.228.32.31](https://vuldb.com/?ip.66.228.32.31) | li282-31.members.linode.com | - | High
|
||||
369 | [66.228.45.129](https://vuldb.com/?ip.66.228.45.129) | li326-129.members.linode.com | - | High
|
||||
370 | [66.228.61.248](https://vuldb.com/?ip.66.228.61.248) | li318-248.members.linode.com | - | High
|
||||
371 | [67.19.105.107](https://vuldb.com/?ip.67.19.105.107) | ns2.datatrust.com.br | - | High
|
||||
372 | [67.68.235.25](https://vuldb.com/?ip.67.68.235.25) | bas10-montrealak-67-68-235-25.dsl.bell.ca | - | High
|
||||
373 | [67.163.161.107](https://vuldb.com/?ip.67.163.161.107) | c-67-163-161-107.hsd1.pa.comcast.net | - | High
|
||||
374 | [67.170.250.203](https://vuldb.com/?ip.67.170.250.203) | c-67-170-250-203.hsd1.ca.comcast.net | - | High
|
||||
375 | [67.177.71.77](https://vuldb.com/?ip.67.177.71.77) | c-67-177-71-77.hsd1.al.comcast.net | - | High
|
||||
376 | [67.195.197.75](https://vuldb.com/?ip.67.195.197.75) | p9ats-i.geo.vip.bf1.yahoo.com | - | High
|
||||
377 | [67.195.228.95](https://vuldb.com/?ip.67.195.228.95) | unknown.yahoo.com | - | High
|
||||
378 | [67.212.168.237](https://vuldb.com/?ip.67.212.168.237) | 237.168.212.67.unassigned.ord.singlehop.net | - | High
|
||||
379 | [67.216.131.134](https://vuldb.com/?ip.67.216.131.134) | 134.131.216.67.134.static.hargray.net | - | High
|
||||
380 | [67.222.2.148](https://vuldb.com/?ip.67.222.2.148) | - | - | High
|
||||
381 | [67.225.218.50](https://vuldb.com/?ip.67.225.218.50) | lb01.parklogic.com | - | High
|
||||
382 | [67.225.221.173](https://vuldb.com/?ip.67.225.221.173) | host.hddpool2.net | - | High
|
||||
383 | [67.225.229.55](https://vuldb.com/?ip.67.225.229.55) | - | - | High
|
||||
384 | [67.241.81.253](https://vuldb.com/?ip.67.241.81.253) | cpe-67-241-81-253.twcny.res.rr.com | - | High
|
||||
385 | [68.2.97.91](https://vuldb.com/?ip.68.2.97.91) | ip68-2-97-91.ph.ph.cox.net | - | High
|
||||
386 | [68.44.137.144](https://vuldb.com/?ip.68.44.137.144) | c-68-44-137-144.hsd1.in.comcast.net | - | High
|
||||
387 | [68.66.194.12](https://vuldb.com/?ip.68.66.194.12) | 68.66.194.12.static.a2webhosting.com | - | High
|
||||
388 | [68.66.248.6](https://vuldb.com/?ip.68.66.248.6) | nl1-ls1.a2hosting.com | - | High
|
||||
389 | [68.178.213.203](https://vuldb.com/?ip.68.178.213.203) | p3plibsmtp03-v01.prod.phx3.secureserver.net | - | High
|
||||
390 | [68.183.62.61](https://vuldb.com/?ip.68.183.62.61) | - | - | High
|
||||
391 | [68.183.91.111](https://vuldb.com/?ip.68.183.91.111) | romeo.samplebox.in | - | High
|
||||
392 | [68.183.93.250](https://vuldb.com/?ip.68.183.93.250) | - | - | High
|
||||
393 | [68.183.170.114](https://vuldb.com/?ip.68.183.170.114) | 68.183.170.114-e1-8080-keep-up | - | High
|
||||
394 | [68.183.190.199](https://vuldb.com/?ip.68.183.190.199) | 68.183.190.199-e1-8080-keep-up | - | High
|
||||
395 | [69.16.218.101](https://vuldb.com/?ip.69.16.218.101) | - | - | High
|
||||
396 | [69.16.228.14](https://vuldb.com/?ip.69.16.228.14) | kurt.duplika.com | - | High
|
||||
397 | [69.16.254.127](https://vuldb.com/?ip.69.16.254.127) | cloudvpsserver.etelligens.in | - | High
|
||||
398 | [69.17.170.58](https://vuldb.com/?ip.69.17.170.58) | unallocated-static.rogers.com | - | High
|
||||
399 | [69.43.168.200](https://vuldb.com/?ip.69.43.168.200) | ns0.imunplugged.com | - | High
|
||||
400 | [69.43.168.232](https://vuldb.com/?ip.69.43.168.232) | - | - | High
|
||||
401 | [69.45.19.251](https://vuldb.com/?ip.69.45.19.251) | coastinet.com | - | High
|
||||
402 | [69.61.0.198](https://vuldb.com/?ip.69.61.0.198) | alpha01.serverparlor.net | - | High
|
||||
403 | [69.147.92.11](https://vuldb.com/?ip.69.147.92.11) | e1.ycpi.vip.dca.yahoo.com | - | High
|
||||
404 | [69.147.92.12](https://vuldb.com/?ip.69.147.92.12) | e2.ycpi.vip.dca.yahoo.com | - | High
|
||||
405 | [69.156.240.33](https://vuldb.com/?ip.69.156.240.33) | smtp.transportalliance.ca | - | High
|
||||
406 | [69.163.33.82](https://vuldb.com/?ip.69.163.33.82) | - | - | High
|
||||
407 | [69.167.152.111](https://vuldb.com/?ip.69.167.152.111) | - | - | High
|
||||
408 | [69.168.106.36](https://vuldb.com/?ip.69.168.106.36) | mail.windstream.syn-alias.com | - | High
|
||||
409 | [69.175.31.212](https://vuldb.com/?ip.69.175.31.212) | 212.31.175.69.unassigned.ord.singlehop.net | - | High
|
||||
410 | [69.197.160.180](https://vuldb.com/?ip.69.197.160.180) | vps180.unisonserver.com | - | High
|
||||
411 | ... | ... | ... | ...
|
||||
|
||||
There are 1498 more IOC items available. Please use our online service to access the data.
|
||||
There are 1640 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
|
@ -406,10 +441,10 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1006 | CWE-21, CWE-22 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294, CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 17 more TTP items available. Please use our online service to access the data.
|
||||
|
@ -420,21 +455,21 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/action/import_cert_file/` | High
|
||||
2 | File | `/action/import_https_cert_file/` | High
|
||||
3 | File | `/action/remove/` | High
|
||||
4 | File | `/admin/inquiries/view_details.php` | High
|
||||
5 | File | `/api/user/userData?userCode=admin` | High
|
||||
6 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
7 | File | `/ci_hms/search` | High
|
||||
8 | File | `/ci_ssms/index.php/orders/create` | High
|
||||
9 | File | `/classes/Master.php?f=delete_message` | High
|
||||
10 | File | `/classes/Master.php?f=delete_reservation` | High
|
||||
11 | File | `/classes/Master.php?f=delete_schedule` | High
|
||||
12 | File | `/classes/Master.php?f=delete_service` | High
|
||||
1 | File | `.python-version` | High
|
||||
2 | File | `/api/sys_username_passwd.cmd` | High
|
||||
3 | File | `/app/controller/Books.php` | High
|
||||
4 | File | `/app/options.py` | High
|
||||
5 | File | `/bin/posix/src/ports/POSIX/OpENer` | High
|
||||
6 | File | `/conf/` | Low
|
||||
7 | File | `/dashboard/menu-list.php` | High
|
||||
8 | File | `/dashboard/profile.php` | High
|
||||
9 | File | `/dashboard/table-list.php` | High
|
||||
10 | File | `/etc/lighttpd.d/ca.pem` | High
|
||||
11 | File | `/ffos/classes/Master.php?f=save_category` | High
|
||||
12 | File | `/home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf` | High
|
||||
13 | ... | ... | ...
|
||||
|
||||
There are 100 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 104 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
@ -530,8 +565,46 @@ The following list contains _external sources_ which discuss the actor and the a
|
|||
* https://community.blueliv.com/#!/s/5fb2ee2482df413eaf344b29
|
||||
* https://cyber.wtf/2021/11/15/guess-whos-back/
|
||||
* https://ddanchev.blogspot.com/2022/01/profiling-emotet-botnet-c.html
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-11-17%20Emotet%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-12-09%20Emotet%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-01-20%20Emotet%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-01-20%20Emotet_2%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-01-25%20Emotet%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-01-26%20%26%2027%20Emotet%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-02-02%20Emotet%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-02-07%20Emotet%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-02-08%20Emotet%20IOCs%20(AM)
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-02-22%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-02-23%20Emotet%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-02-28%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-01%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-14%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-15%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-16%20Emotet%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-28%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-29%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-04-01%20Emotet%20(E5)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-04-21%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-04-27%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-11%20Emotet%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-16%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-16%20Emotet%20(E5)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-17%20Emotet%20(E5)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-18%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-24%20Emotet%20(E5)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-06-03%20Emotet%20(E4)%20Additional%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-06-07%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-06-09%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-06-09%20Emotet%20(E5)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-06-14%20Emotet%20(E4)%20%232%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-06-15%20Emotet%20(E4)%20PM%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-06-21%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-06-28%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-06-30%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-07-05%20Emotet%20(E4)%20IOCs
|
||||
* https://github.com/pr0xylife/Emotet/blob/main/e4_emotet_05.02.2022.txt
|
||||
* https://github.com/pr0xylife/Emotet/blob/main/e4_emotet_24.03.2022.txt
|
||||
* https://isc.sans.edu/forums/diary/Emotet+infection+with+Cobalt+Strike/28824/
|
||||
* https://isc.sans.edu/forums/diary/Emotet+infection+with+IcedID+banking+Trojan/24312/
|
||||
* https://isc.sans.edu/forums/diary/Emotet+infections+and+followup+malware/24532/
|
||||
* https://isc.sans.edu/forums/diary/Emotet+malspam+is+back/25330/
|
||||
|
|
|
@ -14,12 +14,12 @@ The following _campaigns_ are known and can be associated with FIN8:
|
|||
|
||||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with FIN8:
|
||||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [IT](https://vuldb.com/?country.it)
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* ...
|
||||
|
||||
There are 1 more country items available. Please use our online service to access the data.
|
||||
There are 21 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -27,12 +27,12 @@ These _indicators of compromise_ (IOC) indicate associated network resources whi
|
|||
|
||||
ID | IP address | Hostname | Campaign | Confidence
|
||||
-- | ---------- | -------- | -------- | ----------
|
||||
1 | [104.168.145.204](https://vuldb.com/?ip.104.168.145.204) | hwsrv-836597.hostwindsdns.com | Badhatch | High
|
||||
2 | [104.168.237.21](https://vuldb.com/?ip.104.168.237.21) | hwsrv-850035.hostwindsdns.com | - | High
|
||||
3 | [192.52.167.199](https://vuldb.com/?ip.192.52.167.199) | mx312.punkchaine.net | Badhatch | High
|
||||
1 | [37.1.204.87](https://vuldb.com/?ip.37.1.204.87) | - | - | High
|
||||
2 | [104.168.145.204](https://vuldb.com/?ip.104.168.145.204) | hwsrv-836597.hostwindsdns.com | Badhatch | High
|
||||
3 | [104.168.237.21](https://vuldb.com/?ip.104.168.237.21) | hwsrv-850035.hostwindsdns.com | - | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 2 more IOC items available. Please use our online service to access the data.
|
||||
There are 4 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
|
@ -40,8 +40,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264 | Execution with Unnecessary Privileges | High
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 15 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -49,17 +54,43 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `addentry.php` | Medium
|
||||
2 | File | `add_comment.php` | High
|
||||
3 | File | `admin/index.php` | High
|
||||
4 | ... | ... | ...
|
||||
1 | File | `//proc/kcore` | Medium
|
||||
2 | File | `/Ap4RtpAtom.cpp` | High
|
||||
3 | File | `/app/options.py` | High
|
||||
4 | File | `/bcms/admin/?page=user/list` | High
|
||||
5 | File | `/bsms/?page=manage_account` | High
|
||||
6 | File | `/cgi-bin/login.cgi` | High
|
||||
7 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
8 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
9 | File | `/dashboard/reports/logs/view` | High
|
||||
10 | File | `/debug/pprof` | Medium
|
||||
11 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
12 | File | `/fuel/sitevariables/delete/4` | High
|
||||
13 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
14 | File | `/index/jobfairol/show/` | High
|
||||
15 | File | `/librarian/bookdetails.php` | High
|
||||
16 | File | `/mgmt/tm/util/bash` | High
|
||||
17 | File | `/monitoring` | Medium
|
||||
18 | File | `/new` | Low
|
||||
19 | File | `/proc/<pid>/status` | High
|
||||
20 | File | `/public/plugins/` | High
|
||||
21 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
22 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
23 | File | `/simple_chat_bot/admin/?page=user/manage_user` | High
|
||||
24 | File | `/src/main/java/com/dotmarketing/filters/CMSFilter.java` | High
|
||||
25 | File | `/tmp` | Low
|
||||
26 | File | `/uncpath/` | Medium
|
||||
27 | File | `/views/directive/sys/SysConfigDataDirective.java` | High
|
||||
28 | File | `/wp-json/wc/v3/webhooks` | High
|
||||
29 | ... | ... | ...
|
||||
|
||||
There are 20 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 246 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
The following list contains _external sources_ which discuss the actor and the associated activities:
|
||||
|
||||
* https://blog.morphisec.com/security-alert-fin8-is-back
|
||||
* https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation
|
||||
* https://vxug.fakedoma.in/archive/APTs/2021/2021.03.10/BADHATCH.pdf
|
||||
|
||||
|
|
|
@ -26,12 +26,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
1 | T1006 | CWE-21, CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 4 more TTP items available. Please use our online service to access the data.
|
||||
There are 13 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -45,7 +45,7 @@ ID | Type | Indicator | Confidence
|
|||
4 | File | `/system?action=ServiceAdmin` | High
|
||||
5 | ... | ... | ...
|
||||
|
||||
There are 30 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 31 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -9,11 +9,11 @@ _Live data_ and more _analysis capabilities_ are available at [https://vuldb.com
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with FritzFrog:
|
||||
|
||||
* [VN](https://vuldb.com/?country.vn)
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* ...
|
||||
|
||||
There are 17 more country items available. Please use our online service to access the data.
|
||||
There are 13 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -331,12 +331,14 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1040 | CWE-294 | Authentication Bypass by Capture-replay | High
|
||||
2 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
3 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23, CWE-425 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294, CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 9 more TTP items available. Please use our online service to access the data.
|
||||
There are 21 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -345,44 +347,40 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `.htaccess` | Medium
|
||||
2 | File | `/admin.php/news/admin/topic/save` | High
|
||||
3 | File | `/admin_page/all-files-update-ajax.php` | High
|
||||
4 | File | `/api/crontab` | Medium
|
||||
5 | File | `/api/RecordingList/DownloadRecord?file=` | High
|
||||
6 | File | `/cgi-bin/cgiServer.exx` | High
|
||||
7 | File | `/cgi-bin/kerbynet` | High
|
||||
8 | File | `/cgi-bin/supervisor/adcommand.cgi` | High
|
||||
9 | File | `/cmd?cmd=connect` | High
|
||||
10 | File | `/CMD_ACCOUNT_ADMIN` | High
|
||||
11 | File | `/componetns/user/class.user.php` | High
|
||||
12 | File | `/config/getuser` | High
|
||||
13 | File | `/current_action.php?action=reboot` | High
|
||||
14 | File | `/dms/admin/reports/daily_collection_report.php` | High
|
||||
15 | File | `/etc/config/image_sign` | High
|
||||
16 | File | `/etc/hosts` | Medium
|
||||
17 | File | `/etc/password` | High
|
||||
18 | File | `/etc/quagga` | Medium
|
||||
19 | File | `/forum/away.php` | High
|
||||
20 | File | `/gaia-job-admin/user/add` | High
|
||||
21 | File | `/HNAP1` | Low
|
||||
22 | File | `/info.cgi` | Medium
|
||||
23 | File | `/lists/admin/` | High
|
||||
24 | File | `/proc/stat` | Medium
|
||||
25 | File | `/public/plugins/` | High
|
||||
26 | File | `/ram/pckg/security/nova/bin/ipsec` | High
|
||||
27 | File | `/rest/api/latest/projectvalidate/key` | High
|
||||
28 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
29 | File | `/spip.php` | Medium
|
||||
30 | File | `/sql/sql_string.h` | High
|
||||
31 | File | `/sql/sql_type.cc` | High
|
||||
32 | File | `/strings/ctype-latin1.c` | High
|
||||
33 | File | `/strings/ctype-simple.c` | High
|
||||
34 | File | `/uncpath/` | Medium
|
||||
35 | File | `/upload/localhost` | High
|
||||
36 | File | `/user-utils/users/md5.json` | High
|
||||
37 | ... | ... | ...
|
||||
2 | File | `/admin/conferences/list/` | High
|
||||
3 | File | `/admin/dl_sendmail.php` | High
|
||||
4 | File | `/admin/edit_admin_details.php?id=admin` | High
|
||||
5 | File | `/admin/generalsettings.php` | High
|
||||
6 | File | `/admin/inquiries/view_details.php` | High
|
||||
7 | File | `/admin/payment.php` | High
|
||||
8 | File | `/admin/reports.php` | High
|
||||
9 | File | `/blog/blog.php` | High
|
||||
10 | File | `/Content/Template/root/reverse-shell.aspx` | High
|
||||
11 | File | `/controller/OnlinePreviewController.java` | High
|
||||
12 | File | `/debug/pprof` | Medium
|
||||
13 | File | `/etc/hosts` | Medium
|
||||
14 | File | `/filemanager/php/connector.php` | High
|
||||
15 | File | `/forum/away.php` | High
|
||||
16 | File | `/ghost/preview` | High
|
||||
17 | File | `/hy-cgi/devices.cgi` | High
|
||||
18 | File | `/index.php?p=admin/actions/users/send-password-reset-email` | High
|
||||
19 | File | `/Items/*/RemoteImages/Download` | High
|
||||
20 | File | `/librarian/bookdetails.php` | High
|
||||
21 | File | `/MagickCore/image.c` | High
|
||||
22 | File | `/mdiy/dict/listExcludeApp` | High
|
||||
23 | File | `/menu.html` | Medium
|
||||
24 | File | `/owa/auth/logon.aspx` | High
|
||||
25 | File | `/p1/p2/:name` | Medium
|
||||
26 | File | `/plugin/jcapture/applet.php` | High
|
||||
27 | File | `/public/launchNewWindow.jsp` | High
|
||||
28 | File | `/rdms/admin/?page=user/manage_user` | High
|
||||
29 | File | `/recreate.php` | High
|
||||
30 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
31 | File | `/setting/setDeviceName` | High
|
||||
32 | File | `/setting/setLanguageCfg` | High
|
||||
33 | ... | ... | ...
|
||||
|
||||
There are 321 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 286 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -27,12 +27,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1222 | CWE-275 | Permission Issues | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 3 more TTP items available. Please use our online service to access the data.
|
||||
There are 10 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -47,7 +47,7 @@ ID | Type | Indicator | Confidence
|
|||
5 | File | `c4t64fx.c` | Medium
|
||||
6 | ... | ... | ...
|
||||
|
||||
There are 40 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 43 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -13,7 +13,7 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
* [VN](https://vuldb.com/?country.vn)
|
||||
* ...
|
||||
|
||||
There are 10 more country items available. Please use our online service to access the data.
|
||||
There are 14 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -97,7 +97,7 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23, CWE-24 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
|
@ -115,51 +115,50 @@ ID | Type | Indicator | Confidence
|
|||
1 | File | `.htaccess` | Medium
|
||||
2 | File | `/#/CampaignManager/users` | High
|
||||
3 | File | `/admin/admin_login.php` | High
|
||||
4 | File | `/admin/login.php` | High
|
||||
4 | File | `/app/options.py` | High
|
||||
5 | File | `/cgi-bin/luci/api/auth` | High
|
||||
6 | File | `/cgi-bin/luci/api/diagnose` | High
|
||||
7 | File | `/classes/Master.php?f=delete_train` | High
|
||||
8 | File | `/Content/Template/root/reverse-shell.aspx` | High
|
||||
9 | File | `/debug/pprof` | Medium
|
||||
10 | File | `/dev/tty` | Medium
|
||||
11 | File | `/etc/config/image_sign` | High
|
||||
12 | File | `/forum/away.php` | High
|
||||
13 | File | `/gaia-job-admin/user/add` | High
|
||||
14 | File | `/goforms/rlminfo` | High
|
||||
15 | File | `/HNAP1` | Low
|
||||
16 | File | `/login` | Low
|
||||
17 | File | `/member/index/login.html` | High
|
||||
18 | File | `/mgmt/tm/util/bash` | High
|
||||
19 | File | `/ocwbs/admin/?page=user/manage_user` | High
|
||||
20 | File | `/ofrs/admin/?page=user/manage_user` | High
|
||||
21 | File | `/p1/p2/:name` | Medium
|
||||
22 | File | `/php/passport/index.php` | High
|
||||
23 | File | `/rdms/admin/?page=user/manage_user` | High
|
||||
24 | File | `/requests.php` | High
|
||||
25 | File | `/saml/login` | Medium
|
||||
26 | File | `/ScadaBR/login.htm` | High
|
||||
27 | File | `/setting/setDeviceName` | High
|
||||
28 | File | `/setting/setLanguageCfg` | High
|
||||
29 | File | `/setting/setUploadSetting` | High
|
||||
30 | File | `/spip.php` | Medium
|
||||
31 | File | `/upload` | Low
|
||||
32 | File | `/user-utils/users/md5.json` | High
|
||||
33 | File | `/userRpm/popupSiteSurveyRpm.html` | High
|
||||
34 | File | `/var/adm/btmp` | High
|
||||
35 | File | `/vloggers_merch/?p=view_product` | High
|
||||
36 | File | `/wp-admin/admin-ajax.php` | High
|
||||
37 | File | `account/login.php` | High
|
||||
38 | File | `ad/login.asp` | Medium
|
||||
39 | File | `admin.inc.php` | High
|
||||
40 | File | `admin/?page=students` | High
|
||||
41 | File | `admin/admin_ping.php` | High
|
||||
42 | File | `admin/conf_users_edit.php` | High
|
||||
43 | File | `admin/index.php` | High
|
||||
44 | File | `admin/login.php` | High
|
||||
45 | File | `admin/navbar.php?action=add_page` | High
|
||||
46 | ... | ... | ...
|
||||
7 | File | `/ci_spms/admin/category` | High
|
||||
8 | File | `/ci_spms/admin/search/searching/` | High
|
||||
9 | File | `/classes/Master.php?f=delete_train` | High
|
||||
10 | File | `/Content/Template/root/reverse-shell.aspx` | High
|
||||
11 | File | `/debug/pprof` | Medium
|
||||
12 | File | `/dev/tty` | Medium
|
||||
13 | File | `/etc/config/image_sign` | High
|
||||
14 | File | `/forum/away.php` | High
|
||||
15 | File | `/gaia-job-admin/user/add` | High
|
||||
16 | File | `/ghost/preview` | High
|
||||
17 | File | `/goforms/rlminfo` | High
|
||||
18 | File | `/HNAP1` | Low
|
||||
19 | File | `/login` | Low
|
||||
20 | File | `/member/index/login.html` | High
|
||||
21 | File | `/mgmt/tm/util/bash` | High
|
||||
22 | File | `/ocwbs/admin/?page=user/manage_user` | High
|
||||
23 | File | `/ofrs/admin/?page=user/manage_user` | High
|
||||
24 | File | `/p1/p2/:name` | Medium
|
||||
25 | File | `/php/passport/index.php` | High
|
||||
26 | File | `/rdms/admin/?page=user/manage_user` | High
|
||||
27 | File | `/requests.php` | High
|
||||
28 | File | `/saml/login` | Medium
|
||||
29 | File | `/ScadaBR/login.htm` | High
|
||||
30 | File | `/setting/setDeviceName` | High
|
||||
31 | File | `/setting/setLanguageCfg` | High
|
||||
32 | File | `/setting/setUploadSetting` | High
|
||||
33 | File | `/spip.php` | Medium
|
||||
34 | File | `/upload` | Low
|
||||
35 | File | `/user-utils/users/md5.json` | High
|
||||
36 | File | `/userRpm/popupSiteSurveyRpm.html` | High
|
||||
37 | File | `/var/adm/btmp` | High
|
||||
38 | File | `/vloggers_merch/?p=view_product` | High
|
||||
39 | File | `/wp-admin/admin-ajax.php` | High
|
||||
40 | File | `account/login.php` | High
|
||||
41 | File | `ad/login.asp` | Medium
|
||||
42 | File | `admin.inc.php` | High
|
||||
43 | File | `admin/?page=students` | High
|
||||
44 | File | `admin/admin_ping.php` | High
|
||||
45 | ... | ... | ...
|
||||
|
||||
There are 397 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 390 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -8,12 +8,12 @@ _Live data_ and more _analysis capabilities_ are available at [https://vuldb.com
|
|||
|
||||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Grizzly Steppe:
|
||||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [RU](https://vuldb.com/?country.ru)
|
||||
* [NL](https://vuldb.com/?country.nl)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* ...
|
||||
|
||||
There are 7 more country items available. Please use our online service to access the data.
|
||||
There are 11 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -156,13 +156,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294, CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 19 more TTP items available. Please use our online service to access the data.
|
||||
There are 18 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -170,42 +169,36 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `//proc/kcore` | Medium
|
||||
2 | File | `/about.php` | Medium
|
||||
3 | File | `/acms/admin/?page=transactions/manage_transaction` | High
|
||||
4 | File | `/acms/classes/Master.php?f=delete_cargo_type` | High
|
||||
5 | File | `/admin/` | Low
|
||||
6 | File | `/admin/photo.php` | High
|
||||
1 | File | `.forward` | Medium
|
||||
2 | File | `//proc/kcore` | Medium
|
||||
3 | File | `/about.php` | Medium
|
||||
4 | File | `/admin/` | Low
|
||||
5 | File | `/admin/photo.php` | High
|
||||
6 | File | `/admin/searchview.php` | High
|
||||
7 | File | `/Ap4RtpAtom.cpp` | High
|
||||
8 | File | `/bcms/admin/?page=user/list` | High
|
||||
8 | File | `/app/options.py` | High
|
||||
9 | File | `/bsms/?page=manage_account` | High
|
||||
10 | File | `/car-rental-management-system/admin/manage_user.php` | High
|
||||
11 | File | `/cgi-bin/kerbynet` | High
|
||||
12 | File | `/cgi-bin/login.cgi` | High
|
||||
13 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
14 | File | `/classes/Master.php?f=delete_schedule` | High
|
||||
15 | File | `/cms/admin/?page=invoice/manage_invoice` | High
|
||||
16 | File | `/cms/classes/Master.php?f=delete_invoice` | High
|
||||
17 | File | `/cms/classes/Users.php?f=delete` | High
|
||||
18 | File | `/company/down_resume/total/nature` | High
|
||||
19 | File | `/core/conditions/AbstractWrapper.java` | High
|
||||
20 | File | `/course/api/upload/pic` | High
|
||||
21 | File | `/ctpms/admin/individuals/update_status.php` | High
|
||||
22 | File | `/dashboard/reports/logs/view` | High
|
||||
23 | File | `/dashboard/snapshot/*?orgId=0` | High
|
||||
24 | File | `/debug/pprof` | Medium
|
||||
25 | File | `/forum/away.php` | High
|
||||
26 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
27 | File | `/fuel/sitevariables/delete/4` | High
|
||||
28 | File | `/getcfg.php` | Medium
|
||||
29 | File | `/goform/SetFirewallCfg` | High
|
||||
30 | File | `/guest/s/default/` | High
|
||||
31 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
32 | File | `/hub/api/user` | High
|
||||
33 | File | `/index/jobfairol/show/` | High
|
||||
34 | ... | ... | ...
|
||||
14 | File | `/ci_spms/admin/category` | High
|
||||
15 | File | `/ci_spms/admin/search/searching/` | High
|
||||
16 | File | `/classes/Master.php?f=delete_schedule` | High
|
||||
17 | File | `/company/down_resume/total/nature` | High
|
||||
18 | File | `/core/conditions/AbstractWrapper.java` | High
|
||||
19 | File | `/dashboard/reports/logs/view` | High
|
||||
20 | File | `/dashboard/snapshot/*?orgId=0` | High
|
||||
21 | File | `/debug/pprof` | Medium
|
||||
22 | File | `/etc/hosts` | Medium
|
||||
23 | File | `/forum/away.php` | High
|
||||
24 | File | `/fuel/sitevariables/delete/4` | High
|
||||
25 | File | `/getcfg.php` | Medium
|
||||
26 | File | `/goform/SetFirewallCfg` | High
|
||||
27 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
28 | ... | ... | ...
|
||||
|
||||
There are 288 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 236 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -33,12 +33,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1211 | CWE-254 | 7PK Security Features | High
|
||||
1 | T1006 | CWE-21, CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 1 more TTP items available. Please use our online service to access the data.
|
||||
There are 9 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -56,12 +56,14 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1040 | CWE-294 | Authentication Bypass by Capture-replay | High
|
||||
2 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
3 | T1068 | CWE-264, CWE-274, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 10 more TTP items available. Please use our online service to access the data.
|
||||
There are 21 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -72,53 +74,53 @@ ID | Type | Indicator | Confidence
|
|||
1 | File | `/.vnc/sesman_${username}_passwd` | High
|
||||
2 | File | `/admin-document/@@share` | High
|
||||
3 | File | `/admin/index.php` | High
|
||||
4 | File | `/anony/mjpg.cgi` | High
|
||||
5 | File | `/bin/sh` | Low
|
||||
6 | File | `/cgi-bin/editBookmark` | High
|
||||
7 | File | `/cgi-bin/supervisor/PwdGrp.cgi` | High
|
||||
8 | File | `/etc/shadow` | Medium
|
||||
9 | File | `/EXCU_SHELL` | Medium
|
||||
10 | File | `/export` | Low
|
||||
11 | File | `/GetSimpleCMS-3.3.15/admin/log.php` | High
|
||||
12 | File | `/goform/addressNat` | High
|
||||
13 | File | `/iisadmpwd` | Medium
|
||||
14 | File | `/include/menu_v.inc.php` | High
|
||||
15 | File | `/lms/admin.php` | High
|
||||
16 | File | `/mc` | Low
|
||||
17 | File | `/mgmt/tm/util/bash` | High
|
||||
18 | File | `/my_photo_gallery/image.php` | High
|
||||
19 | File | `/opt/IBM/es/lib/libffq.cryptionjni.so` | High
|
||||
20 | File | `/out.php` | Medium
|
||||
21 | File | `/proc/*/cmdline"` | High
|
||||
22 | File | `/proc/pid/syscall` | High
|
||||
23 | File | `/reps/classes/Users.php?f=delete_agent` | High
|
||||
24 | File | `/rest/review-coverage-chart/1.0/data/<repository_name>/.json` | High
|
||||
25 | File | `/TeamMate/Upload/DomainObjectDocumentUpload.ashx` | High
|
||||
26 | File | `/uncpath/` | Medium
|
||||
27 | File | `/var/log/pcp/configs.sh` | High
|
||||
28 | File | `/webconsole/APIController` | High
|
||||
29 | File | `/wp-admin/admin-ajax.php` | High
|
||||
30 | File | `/WWW//app/admin/controller/admincontroller.php` | High
|
||||
31 | File | `a-b-membres.php` | High
|
||||
32 | File | `action.php` | Medium
|
||||
33 | File | `admin-search.php` | High
|
||||
34 | File | `admin.jcomments.php` | High
|
||||
35 | File | `admin/adminsignin.html` | High
|
||||
36 | File | `admin/index.php` | High
|
||||
37 | File | `admin/infoclass_update.php` | High
|
||||
38 | File | `admin/plugin.php` | High
|
||||
39 | File | `admin/versions.html` | High
|
||||
40 | File | `administrator/index.php?option=com_pago&view=comments` | High
|
||||
41 | File | `Adminlog.asp` | Medium
|
||||
42 | File | `admin_iplog.php` | High
|
||||
43 | File | `ajax.php` | Medium
|
||||
44 | File | `ajax_admin_apis.php` | High
|
||||
45 | File | `ajax_php_pecl.php` | High
|
||||
46 | File | `allocate_block.cpp` | High
|
||||
47 | File | `api.cc` | Low
|
||||
4 | File | `/admin/inquiries/view_details.php` | High
|
||||
5 | File | `/anony/mjpg.cgi` | High
|
||||
6 | File | `/bin/sh` | Low
|
||||
7 | File | `/cgi-bin/editBookmark` | High
|
||||
8 | File | `/cgi-bin/supervisor/PwdGrp.cgi` | High
|
||||
9 | File | `/etc/shadow` | Medium
|
||||
10 | File | `/EXCU_SHELL` | Medium
|
||||
11 | File | `/export` | Low
|
||||
12 | File | `/GetSimpleCMS-3.3.15/admin/log.php` | High
|
||||
13 | File | `/goform/addressNat` | High
|
||||
14 | File | `/iisadmpwd` | Medium
|
||||
15 | File | `/include/menu_v.inc.php` | High
|
||||
16 | File | `/lms/admin.php` | High
|
||||
17 | File | `/mc` | Low
|
||||
18 | File | `/mgmt/tm/util/bash` | High
|
||||
19 | File | `/my_photo_gallery/image.php` | High
|
||||
20 | File | `/opt/IBM/es/lib/libffq.cryptionjni.so` | High
|
||||
21 | File | `/out.php` | Medium
|
||||
22 | File | `/proc/*/cmdline"` | High
|
||||
23 | File | `/proc/pid/syscall` | High
|
||||
24 | File | `/reps/classes/Users.php?f=delete_agent` | High
|
||||
25 | File | `/rest/review-coverage-chart/1.0/data/<repository_name>/.json` | High
|
||||
26 | File | `/TeamMate/Upload/DomainObjectDocumentUpload.ashx` | High
|
||||
27 | File | `/uncpath/` | Medium
|
||||
28 | File | `/usr/bin/pkexec` | High
|
||||
29 | File | `/var/log/pcp/configs.sh` | High
|
||||
30 | File | `/webconsole/APIController` | High
|
||||
31 | File | `/wp-admin/admin-ajax.php` | High
|
||||
32 | File | `/WWW//app/admin/controller/admincontroller.php` | High
|
||||
33 | File | `a-b-membres.php` | High
|
||||
34 | File | `action.php` | Medium
|
||||
35 | File | `admin-search.php` | High
|
||||
36 | File | `admin.jcomments.php` | High
|
||||
37 | File | `admin/adminsignin.html` | High
|
||||
38 | File | `admin/index.php` | High
|
||||
39 | File | `admin/infoclass_update.php` | High
|
||||
40 | File | `admin/plugin.php` | High
|
||||
41 | File | `admin/versions.html` | High
|
||||
42 | File | `administrator/index.php?option=com_pago&view=comments` | High
|
||||
43 | File | `Adminlog.asp` | Medium
|
||||
44 | File | `admin_iplog.php` | High
|
||||
45 | File | `ajax.php` | Medium
|
||||
46 | File | `ajax_admin_apis.php` | High
|
||||
47 | File | `ajax_php_pecl.php` | High
|
||||
48 | ... | ... | ...
|
||||
|
||||
There are 413 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 412 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -60,35 +60,35 @@ ID | Type | Indicator | Confidence
|
|||
3 | File | `/admin.php/pic/admin/pic/hy` | High
|
||||
4 | File | `/admin.php/singer/admin/lists/zhuan` | High
|
||||
5 | File | `/admin.php/singer/admin/singer/hy` | High
|
||||
6 | File | `/admin.php?id=posts&action=display&value=1&postid=` | High
|
||||
7 | File | `/admin/featured.php` | High
|
||||
8 | File | `/admin/general.cgi` | High
|
||||
9 | File | `/admin/inbox.php&action=read` | High
|
||||
10 | File | `/admin/usermanagement.php` | High
|
||||
11 | File | `/administrator/alerts/alertLightbox.php` | High
|
||||
12 | File | `/ajax/clear_tools_log/` | High
|
||||
13 | File | `/api/part_categories` | High
|
||||
14 | File | `/api/programs/orgUnits?programs` | High
|
||||
15 | File | `/api/students/me/courses/` | High
|
||||
16 | File | `/apps/acs-commons/content/page-compare.html` | High
|
||||
17 | File | `/base/SysEveMenuAuthPointMapper.xml` | High
|
||||
18 | File | `/bcms/admin/?page=service_transactions/view_details` | High
|
||||
19 | File | `/bcms/classes/Master.php?f=delete_court_rental` | High
|
||||
20 | File | `/blog/blog.php` | High
|
||||
21 | File | `/cgi-bin/luci/api/diagnose` | High
|
||||
22 | File | `/cgi-bin/main.cgi` | High
|
||||
23 | File | `/cgi-mod/lookup.cgi` | High
|
||||
24 | File | `/cgi/ansi` | Medium
|
||||
25 | File | `/classes/Master.php?f=delete_train` | High
|
||||
26 | File | `/cms/classes/Master.php?f=delete_designation` | High
|
||||
27 | File | `/controller/Adv.php` | High
|
||||
28 | File | `/createnewaccount` | High
|
||||
29 | File | `/dashboard/blocks/stacks/view_details/` | High
|
||||
30 | File | `/dev/urandom` | Medium
|
||||
31 | File | `/dl/dl_sendmail.php` | High
|
||||
6 | File | `/admin/featured.php` | High
|
||||
7 | File | `/admin/general.cgi` | High
|
||||
8 | File | `/admin/usermanagement.php` | High
|
||||
9 | File | `/ajax/clear_tools_log/` | High
|
||||
10 | File | `/api/part_categories` | High
|
||||
11 | File | `/api/programs/orgUnits?programs` | High
|
||||
12 | File | `/api/students/me/courses/` | High
|
||||
13 | File | `/base/SysEveMenuAuthPointMapper.xml` | High
|
||||
14 | File | `/bcms/admin/?page=service_transactions/view_details` | High
|
||||
15 | File | `/bcms/classes/Master.php?f=delete_court_rental` | High
|
||||
16 | File | `/bin/posix/src/ports/POSIX/OpENer` | High
|
||||
17 | File | `/cgi-bin/luci/api/diagnose` | High
|
||||
18 | File | `/cgi-mod/lookup.cgi` | High
|
||||
19 | File | `/cgi/ansi` | Medium
|
||||
20 | File | `/classes/Master.php?f=delete_train` | High
|
||||
21 | File | `/cms/classes/Master.php?f=delete_designation` | High
|
||||
22 | File | `/createnewaccount` | High
|
||||
23 | File | `/dashboard/blocks/stacks/view_details/` | High
|
||||
24 | File | `/dev/urandom` | Medium
|
||||
25 | File | `/dl/dl_sendmail.php` | High
|
||||
26 | File | `/ecrire` | Low
|
||||
27 | File | `/etc/fstab` | Medium
|
||||
28 | File | `/etc/sudoers` | Medium
|
||||
29 | File | `/food/admin/all_users.php` | High
|
||||
30 | File | `/genericreport` | High
|
||||
31 | File | `/goform/aspForm` | High
|
||||
32 | ... | ... | ...
|
||||
|
||||
There are 277 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 269 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -10,10 +10,10 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
|
||||
* [VN](https://vuldb.com/?country.vn)
|
||||
* [HK](https://vuldb.com/?country.hk)
|
||||
* [NZ](https://vuldb.com/?country.nz)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* ...
|
||||
|
||||
There are 2 more country items available. Please use our online service to access the data.
|
||||
There are 1 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -287,12 +287,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-307 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23, CWE-36 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 3 more TTP items available. Please use our online service to access the data.
|
||||
There are 17 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -300,20 +301,19 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/admin/deluser.php` | High
|
||||
2 | File | `/admin/dl_sendmail.php` | High
|
||||
3 | File | `/admin/general.cgi` | High
|
||||
4 | File | `/admin/scheprofile.cgi` | High
|
||||
5 | File | `/admin/showbad.php` | High
|
||||
6 | File | `/admin/usermanagement.php` | High
|
||||
7 | File | `/admin/ztliuyan_sendmail.php` | High
|
||||
8 | File | `/churchcrm/WhyCameEditor.php` | High
|
||||
9 | File | `/dashboard/snapshot/*?orgId=0` | High
|
||||
10 | File | `/data/vendor/tcl` | High
|
||||
11 | File | `/dl/dl_sendmail.php` | High
|
||||
12 | ... | ... | ...
|
||||
1 | File | `/AgilePointServer/Extension/FetchUsingEncodedData` | High
|
||||
2 | File | `/app/options.py` | High
|
||||
3 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
4 | File | `/ci_hms/search` | High
|
||||
5 | File | `/ci_ssms/index.php/orders/create` | High
|
||||
6 | File | `/goform/formLogin` | High
|
||||
7 | File | `/index.php` | Medium
|
||||
8 | File | `/index.php?p=admin/actions/users/send-password-reset-email` | High
|
||||
9 | File | `/index.php?page=search/rentals` | High
|
||||
10 | File | `/index.php?route=extension/module/so_filter_shop_by/filter_data` | High
|
||||
11 | ... | ... | ...
|
||||
|
||||
There are 88 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 80 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -40,12 +40,14 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1040 | CWE-294 | Authentication Bypass by Capture-replay | High
|
||||
2 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
3 | T1068 | CWE-264, CWE-266, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 8 more TTP items available. Please use our online service to access the data.
|
||||
There are 19 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -110,7 +112,7 @@ ID | Type | Indicator | Confidence
|
|||
55 | File | `app/application.cpp` | High
|
||||
56 | ... | ... | ...
|
||||
|
||||
There are 485 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 486 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -26,8 +26,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264 | Execution with Unnecessary Privileges | High
|
||||
1 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
2 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
3 | T1068 | CWE-264, CWE-269 | Execution with Unnecessary Privileges | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 4 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -45,12 +45,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 6 more TTP items available. Please use our online service to access the data.
|
||||
There are 16 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -36,12 +36,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 3 more TTP items available. Please use our online service to access the data.
|
||||
There are 12 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -21,11 +21,11 @@ There are 8 more campaign items available. Please use our online service to acce
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Lazarus:
|
||||
|
||||
* [VN](https://vuldb.com/?country.vn)
|
||||
* [IN](https://vuldb.com/?country.in)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [IN](https://vuldb.com/?country.in)
|
||||
* ...
|
||||
|
||||
There are 2 more country items available. Please use our online service to access the data.
|
||||
There are 1 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -228,13 +228,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1006 | CWE-21, CWE-22 | Pathname Traversal | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 16 more TTP items available. Please use our online service to access the data.
|
||||
There are 15 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -242,20 +242,18 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/action/import_cert_file/` | High
|
||||
2 | File | `/action/import_https_cert_file/` | High
|
||||
3 | File | `/action/remove/` | High
|
||||
4 | File | `/admin/inquiries/view_details.php` | High
|
||||
5 | File | `/api/user/userData?userCode=admin` | High
|
||||
6 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
7 | File | `/ci_hms/search` | High
|
||||
8 | File | `/ci_ssms/index.php/orders/create` | High
|
||||
9 | File | `/classes/Master.php?f=delete_message` | High
|
||||
10 | File | `/classes/Master.php?f=delete_reservation` | High
|
||||
11 | File | `/classes/Master.php?f=delete_schedule` | High
|
||||
12 | ... | ... | ...
|
||||
1 | File | `/app/options.py` | High
|
||||
2 | File | `/bin/posix/src/ports/POSIX/OpENer` | High
|
||||
3 | File | `/dashboard/menu-list.php` | High
|
||||
4 | File | `/dashboard/profile.php` | High
|
||||
5 | File | `/dashboard/table-list.php` | High
|
||||
6 | File | `/etc/lighttpd.d/ca.pem` | High
|
||||
7 | File | `/ffos/classes/Master.php?f=save_category` | High
|
||||
8 | File | `/home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf` | High
|
||||
9 | File | `/pkg/util` | Medium
|
||||
10 | ... | ... | ...
|
||||
|
||||
There are 88 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 74 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -32,7 +32,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
1 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
2 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
3 | T1204.001 | CWE-601 | Open Redirect | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 2 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -13,7 +13,7 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
* [CN](https://vuldb.com/?country.cn)
|
||||
* ...
|
||||
|
||||
There are 7 more country items available. Please use our online service to access the data.
|
||||
There are 9 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -24,9 +24,10 @@ ID | IP address | Hostname | Campaign | Confidence
|
|||
1 | [45.91.83.176](https://vuldb.com/?ip.45.91.83.176) | - | - | High
|
||||
2 | [45.227.255.190](https://vuldb.com/?ip.45.227.255.190) | - | - | High
|
||||
3 | [88.80.147.102](https://vuldb.com/?ip.88.80.147.102) | - | - | High
|
||||
4 | ... | ... | ... | ...
|
||||
4 | [93.190.139.223](https://vuldb.com/?ip.93.190.139.223) | 93-190-139-223.hosted-by-worldstream.net | - | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 13 more IOC items available. Please use our online service to access the data.
|
||||
There are 15 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
|
@ -34,12 +35,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1055 | CWE-74 | Injection | High
|
||||
2 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
3 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 8 more TTP items available. Please use our online service to access the data.
|
||||
There are 10 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -54,9 +55,11 @@ ID | Type | Indicator | Confidence
|
|||
5 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
6 | File | `/uncpath/` | Medium
|
||||
7 | File | `agent/Core/Controller/SendRequest.cpp` | High
|
||||
8 | ... | ... | ...
|
||||
8 | File | `backend/Login/load/` | High
|
||||
9 | File | `chan_skinny.c` | High
|
||||
10 | ... | ... | ...
|
||||
|
||||
There are 56 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 73 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
@ -65,6 +68,8 @@ The following list contains _external sources_ which discuss the actor and the a
|
|||
* https://github.com/hvs-consulting/ioc_signatures/blob/main/Proxyshell/HvS_Proxyshell_2021_09_IOCs.csv
|
||||
* https://github.com/sophoslabs/IoCs/blob/master/Ransomware-LockBit.csv
|
||||
* https://thedfirreport.com/2020/06/10/lockbit-ransomware-why-you-no-spread/
|
||||
* https://twitter.com/OscarAldana/status/1548457335852437506
|
||||
* https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom
|
||||
* https://www.ic3.gov/Media/News/2022/220204.pdf
|
||||
|
||||
## Literature
|
||||
|
|
|
@ -1,171 +1,118 @@
|
|||
# Lokibot - Cyber Threat Intelligence
|
||||
# LokiBot - Cyber Threat Intelligence
|
||||
|
||||
These _indicators_ were reported, collected, and generated during the [VulDB CTI analysis](https://vuldb.com/?kb.cti) of the actor known as [Lokibot](https://vuldb.com/?actor.lokibot). The _activity monitoring_ correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique _predictive model_ uses _big data_ to forecast activities and their characteristics.
|
||||
These _indicators_ were reported, collected, and generated during the [VulDB CTI analysis](https://vuldb.com/?kb.cti) of the actor known as [LokiBot](https://vuldb.com/?actor.lokibot). The _activity monitoring_ correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique _predictive model_ uses _big data_ to forecast activities and their characteristics.
|
||||
|
||||
_Live data_ and more _analysis capabilities_ are available at [https://vuldb.com/?actor.lokibot](https://vuldb.com/?actor.lokibot)
|
||||
|
||||
## Countries
|
||||
|
||||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Lokibot:
|
||||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with LokiBot:
|
||||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [VN](https://vuldb.com/?country.vn)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* ...
|
||||
|
||||
There are 18 more country items available. Please use our online service to access the data.
|
||||
There are 11 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
These _indicators of compromise_ (IOC) indicate associated network resources which are known to be part of research and attack activities of Lokibot.
|
||||
These _indicators of compromise_ (IOC) indicate associated network resources which are known to be part of research and attack activities of LokiBot.
|
||||
|
||||
ID | IP address | Hostname | Campaign | Confidence
|
||||
-- | ---------- | -------- | -------- | ----------
|
||||
1 | [1.2.4.8](https://vuldb.com/?ip.1.2.4.8) | public1.sdns.cn | - | High
|
||||
2 | [2.57.186.170](https://vuldb.com/?ip.2.57.186.170) | - | - | High
|
||||
3 | [3.64.163.50](https://vuldb.com/?ip.3.64.163.50) | ec2-3-64-163-50.eu-central-1.compute.amazonaws.com | - | Medium
|
||||
4 | [3.130.204.160](https://vuldb.com/?ip.3.130.204.160) | ec2-3-130-204-160.us-east-2.compute.amazonaws.com | - | Medium
|
||||
5 | [3.220.57.224](https://vuldb.com/?ip.3.220.57.224) | ec2-3-220-57-224.compute-1.amazonaws.com | - | Medium
|
||||
6 | [3.232.242.170](https://vuldb.com/?ip.3.232.242.170) | ec2-3-232-242-170.compute-1.amazonaws.com | - | Medium
|
||||
7 | [5.160.218.88](https://vuldb.com/?ip.5.160.218.88) | ircpanel4.novinhost.org | - | High
|
||||
8 | [5.253.62.214](https://vuldb.com/?ip.5.253.62.214) | - | - | High
|
||||
9 | [5.255.255.80](https://vuldb.com/?ip.5.255.255.80) | yandex.ru | - | High
|
||||
10 | [8.208.76.80](https://vuldb.com/?ip.8.208.76.80) | - | - | High
|
||||
11 | [8.249.245.254](https://vuldb.com/?ip.8.249.245.254) | - | - | High
|
||||
12 | [13.107.21.200](https://vuldb.com/?ip.13.107.21.200) | - | - | High
|
||||
13 | [13.250.255.10](https://vuldb.com/?ip.13.250.255.10) | ec2-13-250-255-10.ap-southeast-1.compute.amazonaws.com | - | Medium
|
||||
14 | [15.197.142.173](https://vuldb.com/?ip.15.197.142.173) | a4ec4c6ea1c92e2e6.awsglobalaccelerator.com | - | High
|
||||
15 | [18.116.152.12](https://vuldb.com/?ip.18.116.152.12) | ec2-18-116-152-12.us-east-2.compute.amazonaws.com | - | Medium
|
||||
16 | [18.118.182.0](https://vuldb.com/?ip.18.118.182.0) | ec2-18-118-182-0.us-east-2.compute.amazonaws.com | - | Medium
|
||||
17 | [18.188.18.34](https://vuldb.com/?ip.18.188.18.34) | ec2-18-188-18-34.us-east-2.compute.amazonaws.com | - | Medium
|
||||
18 | [20.42.65.92](https://vuldb.com/?ip.20.42.65.92) | - | - | High
|
||||
19 | [20.72.235.82](https://vuldb.com/?ip.20.72.235.82) | - | - | High
|
||||
20 | [20.112.52.29](https://vuldb.com/?ip.20.112.52.29) | - | - | High
|
||||
21 | [20.189.173.20](https://vuldb.com/?ip.20.189.173.20) | - | - | High
|
||||
22 | [23.20.239.12](https://vuldb.com/?ip.23.20.239.12) | ec2-23-20-239-12.compute-1.amazonaws.com | - | Medium
|
||||
23 | [23.21.126.66](https://vuldb.com/?ip.23.21.126.66) | ec2-23-21-126-66.compute-1.amazonaws.com | - | Medium
|
||||
24 | [23.21.173.155](https://vuldb.com/?ip.23.21.173.155) | ec2-23-21-173-155.compute-1.amazonaws.com | - | Medium
|
||||
25 | [23.21.211.162](https://vuldb.com/?ip.23.21.211.162) | ec2-23-21-211-162.compute-1.amazonaws.com | - | Medium
|
||||
26 | [23.21.252.4](https://vuldb.com/?ip.23.21.252.4) | ec2-23-21-252-4.compute-1.amazonaws.com | - | Medium
|
||||
27 | [23.95.132.48](https://vuldb.com/?ip.23.95.132.48) | 23-95-132-48-host.colocrossing.com | - | High
|
||||
28 | [23.111.168.182](https://vuldb.com/?ip.23.111.168.182) | netbserverdns02.com | - | High
|
||||
29 | [23.205.105.153](https://vuldb.com/?ip.23.205.105.153) | a23-205-105-153.deploy.static.akamaitechnologies.com | - | High
|
||||
30 | [23.205.105.157](https://vuldb.com/?ip.23.205.105.157) | a23-205-105-157.deploy.static.akamaitechnologies.com | - | High
|
||||
31 | [23.222.5.37](https://vuldb.com/?ip.23.222.5.37) | a23-222-5-37.deploy.static.akamaitechnologies.com | - | High
|
||||
32 | [27.121.64.133](https://vuldb.com/?ip.27.121.64.133) | cp133.ezyreg.com | - | High
|
||||
33 | [31.13.65.174](https://vuldb.com/?ip.31.13.65.174) | instagram-p42-shv-01-atl3.fbcdn.net | - | High
|
||||
34 | [31.41.46.120](https://vuldb.com/?ip.31.41.46.120) | maldova873.example.com | - | High
|
||||
35 | [31.220.52.219](https://vuldb.com/?ip.31.220.52.219) | workshop.piguno.com | - | High
|
||||
36 | [34.77.10.20](https://vuldb.com/?ip.34.77.10.20) | 20.10.77.34.bc.googleusercontent.com | - | Medium
|
||||
37 | [34.98.99.30](https://vuldb.com/?ip.34.98.99.30) | 30.99.98.34.bc.googleusercontent.com | - | Medium
|
||||
38 | [34.102.136.180](https://vuldb.com/?ip.34.102.136.180) | 180.136.102.34.bc.googleusercontent.com | - | Medium
|
||||
39 | [34.117.168.233](https://vuldb.com/?ip.34.117.168.233) | 233.168.117.34.bc.googleusercontent.com | - | Medium
|
||||
40 | [34.205.248.193](https://vuldb.com/?ip.34.205.248.193) | ec2-34-205-248-193.compute-1.amazonaws.com | - | Medium
|
||||
41 | [35.186.238.101](https://vuldb.com/?ip.35.186.238.101) | 101.238.186.35.bc.googleusercontent.com | - | Medium
|
||||
42 | [35.238.161.88](https://vuldb.com/?ip.35.238.161.88) | 88.161.238.35.bc.googleusercontent.com | - | Medium
|
||||
43 | [35.247.234.230](https://vuldb.com/?ip.35.247.234.230) | 230.234.247.35.bc.googleusercontent.com | - | Medium
|
||||
44 | [37.49.224.146](https://vuldb.com/?ip.37.49.224.146) | - | - | High
|
||||
45 | [37.49.224.209](https://vuldb.com/?ip.37.49.224.209) | - | - | High
|
||||
46 | [37.49.225.195](https://vuldb.com/?ip.37.49.225.195) | - | - | High
|
||||
47 | [37.49.225.217](https://vuldb.com/?ip.37.49.225.217) | - | - | High
|
||||
48 | [37.120.146.122](https://vuldb.com/?ip.37.120.146.122) | - | - | High
|
||||
49 | [37.120.146.124](https://vuldb.com/?ip.37.120.146.124) | - | - | High
|
||||
50 | [37.235.1.174](https://vuldb.com/?ip.37.235.1.174) | resolver1.freedns.zone.powered.by.virtexxa.com | - | High
|
||||
51 | [37.235.1.177](https://vuldb.com/?ip.37.235.1.177) | resolver2.freedns.zone.powered.by.virtexxa.com | - | High
|
||||
52 | [40.70.224.146](https://vuldb.com/?ip.40.70.224.146) | - | - | High
|
||||
53 | [40.76.4.15](https://vuldb.com/?ip.40.76.4.15) | - | - | High
|
||||
54 | [43.254.17.15](https://vuldb.com/?ip.43.254.17.15) | 43-254-17-15.static.ip.net.tw | - | High
|
||||
55 | [43.255.154.37](https://vuldb.com/?ip.43.255.154.37) | ip-43-255-154-37.ip.secureserver.net | - | High
|
||||
56 | [45.33.83.75](https://vuldb.com/?ip.45.33.83.75) | li1029-75.members.linode.com | - | High
|
||||
57 | [45.43.35.96](https://vuldb.com/?ip.45.43.35.96) | - | - | High
|
||||
58 | [45.67.14.182](https://vuldb.com/?ip.45.67.14.182) | - | - | High
|
||||
59 | [45.80.132.70](https://vuldb.com/?ip.45.80.132.70) | host-45-80-132-70.superhosting.rs | - | High
|
||||
60 | [45.122.138.6](https://vuldb.com/?ip.45.122.138.6) | - | - | High
|
||||
61 | [45.128.184.132](https://vuldb.com/?ip.45.128.184.132) | vds107519.mgn-host.ru | - | High
|
||||
62 | [45.147.229.85](https://vuldb.com/?ip.45.147.229.85) | - | - | High
|
||||
63 | [45.154.253.150](https://vuldb.com/?ip.45.154.253.150) | shared04.cust05.proxy.is | - | High
|
||||
64 | [45.154.253.152](https://vuldb.com/?ip.45.154.253.152) | shared06.cust05.proxy.is | - | High
|
||||
65 | [46.17.98.105](https://vuldb.com/?ip.46.17.98.105) | - | - | High
|
||||
66 | [46.101.46.83](https://vuldb.com/?ip.46.101.46.83) | - | - | High
|
||||
67 | [47.52.60.150](https://vuldb.com/?ip.47.52.60.150) | - | - | High
|
||||
68 | [47.91.169.15](https://vuldb.com/?ip.47.91.169.15) | - | - | High
|
||||
69 | [47.254.177.155](https://vuldb.com/?ip.47.254.177.155) | - | - | High
|
||||
70 | ... | ... | ... | ...
|
||||
1 | [2.57.186.170](https://vuldb.com/?ip.2.57.186.170) | - | - | High
|
||||
2 | [3.220.57.224](https://vuldb.com/?ip.3.220.57.224) | ec2-3-220-57-224.compute-1.amazonaws.com | - | Medium
|
||||
3 | [3.232.242.170](https://vuldb.com/?ip.3.232.242.170) | ec2-3-232-242-170.compute-1.amazonaws.com | - | Medium
|
||||
4 | [13.107.21.200](https://vuldb.com/?ip.13.107.21.200) | - | - | High
|
||||
5 | [15.197.142.173](https://vuldb.com/?ip.15.197.142.173) | a4ec4c6ea1c92e2e6.awsglobalaccelerator.com | - | High
|
||||
6 | [18.116.152.12](https://vuldb.com/?ip.18.116.152.12) | ec2-18-116-152-12.us-east-2.compute.amazonaws.com | - | Medium
|
||||
7 | [18.188.18.34](https://vuldb.com/?ip.18.188.18.34) | ec2-18-188-18-34.us-east-2.compute.amazonaws.com | - | Medium
|
||||
8 | [20.189.173.20](https://vuldb.com/?ip.20.189.173.20) | - | - | High
|
||||
9 | [23.21.173.155](https://vuldb.com/?ip.23.21.173.155) | ec2-23-21-173-155.compute-1.amazonaws.com | - | Medium
|
||||
10 | [23.21.211.162](https://vuldb.com/?ip.23.21.211.162) | ec2-23-21-211-162.compute-1.amazonaws.com | - | Medium
|
||||
11 | [23.95.132.48](https://vuldb.com/?ip.23.95.132.48) | 23-95-132-48-host.colocrossing.com | - | High
|
||||
12 | [23.205.105.153](https://vuldb.com/?ip.23.205.105.153) | a23-205-105-153.deploy.static.akamaitechnologies.com | - | High
|
||||
13 | [23.205.105.157](https://vuldb.com/?ip.23.205.105.157) | a23-205-105-157.deploy.static.akamaitechnologies.com | - | High
|
||||
14 | [23.222.5.37](https://vuldb.com/?ip.23.222.5.37) | a23-222-5-37.deploy.static.akamaitechnologies.com | - | High
|
||||
15 | [31.41.46.120](https://vuldb.com/?ip.31.41.46.120) | maldova873.example.com | - | High
|
||||
16 | [31.220.52.219](https://vuldb.com/?ip.31.220.52.219) | workshop.piguno.com | - | High
|
||||
17 | [34.98.99.30](https://vuldb.com/?ip.34.98.99.30) | 30.99.98.34.bc.googleusercontent.com | - | Medium
|
||||
18 | [34.102.136.180](https://vuldb.com/?ip.34.102.136.180) | 180.136.102.34.bc.googleusercontent.com | - | Medium
|
||||
19 | [34.117.168.233](https://vuldb.com/?ip.34.117.168.233) | 233.168.117.34.bc.googleusercontent.com | - | Medium
|
||||
20 | [35.186.238.101](https://vuldb.com/?ip.35.186.238.101) | 101.238.186.35.bc.googleusercontent.com | - | Medium
|
||||
21 | [35.247.234.230](https://vuldb.com/?ip.35.247.234.230) | 230.234.247.35.bc.googleusercontent.com | - | Medium
|
||||
22 | [37.235.1.174](https://vuldb.com/?ip.37.235.1.174) | resolver1.freedns.zone.powered.by.virtexxa.com | - | High
|
||||
23 | [37.235.1.177](https://vuldb.com/?ip.37.235.1.177) | resolver2.freedns.zone.powered.by.virtexxa.com | - | High
|
||||
24 | [45.33.83.75](https://vuldb.com/?ip.45.33.83.75) | li1029-75.members.linode.com | - | High
|
||||
25 | [45.122.138.6](https://vuldb.com/?ip.45.122.138.6) | - | - | High
|
||||
26 | [45.128.184.132](https://vuldb.com/?ip.45.128.184.132) | vds107519.mgn-host.ru | - | High
|
||||
27 | [45.147.229.85](https://vuldb.com/?ip.45.147.229.85) | - | - | High
|
||||
28 | [45.154.253.150](https://vuldb.com/?ip.45.154.253.150) | shared04.cust05.proxy.is | - | High
|
||||
29 | ... | ... | ... | ...
|
||||
|
||||
There are 278 more IOC items available. Please use our online service to access the data.
|
||||
There are 112 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
_Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK techniques used by _Lokibot_. This data is unique as it uses our predictive model for actor profiling.
|
||||
_Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK techniques used by _LokiBot_. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
2 | T1068 | CWE-264, CWE-266, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-307, CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 6 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
These _indicators of attack_ (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Lokibot. This data is unique as it uses our predictive model for actor profiling.
|
||||
These _indicators of attack_ (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by LokiBot. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/.ssh/authorized_keys` | High
|
||||
2 | File | `//proc/kcore` | Medium
|
||||
3 | File | `/Ap4RtpAtom.cpp` | High
|
||||
4 | File | `/bcms/admin/?page=user/list` | High
|
||||
5 | File | `/bsms/?page=manage_account` | High
|
||||
6 | File | `/cgi-bin/login.cgi` | High
|
||||
7 | File | `/cgi-bin/luci/api/auth` | High
|
||||
8 | File | `/cgi-bin/luci/api/diagnose` | High
|
||||
9 | File | `/CMD_ACCOUNT_ADMIN` | High
|
||||
10 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
11 | File | `/core/admin/categories.php` | High
|
||||
12 | File | `/dashboard/reports/logs/view` | High
|
||||
13 | File | `/debug/pprof` | Medium
|
||||
14 | File | `/etc/config/image_sign` | High
|
||||
15 | File | `/etc/groups` | Medium
|
||||
16 | File | `/forum/away.php` | High
|
||||
17 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
18 | File | `/fuel/sitevariables/delete/4` | High
|
||||
19 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
20 | File | `/index/jobfairol/show/` | High
|
||||
21 | File | `/librarian/bookdetails.php` | High
|
||||
22 | File | `/mgmt/tm/util/bash` | High
|
||||
23 | File | `/MTFWU` | Low
|
||||
24 | File | `/php/passport/index.php` | High
|
||||
25 | File | `/public/login.htm` | High
|
||||
26 | File | `/public/plugins/` | High
|
||||
27 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
28 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
29 | File | `/setting/setDeviceName` | High
|
||||
30 | ... | ... | ...
|
||||
1 | File | `/.env` | Low
|
||||
2 | File | `/.ssh/authorized_keys` | High
|
||||
3 | File | `/car.php` | Medium
|
||||
4 | File | `/CMD_ACCOUNT_ADMIN` | High
|
||||
5 | File | `/config/getuser` | High
|
||||
6 | File | `/core/admin/categories.php` | High
|
||||
7 | File | `/dashboards/#` | High
|
||||
8 | File | `/etc/controller-agent/agent.conf` | High
|
||||
9 | File | `/etc/postfix/sender_login` | High
|
||||
10 | File | `/etc/sudoers` | Medium
|
||||
11 | File | `/etc/tomcat8/Catalina/attack` | High
|
||||
12 | File | `/filemanager/php/connector.php` | High
|
||||
13 | File | `/forum/away.php` | High
|
||||
14 | File | `/fudforum/adm/hlplist.php` | High
|
||||
15 | File | `/GponForm/fsetup_Form` | High
|
||||
16 | File | `/log_download.cgi` | High
|
||||
17 | File | `/modules/profile/index.php` | High
|
||||
18 | File | `/MTFWU` | Low
|
||||
19 | File | `/out.php` | Medium
|
||||
20 | File | `/public/plugins/` | High
|
||||
21 | File | `/s/` | Low
|
||||
22 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
23 | File | `/server-info` | Medium
|
||||
24 | File | `/tmp` | Low
|
||||
25 | File | `/tmp/app/.env` | High
|
||||
26 | File | `/tmp/kamailio_ctl` | High
|
||||
27 | File | `/tmp/kamailio_fifo` | High
|
||||
28 | File | `/uncpath/` | Medium
|
||||
29 | File | `/updown/upload.cgi` | High
|
||||
30 | File | `/usr/bin/pkexec` | High
|
||||
31 | File | `/way4acs/enroll` | High
|
||||
32 | File | `/WEB-INF/web.xml` | High
|
||||
33 | File | `/wp-json/wc/v3/webhooks` | High
|
||||
34 | ... | ... | ...
|
||||
|
||||
There are 257 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 290 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
The following list contains _external sources_ which discuss the actor and the associated activities:
|
||||
|
||||
* https://blog.talosintelligence.com/2019/04/threat-source-april-18-new-attacks.html
|
||||
* https://blog.talosintelligence.com/2019/05/threat-roundup-0524-0531.html
|
||||
* https://blog.talosintelligence.com/2019/06/threat-roundup-0531-0607.html
|
||||
* https://blog.talosintelligence.com/2019/06/threat-roundup-0621-0628.html
|
||||
* https://blog.talosintelligence.com/2019/07/threat-roundup-0719-0726.html
|
||||
* https://blog.talosintelligence.com/2019/10/threat-roundup-1011-1018.html
|
||||
* https://blog.talosintelligence.com/2019/11/threat-roundup-1025-1101.html
|
||||
* https://blog.talosintelligence.com/2019/12/threat-roundup-1129-1206.html
|
||||
* https://blog.talosintelligence.com/2020/04/threat-roundup-0410-0417.html
|
||||
* https://blog.talosintelligence.com/2020/07/threat-roundup-0703-0710.html
|
||||
* https://blog.talosintelligence.com/2020/07/threat-roundup-0710-0717.html
|
||||
* https://blog.talosintelligence.com/2020/08/threat-roundup-0807-0814.html
|
||||
* https://blog.talosintelligence.com/2020/08/tru-0731-0807.html
|
||||
* https://blog.talosintelligence.com/2020/10/threat-roundup-1016-1023.html
|
||||
* https://blog.talosintelligence.com/2020/10/threat-roundup-1023-1030.html
|
||||
* https://blog.talosintelligence.com/2020/11/threat-roundup-1113-1120.html
|
||||
* https://blog.talosintelligence.com/2021/04/threat-roundup-0423-0430.html
|
||||
* https://blog.talosintelligence.com/2021/06/threat-roundup-0604-0611.html
|
||||
* https://blog.talosintelligence.com/2021/07/threat-roundup-0716-0723.html
|
||||
|
@ -179,12 +126,6 @@ The following list contains _external sources_ which discuss the actor and the a
|
|||
* https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html
|
||||
* https://blog.talosintelligence.com/2022/03/threat-roundup-0304-0311.html
|
||||
* https://blog.talosintelligence.com/2022/03/threat-roundup-0311-0318.html
|
||||
* https://blog.talosintelligence.com/2022/04/threat-roundup-0401-0408.html
|
||||
* https://blog.talosintelligence.com/2022/04/threat-roundup-0408-0415.html
|
||||
* https://blog.talosintelligence.com/2022/05/threat-roundup-0429-0506.html
|
||||
* https://blog.talosintelligence.com/2022/05/threat-roundup-0506-0513.html
|
||||
* https://isc.sans.edu/forums/diary/3+examples+of+malspam+pushing+LokiBot+malware/23317/
|
||||
* https://isc.sans.edu/forums/diary/HSBCthemed+malspam+uses+ISO+attachments+to+push+Loki+Bot+malware/22942/
|
||||
* https://isc.sans.edu/forums/diary/Malspam+pushing+Lokibot+malware/24372/
|
||||
* https://isc.sans.edu/forums/diary/More+malspam+pushing+Lokibot/23754/
|
||||
* https://vxug.fakedoma.in/archive/APTs/2021/2021.01.06(1)/LokiBot%20Infection%20Chain.pdf
|
||||
|
|
|
@ -10,10 +10,10 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [IT](https://vuldb.com/?country.it)
|
||||
* [RU](https://vuldb.com/?country.ru)
|
||||
* ...
|
||||
|
||||
There are 10 more country items available. Please use our online service to access the data.
|
||||
There are 11 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -52,10 +52,10 @@ ID | Technique | Weakness | Description | Confidence
|
|||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294, CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 17 more TTP items available. Please use our online service to access the data.
|
||||
There are 18 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -63,42 +63,32 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `../FILEDIR` | Medium
|
||||
2 | File | `/(((a\2)|(a*)\g</-1>/))*/` | High
|
||||
3 | File | `//proc/kcore` | Medium
|
||||
4 | File | `/admin.php/pic/admin/type/del` | High
|
||||
5 | File | `/admin.php/vod/admin/topic/del` | High
|
||||
6 | File | `/admin.php?p=/User/index` | High
|
||||
7 | File | `/admin/communitymanagement.php` | High
|
||||
8 | File | `/admin/conferences/get-all-status/` | High
|
||||
9 | File | `/Ap4RtpAtom.cpp` | High
|
||||
10 | File | `/bcms/admin/?page=user/list` | High
|
||||
11 | File | `/bcms/admin/?page=user/manage_user` | High
|
||||
12 | File | `/bcms/admin/services/view_service.php` | High
|
||||
13 | File | `/bsms/?page=manage_account` | High
|
||||
14 | File | `/cardo/api` | Medium
|
||||
15 | File | `/cgi-bin/login.cgi` | High
|
||||
16 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
17 | File | `/classes/Master.php?f=delete_train` | High
|
||||
18 | File | `/company` | Medium
|
||||
19 | File | `/dashboard/reports/logs/view` | High
|
||||
20 | File | `/debug/pprof` | Medium
|
||||
21 | File | `/ecrire` | Low
|
||||
22 | File | `/eris/admin/applicants/index.php?view=view` | High
|
||||
23 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
24 | File | `/fuel/sitevariables/delete/4` | High
|
||||
25 | File | `/getImage` | Medium
|
||||
26 | File | `/goform/aspForm` | High
|
||||
27 | File | `/hprms/admin/?page=patients/view_patient` | High
|
||||
28 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
29 | File | `/hprms/admin/patients/manage_patient.php` | High
|
||||
30 | File | `/index/jobfairol/show/` | High
|
||||
31 | File | `/librarian/bookdetails.php` | High
|
||||
32 | File | `/lists/admin/` | High
|
||||
33 | File | `/mgmt/tm/util/bash` | High
|
||||
34 | ... | ... | ...
|
||||
1 | File | `/(((a\2)|(a*)\g</-1>/))*/` | High
|
||||
2 | File | `//proc/kcore` | Medium
|
||||
3 | File | `/admin/communitymanagement.php` | High
|
||||
4 | File | `/admin/conferences/get-all-status/` | High
|
||||
5 | File | `/Ap4RtpAtom.cpp` | High
|
||||
6 | File | `/app/options.py` | High
|
||||
7 | File | `/bin/posix/src/ports/POSIX/OpENer` | High
|
||||
8 | File | `/bsms/?page=manage_account` | High
|
||||
9 | File | `/cgi-bin/login.cgi` | High
|
||||
10 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
11 | File | `/classes/Master.php?f=delete_train` | High
|
||||
12 | File | `/company` | Medium
|
||||
13 | File | `/conf/` | Low
|
||||
14 | File | `/dashboard/reports/logs/view` | High
|
||||
15 | File | `/etc/hosts` | Medium
|
||||
16 | File | `/fuel/sitevariables/delete/4` | High
|
||||
17 | File | `/getImage` | Medium
|
||||
18 | File | `/hprms/admin/?page=patients/view_patient` | High
|
||||
19 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
20 | File | `/hprms/admin/patients/manage_patient.php` | High
|
||||
21 | File | `/index/jobfairol/show/` | High
|
||||
22 | File | `/librarian/bookdetails.php` | High
|
||||
23 | File | `/ordering/admin/store/index.php?view=edit` | High
|
||||
24 | ... | ... | ...
|
||||
|
||||
There are 287 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 203 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -16,12 +16,12 @@ The following _campaigns_ are known and can be associated with Mirai:
|
|||
|
||||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Mirai:
|
||||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* ...
|
||||
|
||||
There are 5 more country items available. Please use our online service to access the data.
|
||||
There are 12 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -48,13 +48,14 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23, CWE-425 | Pathname Traversal | High
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23, CWE-36 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294, CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 18 more TTP items available. Please use our online service to access the data.
|
||||
There are 21 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -62,41 +63,34 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/.dbus-keyrings` | High
|
||||
2 | File | `/.env` | Low
|
||||
3 | File | `//proc/kcore` | Medium
|
||||
4 | File | `/admin.php/Label/page_del` | High
|
||||
5 | File | `/admin.php/vod/admin/topic/del` | High
|
||||
6 | File | `/admin/?page=system_info/contact_info` | High
|
||||
7 | File | `/admin/comn/service/update.json` | High
|
||||
8 | File | `/admin/dl_sendmail.php` | High
|
||||
9 | File | `/admin/dl_sendsms.php` | High
|
||||
10 | File | `/Ap4RtpAtom.cpp` | High
|
||||
11 | File | `/api/part_categories` | High
|
||||
12 | File | `/api/programs/orgUnits?programs` | High
|
||||
13 | File | `/api/user/userData?userCode=admin` | High
|
||||
14 | File | `/asms/classes/Master.php?f=save_product` | High
|
||||
15 | File | `/bcms/admin/?page=reports/daily_court_rental_report` | High
|
||||
16 | File | `/bsms/?page=manage_account` | High
|
||||
17 | File | `/cgi-bin/login.cgi` | High
|
||||
18 | File | `/checklogin.jsp` | High
|
||||
1 | File | `.forward` | Medium
|
||||
2 | File | `/.dbus-keyrings` | High
|
||||
3 | File | `/admin/communitymanagement.php` | High
|
||||
4 | File | `/admin/dl_sendmail.php` | High
|
||||
5 | File | `/admin/extended` | High
|
||||
6 | File | `/admin/featured.php` | High
|
||||
7 | File | `/admin/generalsettings.php` | High
|
||||
8 | File | `/admin/newsletter1.php` | High
|
||||
9 | File | `/admin/payment.php` | High
|
||||
10 | File | `/admin/photo.php` | High
|
||||
11 | File | `/admin/renewaldue.php` | High
|
||||
12 | File | `/admin/success_story.php` | High
|
||||
13 | File | `/admin/usermanagement.php` | High
|
||||
14 | File | `/AgilePointServer/Extension/FetchUsingEncodedData` | High
|
||||
15 | File | `/api/user/userData?userCode=admin` | High
|
||||
16 | File | `/app/options.py` | High
|
||||
17 | File | `/bsms/?page=manage_account` | High
|
||||
18 | File | `/cgi-bin/login.cgi` | High
|
||||
19 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
20 | File | `/classes/Master.php?f=delete_reservation` | High
|
||||
21 | File | `/classes/Master.php?f=delete_schedule` | High
|
||||
22 | File | `/company` | Medium
|
||||
23 | File | `/company/service/increment/add/im` | High
|
||||
24 | File | `/dashboard/reports/logs/view` | High
|
||||
25 | File | `/dashboard/system/express/entities/forms/save_control/[GUID]` | High
|
||||
26 | File | `/debug/pprof` | Medium
|
||||
27 | File | `/dl/dl_sendmail.php` | High
|
||||
28 | File | `/fuel/sitevariables/delete/4` | High
|
||||
29 | File | `/goform/aspForm` | High
|
||||
30 | File | `/goform/saveParentControlInfo` | High
|
||||
31 | File | `/goform/SetClientState` | High
|
||||
32 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
33 | ... | ... | ...
|
||||
20 | File | `/ci_spms/admin/search/searching/` | High
|
||||
21 | File | `/ci_ssms/index.php/orders/create` | High
|
||||
22 | File | `/classes/Master.php?f=delete_reservation` | High
|
||||
23 | File | `/classes/Master.php?f=delete_schedule` | High
|
||||
24 | File | `/company` | Medium
|
||||
25 | File | `/company/service/increment/add/im` | High
|
||||
26 | ... | ... | ...
|
||||
|
||||
There are 277 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 219 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -26,6 +26,14 @@ ID | IP address | Hostname | Campaign | Confidence
|
|||
2 | [95.169.196.52](https://vuldb.com/?ip.95.169.196.52) | - | - | High
|
||||
3 | [185.206.180.138](https://vuldb.com/?ip.185.206.180.138) | 25.http-proxy2.cloudns.net | - | High
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
_Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK techniques used by _Moses Staff_. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1592 | CWE-200 | Configuration | High
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
These _indicators of attack_ (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Moses Staff. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
|
|
@ -21,10 +21,10 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
|
||||
* [JP](https://vuldb.com/?country.jp)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [FR](https://vuldb.com/?country.fr)
|
||||
* ...
|
||||
|
||||
There are 10 more country items available. Please use our online service to access the data.
|
||||
There are 12 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -56,12 +56,14 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 7 more TTP items available. Please use our online service to access the data.
|
||||
There are 22 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -69,36 +71,41 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/admin.php/pic/admin/lists/zhuan` | High
|
||||
2 | File | `/admin/?page=system_info/contact_info` | High
|
||||
3 | File | `/admin/new-content` | High
|
||||
4 | File | `/ad_js.php` | Medium
|
||||
5 | File | `/backups/` | Medium
|
||||
6 | File | `/bcms/admin/?page=user/list` | High
|
||||
7 | File | `/blog/blog.php` | High
|
||||
8 | File | `/cardo/api` | Medium
|
||||
9 | File | `/cgi-bin/login.cgi` | High
|
||||
10 | File | `/cgi-bin/luci/api/auth` | High
|
||||
11 | File | `/cgi-bin/luci/api/diagnose` | High
|
||||
12 | File | `/cgi-bin/luci/api/switch` | High
|
||||
13 | File | `/cgi-bin/luci/api/wireless` | High
|
||||
14 | File | `/cgi-mod/lookup.cgi` | High
|
||||
15 | File | `/edit-db.php` | Medium
|
||||
16 | File | `/etc/networkd-dispatcher` | High
|
||||
17 | File | `/etc/shadow.sample` | High
|
||||
18 | File | `/fantasticblog/single.php` | High
|
||||
19 | File | `/goform/AdvSetLanIp` | High
|
||||
20 | File | `/goform/editassignment` | High
|
||||
21 | File | `/goform/form2IPQoSTcAdd` | High
|
||||
22 | File | `/goform/saveParentControlInfo` | High
|
||||
23 | File | `/goform/setDeviceSettings` | High
|
||||
24 | File | `/goform/SetFirewallCfg` | High
|
||||
25 | File | `/goform/setMacFilterCfg` | High
|
||||
26 | File | `/goform/SetNetControlList` | High
|
||||
27 | File | `/goform/setNetworkLan` | High
|
||||
28 | ... | ... | ...
|
||||
1 | File | `//` | Low
|
||||
2 | File | `/about.php` | Medium
|
||||
3 | File | `/adm/setmain.php` | High
|
||||
4 | File | `/admin.php/pic/admin/lists/zhuan` | High
|
||||
5 | File | `/admin/` | Low
|
||||
6 | File | `/admin/?page=inmates/view_inmate` | High
|
||||
7 | File | `/admin/?page=system_info/contact_info` | High
|
||||
8 | File | `/admin/cms.php` | High
|
||||
9 | File | `/admin/conferences/get-all-status/` | High
|
||||
10 | File | `/admin/conferences/list/` | High
|
||||
11 | File | `/admin/countrymanagement.php` | High
|
||||
12 | File | `/admin/edit_admin_details.php?id=admin` | High
|
||||
13 | File | `/admin/featured.php` | High
|
||||
14 | File | `/admin/general.cgi` | High
|
||||
15 | File | `/admin/general/change-lang` | High
|
||||
16 | File | `/admin/googleads.php` | High
|
||||
17 | File | `/admin/group/list/` | High
|
||||
18 | File | `/admin/newsletter1.php` | High
|
||||
19 | File | `/admin/photo.php` | High
|
||||
20 | File | `/admin/renewaldue.php` | High
|
||||
21 | File | `/admin/scheprofile.cgi` | High
|
||||
22 | File | `/admin/searchview.php` | High
|
||||
23 | File | `/admin/service/stop/` | High
|
||||
24 | File | `/admin/sign/out` | High
|
||||
25 | File | `/admin/usermanagement.php` | High
|
||||
26 | File | `/Ap4RtpAtom.cpp` | High
|
||||
27 | File | `/api/user/userData?userCode=admin` | High
|
||||
28 | File | `/backups/` | Medium
|
||||
29 | File | `/bcms/admin/?page=user/list` | High
|
||||
30 | File | `/cardo/api` | Medium
|
||||
31 | File | `/cgi-bin/ExportAllSettings.sh` | High
|
||||
32 | File | `/cgi-bin/kerbynet` | High
|
||||
33 | ... | ... | ...
|
||||
|
||||
There are 232 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 277 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -90,7 +90,7 @@ ID | Type | Indicator | Confidence
|
|||
17 | File | `/uploads/dede` | High
|
||||
18 | ... | ... | ...
|
||||
|
||||
There are 144 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 148 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -9,6 +9,8 @@ _Live data_ and more _analysis capabilities_ are available at [https://vuldb.com
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Necurs:
|
||||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [FR](https://vuldb.com/?country.fr)
|
||||
* [GB](https://vuldb.com/?country.gb)
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -17,11 +19,26 @@ These _indicators of compromise_ (IOC) indicate associated network resources whi
|
|||
ID | IP address | Hostname | Campaign | Confidence
|
||||
-- | ---------- | -------- | -------- | ----------
|
||||
1 | [40.121.206.97](https://vuldb.com/?ip.40.121.206.97) | - | - | High
|
||||
2 | [64.47.209.23](https://vuldb.com/?ip.64.47.209.23) | - | - | High
|
||||
3 | [64.63.188.85](https://vuldb.com/?ip.64.63.188.85) | - | - | High
|
||||
2 | [62.212.154.98](https://vuldb.com/?ip.62.212.154.98) | ns1.crossdns.com | - | High
|
||||
3 | [64.47.209.23](https://vuldb.com/?ip.64.47.209.23) | - | - | High
|
||||
4 | [64.63.188.85](https://vuldb.com/?ip.64.63.188.85) | - | - | High
|
||||
5 | [64.231.250.149](https://vuldb.com/?ip.64.231.250.149) | bas3-toronto12-64-231-250-149.dsl.bell.ca | - | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 20 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
_Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK techniques used by _Necurs_. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
3 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 10 more IOC items available. Please use our online service to access the data.
|
||||
There are 4 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -29,14 +46,22 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/goform/login` | High
|
||||
2 | Network Port | `Web Server Port` | High
|
||||
1 | File | `/forum/away.php` | High
|
||||
2 | File | `/goform/login` | High
|
||||
3 | File | `addentry.php` | Medium
|
||||
4 | File | `addressbook.php` | High
|
||||
5 | ... | ... | ...
|
||||
|
||||
There are 28 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
The following list contains _external sources_ which discuss the actor and the associated activities:
|
||||
|
||||
* https://blog.talosintelligence.com/2018/01/threat-round-up-1229-0105.html
|
||||
* https://github.com/firehol/blocklist-ipsets/blob/master/bambenek_necurs.ipset
|
||||
* https://isc.sans.edu/forums/diary/Exploit+kits+delivering+Necurs/19719/
|
||||
* https://isc.sans.edu/forums/diary/Necurs+Botnet+malspam+pushes+Locky+using+DDE+attack/22946/
|
||||
|
||||
## Literature
|
||||
|
||||
|
|
|
@ -34,12 +34,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 4 more TTP items available. Please use our online service to access the data.
|
||||
There are 14 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -15,11 +15,11 @@ The following _campaigns_ are known and can be associated with Phorpiex:
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Phorpiex:
|
||||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [ID](https://vuldb.com/?country.id)
|
||||
* [GB](https://vuldb.com/?country.gb)
|
||||
* [JP](https://vuldb.com/?country.jp)
|
||||
* ...
|
||||
|
||||
There are 6 more country items available. Please use our online service to access the data.
|
||||
There are 14 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -30,21 +30,37 @@ ID | IP address | Hostname | Campaign | Confidence
|
|||
1 | [2.61.176.216](https://vuldb.com/?ip.2.61.176.216) | dynamic-2-61-176-216.pppoe.khakasnet.ru | - | High
|
||||
2 | [2.184.139.149](https://vuldb.com/?ip.2.184.139.149) | - | - | High
|
||||
3 | [5.232.28.65](https://vuldb.com/?ip.5.232.28.65) | - | - | High
|
||||
4 | [20.72.235.82](https://vuldb.com/?ip.20.72.235.82) | - | - | High
|
||||
5 | [20.109.209.108](https://vuldb.com/?ip.20.109.209.108) | - | - | High
|
||||
6 | [31.59.189.4](https://vuldb.com/?ip.31.59.189.4) | 31-59-189-4.shatel.ir | - | High
|
||||
7 | [37.255.99.93](https://vuldb.com/?ip.37.255.99.93) | - | - | High
|
||||
8 | [39.41.234.182](https://vuldb.com/?ip.39.41.234.182) | - | - | High
|
||||
9 | [42.248.182.125](https://vuldb.com/?ip.42.248.182.125) | - | - | High
|
||||
10 | [42.248.182.234](https://vuldb.com/?ip.42.248.182.234) | - | - | High
|
||||
11 | [42.248.183.250](https://vuldb.com/?ip.42.248.183.250) | - | - | High
|
||||
12 | [46.70.200.184](https://vuldb.com/?ip.46.70.200.184) | - | - | High
|
||||
13 | [46.224.180.246](https://vuldb.com/?ip.46.224.180.246) | - | - | High
|
||||
14 | [46.225.106.121](https://vuldb.com/?ip.46.225.106.121) | - | - | High
|
||||
15 | [63.251.106.25](https://vuldb.com/?ip.63.251.106.25) | - | - | High
|
||||
16 | ... | ... | ... | ...
|
||||
4 | [7.5.7.7](https://vuldb.com/?ip.7.5.7.7) | - | - | High
|
||||
5 | [17.42.251.10](https://vuldb.com/?ip.17.42.251.10) | mx01.mail.icloud.com | - | High
|
||||
6 | [20.72.235.82](https://vuldb.com/?ip.20.72.235.82) | - | - | High
|
||||
7 | [20.109.209.108](https://vuldb.com/?ip.20.109.209.108) | - | - | High
|
||||
8 | [20.206.235.31](https://vuldb.com/?ip.20.206.235.31) | - | - | High
|
||||
9 | [24.201.245.37](https://vuldb.com/?ip.24.201.245.37) | mx.videotron.ca | - | High
|
||||
10 | [31.59.189.4](https://vuldb.com/?ip.31.59.189.4) | 31-59-189-4.shatel.ir | - | High
|
||||
11 | [34.212.80.54](https://vuldb.com/?ip.34.212.80.54) | cxr.mx.a.cloudfilter.net | - | High
|
||||
12 | [35.45.98.140](https://vuldb.com/?ip.35.45.98.140) | - | - | High
|
||||
13 | [35.205.61.67](https://vuldb.com/?ip.35.205.61.67) | 67.61.205.35.bc.googleusercontent.com | - | Medium
|
||||
14 | [35.225.160.245](https://vuldb.com/?ip.35.225.160.245) | 245.160.225.35.bc.googleusercontent.com | - | Medium
|
||||
15 | [37.255.99.93](https://vuldb.com/?ip.37.255.99.93) | - | - | High
|
||||
16 | [39.41.234.182](https://vuldb.com/?ip.39.41.234.182) | - | - | High
|
||||
17 | [42.248.182.125](https://vuldb.com/?ip.42.248.182.125) | - | - | High
|
||||
18 | [42.248.182.234](https://vuldb.com/?ip.42.248.182.234) | - | - | High
|
||||
19 | [42.248.183.250](https://vuldb.com/?ip.42.248.183.250) | - | - | High
|
||||
20 | [46.70.200.184](https://vuldb.com/?ip.46.70.200.184) | - | - | High
|
||||
21 | [46.224.180.246](https://vuldb.com/?ip.46.224.180.246) | - | - | High
|
||||
22 | [46.225.106.121](https://vuldb.com/?ip.46.225.106.121) | - | - | High
|
||||
23 | [57.197.27.187](https://vuldb.com/?ip.57.197.27.187) | - | - | High
|
||||
24 | [58.74.224.218](https://vuldb.com/?ip.58.74.224.218) | - | - | High
|
||||
25 | [60.162.101.123](https://vuldb.com/?ip.60.162.101.123) | - | - | High
|
||||
26 | [63.251.106.25](https://vuldb.com/?ip.63.251.106.25) | - | - | High
|
||||
27 | [64.8.70.104](https://vuldb.com/?ip.64.8.70.104) | mx.tds.net | - | High
|
||||
28 | [64.98.36.4](https://vuldb.com/?ip.64.98.36.4) | mx.b.hostedemail.com | - | High
|
||||
29 | [64.136.44.37](https://vuldb.com/?ip.64.136.44.37) | mx.dca.untd.com | - | High
|
||||
30 | [66.199.229.251](https://vuldb.com/?ip.66.199.229.251) | 66-199-229-251.reverse.ezzi.net | - | High
|
||||
31 | [66.218.85.151](https://vuldb.com/?ip.66.218.85.151) | unknown.yahoo.com | - | High
|
||||
32 | ... | ... | ... | ...
|
||||
|
||||
There are 60 more IOC items available. Please use our online service to access the data.
|
||||
There are 125 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
|
@ -52,12 +68,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1222 | CWE-275 | Permission Issues | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 1 more TTP items available. Please use our online service to access the data.
|
||||
There are 10 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -65,26 +81,35 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/forum/away.php` | High
|
||||
2 | File | `/plugin` | Low
|
||||
3 | File | `/services/details.asp` | High
|
||||
4 | File | `/way4acs/enroll` | High
|
||||
5 | File | `ajax/api/hook/decodeArguments` | High
|
||||
6 | File | `bin/named/query.c` | High
|
||||
7 | File | `blocking.asp` | Medium
|
||||
8 | ... | ... | ...
|
||||
1 | File | `/cloud_config/router_post/get_reset_pwd_veirfy_code` | High
|
||||
2 | File | `/etc/tomcat8/Catalina/attack` | High
|
||||
3 | File | `/index.php` | Medium
|
||||
4 | File | `/proc/pid/attr` | High
|
||||
5 | File | `/RestAPI` | Medium
|
||||
6 | File | `/service/upload` | High
|
||||
7 | File | `/wp-admin/admin-ajax.php` | High
|
||||
8 | File | `admin.php` | Medium
|
||||
9 | File | `admin/conf_users_edit.php` | High
|
||||
10 | ... | ... | ...
|
||||
|
||||
There are 54 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 77 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
The following list contains _external sources_ which discuss the actor and the associated activities:
|
||||
|
||||
* https://blog.talosintelligence.com/2019/09/threat-roundup-0830-0906.html
|
||||
* https://blog.talosintelligence.com/2019/11/threat-roundup-1101-1108.html
|
||||
* https://blog.talosintelligence.com/2019/12/threat-roundup-1129-1206.html
|
||||
* https://blog.talosintelligence.com/2020/11/threat-roundup-1030-1106.html
|
||||
* https://blog.talosintelligence.com/2020/12/threat-roundup-1211-1218.html
|
||||
* https://blog.talosintelligence.com/2021/01/threat-roundup-0115-0122.html
|
||||
* https://blog.talosintelligence.com/2021/04/threat-roundup-0326-0402.html
|
||||
* https://blog.talosintelligence.com/2021/04/threat-roundup-0416-0423.html
|
||||
* https://blog.talosintelligence.com/2021/05/threat-roundup-0430-0507.html
|
||||
* https://blog.talosintelligence.com/2021/08/threat-roundup-0820-0827.html
|
||||
* https://blog.talosintelligence.com/2022/02/threat-roundup-0211-0218.html
|
||||
* https://blog.talosintelligence.com/2022/07/threat-roundup-0701-0708.html
|
||||
* https://research.checkpoint.com/2019/in-the-footsteps-of-a-sextortion-campaign/
|
||||
* https://research.checkpoint.com/2019/phorpiex-breakdown/
|
||||
* https://research.checkpoint.com/2021/phorpiex-botnet-is-back-with-a-new-twizt-hijacking-hundreds-of-crypto-transactions/
|
||||
|
|
|
@ -40,8 +40,11 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-284 | Execution with Unnecessary Privileges | High
|
||||
2 | T1068 | CWE-269, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1587.003 | CWE-297 | Improper Certificate Validation | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 1 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -54,7 +57,7 @@ ID | Type | Indicator | Confidence
|
|||
3 | File | `admin/conf_users_edit.php` | High
|
||||
4 | ... | ... | ...
|
||||
|
||||
There are 6 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 7 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -42,12 +42,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-307, CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 7 more TTP items available. Please use our online service to access the data.
|
||||
There are 17 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -101,7 +102,7 @@ ID | Type | Indicator | Confidence
|
|||
44 | File | `admin/admin/fileUploadAction_fileUpload.action` | High
|
||||
45 | ... | ... | ...
|
||||
|
||||
There are 390 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 392 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -34,8 +34,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 6 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -46,9 +46,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1600 | CWE-310 | Cryptographic Issues | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 10 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -66,7 +69,7 @@ ID | Type | Indicator | Confidence
|
|||
8 | File | `/zm/index.php` | High
|
||||
9 | ... | ... | ...
|
||||
|
||||
There are 61 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 63 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -27,12 +27,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1008 | CWE-757 | Algorithm Downgrade | High
|
||||
2 | T1040 | CWE-294 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294, CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 8 more TTP items available. Please use our online service to access the data.
|
||||
There are 17 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -68,7 +69,7 @@ ID | Type | Indicator | Confidence
|
|||
26 | File | `base/ErrorHandler.php` | High
|
||||
27 | ... | ... | ...
|
||||
|
||||
There are 225 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 224 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -15,11 +15,11 @@ The following _campaigns_ are known and can be associated with Prophet Spider:
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Prophet Spider:
|
||||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [SC](https://vuldb.com/?country.sc)
|
||||
* [DE](https://vuldb.com/?country.de)
|
||||
* [PT](https://vuldb.com/?country.pt)
|
||||
* [RU](https://vuldb.com/?country.ru)
|
||||
* ...
|
||||
|
||||
There are 1 more country items available. Please use our online service to access the data.
|
||||
There are 9 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -46,14 +46,14 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294, CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-24 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 19 more TTP items available. Please use our online service to access the data.
|
||||
There are 20 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -61,37 +61,27 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/action/import_https_cert_file/` | High
|
||||
2 | File | `/action/remove/` | High
|
||||
3 | File | `/admin/edit_admin_details.php?id=admin` | High
|
||||
4 | File | `/admin/featured.php` | High
|
||||
5 | File | `/admin/scheprofile.cgi` | High
|
||||
6 | File | `/admin/showbad.php` | High
|
||||
7 | File | `/admin/ztliuyan_sendmail.php` | High
|
||||
8 | File | `/ajax/config_rollback/` | High
|
||||
9 | File | `/ajax/set_sys_time/` | High
|
||||
10 | File | `/alarm_pi/alarmService.php` | High
|
||||
11 | File | `/application/controllers/Users.php` | High
|
||||
12 | File | `/cgi-bin/webproc` | High
|
||||
13 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
14 | File | `/ci_hms/search` | High
|
||||
15 | File | `/classes/Master.php?f=delete_schedule` | High
|
||||
16 | File | `/company` | Medium
|
||||
17 | File | `/company/account/safety/trade` | High
|
||||
18 | File | `/company/service/increment/add/im` | High
|
||||
19 | File | `/dashboard/blocks/stacks/view_details/` | High
|
||||
20 | File | `/dashboard/reports/logs/view` | High
|
||||
21 | File | `/dashboard/snapshot/*?orgId=0` | High
|
||||
22 | File | `/dashboard/system/express/entities/forms/save_control/[GUID]` | High
|
||||
23 | File | `/dl/dl_sendmail.php` | High
|
||||
24 | File | `/dl/dl_sendsms.php` | High
|
||||
25 | File | `/home/campus/campus_job` | High
|
||||
26 | File | `/home/job/index` | High
|
||||
27 | File | `/images/background/1.php` | High
|
||||
28 | File | `/irj/servlet/prt/portal/prtroot/com.sap.portal.usermanagement.admin.UserMapping` | High
|
||||
29 | ... | ... | ...
|
||||
1 | File | `/.ssh/authorized_keys2` | High
|
||||
2 | File | `/AgilePointServer/Extension/FetchUsingEncodedData` | High
|
||||
3 | File | `/ajax/remove_sniffer_raw_log/` | High
|
||||
4 | File | `/api/sys_username_passwd.cmd` | High
|
||||
5 | File | `/app/options.py` | High
|
||||
6 | File | `/auth/callback` | High
|
||||
7 | File | `/bin/posix/src/ports/POSIX/OpENer` | High
|
||||
8 | File | `/cgi-bin/nobody` | High
|
||||
9 | File | `/ci_spms/admin/category` | High
|
||||
10 | File | `/ci_spms/admin/search/searching/` | High
|
||||
11 | File | `/conf/` | Low
|
||||
12 | File | `/dashboard/menu-list.php` | High
|
||||
13 | File | `/dashboard/profile.php` | High
|
||||
14 | File | `/dashboard/table-list.php` | High
|
||||
15 | File | `/dev/pts/` | Medium
|
||||
16 | File | `/etc/lighttpd.d/ca.pem` | High
|
||||
17 | File | `/etc/passwd` | Medium
|
||||
18 | File | `/etc/shadow` | Medium
|
||||
19 | ... | ... | ...
|
||||
|
||||
There are 241 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 153 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
File diff suppressed because it is too large
Load Diff
|
@ -39,12 +39,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 6 more TTP items available. Please use our online service to access the data.
|
||||
There are 16 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -4,52 +4,183 @@ These _indicators_ were reported, collected, and generated during the [VulDB CTI
|
|||
|
||||
_Live data_ and more _analysis capabilities_ are available at [https://vuldb.com/?actor.razy](https://vuldb.com/?actor.razy)
|
||||
|
||||
## Countries
|
||||
|
||||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Razy:
|
||||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [FR](https://vuldb.com/?country.fr)
|
||||
* ...
|
||||
|
||||
There are 1 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
These _indicators of compromise_ (IOC) indicate associated network resources which are known to be part of research and attack activities of Razy.
|
||||
|
||||
ID | IP address | Hostname | Campaign | Confidence
|
||||
-- | ---------- | -------- | -------- | ----------
|
||||
1 | [8.248.157.254](https://vuldb.com/?ip.8.248.157.254) | - | - | High
|
||||
2 | [8.248.161.254](https://vuldb.com/?ip.8.248.161.254) | - | - | High
|
||||
3 | [8.249.223.254](https://vuldb.com/?ip.8.249.223.254) | - | - | High
|
||||
4 | [8.249.241.254](https://vuldb.com/?ip.8.249.241.254) | - | - | High
|
||||
5 | [13.107.21.200](https://vuldb.com/?ip.13.107.21.200) | - | - | High
|
||||
6 | [13.249.53.63](https://vuldb.com/?ip.13.249.53.63) | server-13-249-53-63.iah50.r.cloudfront.net | - | High
|
||||
7 | [14.215.177.34](https://vuldb.com/?ip.14.215.177.34) | - | - | High
|
||||
8 | [20.42.65.92](https://vuldb.com/?ip.20.42.65.92) | - | - | High
|
||||
9 | [23.3.13.154](https://vuldb.com/?ip.23.3.13.154) | a23-3-13-154.deploy.static.akamaitechnologies.com | - | High
|
||||
10 | [23.21.252.4](https://vuldb.com/?ip.23.21.252.4) | ec2-23-21-252-4.compute-1.amazonaws.com | - | Medium
|
||||
11 | [23.199.63.11](https://vuldb.com/?ip.23.199.63.11) | a23-199-63-11.deploy.static.akamaitechnologies.com | - | High
|
||||
12 | [23.199.63.83](https://vuldb.com/?ip.23.199.63.83) | a23-199-63-83.deploy.static.akamaitechnologies.com | - | High
|
||||
13 | [35.205.61.67](https://vuldb.com/?ip.35.205.61.67) | 67.61.205.35.bc.googleusercontent.com | - | Medium
|
||||
14 | [37.187.179.73](https://vuldb.com/?ip.37.187.179.73) | vps-48dadaca.vps.ovh.net | - | High
|
||||
15 | [37.228.108.132](https://vuldb.com/?ip.37.228.108.132) | lati.autoupdate.opera.com | - | High
|
||||
16 | [40.76.4.15](https://vuldb.com/?ip.40.76.4.15) | - | - | High
|
||||
17 | [40.112.72.205](https://vuldb.com/?ip.40.112.72.205) | - | - | High
|
||||
18 | [40.113.200.201](https://vuldb.com/?ip.40.113.200.201) | - | - | High
|
||||
19 | [45.139.236.6](https://vuldb.com/?ip.45.139.236.6) | - | - | High
|
||||
20 | [47.91.170.222](https://vuldb.com/?ip.47.91.170.222) | - | - | High
|
||||
21 | [50.19.96.218](https://vuldb.com/?ip.50.19.96.218) | ec2-50-19-96-218.compute-1.amazonaws.com | - | Medium
|
||||
22 | [52.232.252.84](https://vuldb.com/?ip.52.232.252.84) | - | - | High
|
||||
23 | [54.225.155.11](https://vuldb.com/?ip.54.225.155.11) | ec2-54-225-155-11.compute-1.amazonaws.com | - | Medium
|
||||
24 | [54.225.157.230](https://vuldb.com/?ip.54.225.157.230) | ec2-54-225-157-230.compute-1.amazonaws.com | - | Medium
|
||||
25 | [54.225.165.85](https://vuldb.com/?ip.54.225.165.85) | ec2-54-225-165-85.compute-1.amazonaws.com | - | Medium
|
||||
26 | [58.215.145.98](https://vuldb.com/?ip.58.215.145.98) | - | - | High
|
||||
27 | [58.215.145.108](https://vuldb.com/?ip.58.215.145.108) | - | - | High
|
||||
28 | [58.216.118.224](https://vuldb.com/?ip.58.216.118.224) | - | - | High
|
||||
29 | [58.216.118.225](https://vuldb.com/?ip.58.216.118.225) | - | - | High
|
||||
30 | [58.216.118.228](https://vuldb.com/?ip.58.216.118.228) | - | - | High
|
||||
31 | [58.216.118.229](https://vuldb.com/?ip.58.216.118.229) | - | - | High
|
||||
32 | ... | ... | ... | ...
|
||||
1 | [1.2.4.8](https://vuldb.com/?ip.1.2.4.8) | public1.sdns.cn | - | High
|
||||
2 | [3.13.191.225](https://vuldb.com/?ip.3.13.191.225) | ec2-3-13-191-225.us-east-2.compute.amazonaws.com | - | Medium
|
||||
3 | [3.14.182.203](https://vuldb.com/?ip.3.14.182.203) | ec2-3-14-182-203.us-east-2.compute.amazonaws.com | - | Medium
|
||||
4 | [3.17.7.232](https://vuldb.com/?ip.3.17.7.232) | ec2-3-17-7-232.us-east-2.compute.amazonaws.com | - | Medium
|
||||
5 | [3.124.142.205](https://vuldb.com/?ip.3.124.142.205) | ec2-3-124-142-205.eu-central-1.compute.amazonaws.com | - | Medium
|
||||
6 | [3.125.102.39](https://vuldb.com/?ip.3.125.102.39) | ec2-3-125-102-39.eu-central-1.compute.amazonaws.com | - | Medium
|
||||
7 | [3.125.223.134](https://vuldb.com/?ip.3.125.223.134) | ec2-3-125-223-134.eu-central-1.compute.amazonaws.com | - | Medium
|
||||
8 | [3.134.39.220](https://vuldb.com/?ip.3.134.39.220) | ec2-3-134-39-220.us-east-2.compute.amazonaws.com | - | Medium
|
||||
9 | [3.134.125.175](https://vuldb.com/?ip.3.134.125.175) | ec2-3-134-125-175.us-east-2.compute.amazonaws.com | - | Medium
|
||||
10 | [5.45.17.36](https://vuldb.com/?ip.5.45.17.36) | - | - | High
|
||||
11 | [5.45.100.132](https://vuldb.com/?ip.5.45.100.132) | v2202201129253174276.happysrv.de | - | High
|
||||
12 | [5.45.107.160](https://vuldb.com/?ip.5.45.107.160) | ptr.160.107.45.5.static.yourvserver.net | - | High
|
||||
13 | [5.45.107.164](https://vuldb.com/?ip.5.45.107.164) | v220200750311122910.nicesrv.de | - | High
|
||||
14 | [5.45.208.36](https://vuldb.com/?ip.5.45.208.36) | proxy-minsk03.cdn.yandex.net | - | High
|
||||
15 | [5.101.191.51](https://vuldb.com/?ip.5.101.191.51) | - | - | High
|
||||
16 | [5.231.208.172](https://vuldb.com/?ip.5.231.208.172) | virtualmedica.com | - | High
|
||||
17 | [8.248.157.254](https://vuldb.com/?ip.8.248.157.254) | - | - | High
|
||||
18 | [8.248.161.254](https://vuldb.com/?ip.8.248.161.254) | - | - | High
|
||||
19 | [8.249.223.254](https://vuldb.com/?ip.8.249.223.254) | - | - | High
|
||||
20 | [8.249.241.254](https://vuldb.com/?ip.8.249.241.254) | - | - | High
|
||||
21 | [12.153.224.22](https://vuldb.com/?ip.12.153.224.22) | origin-www.etrade.com | - | High
|
||||
22 | [13.107.4.50](https://vuldb.com/?ip.13.107.4.50) | - | - | High
|
||||
23 | [13.107.21.200](https://vuldb.com/?ip.13.107.21.200) | - | - | High
|
||||
24 | [13.249.53.63](https://vuldb.com/?ip.13.249.53.63) | server-13-249-53-63.iah50.r.cloudfront.net | - | High
|
||||
25 | [14.215.177.34](https://vuldb.com/?ip.14.215.177.34) | - | - | High
|
||||
26 | [17.253.144.10](https://vuldb.com/?ip.17.253.144.10) | apple.com.co | - | High
|
||||
27 | [20.42.65.92](https://vuldb.com/?ip.20.42.65.92) | - | - | High
|
||||
28 | [20.53.203.50](https://vuldb.com/?ip.20.53.203.50) | - | - | High
|
||||
29 | [20.81.111.85](https://vuldb.com/?ip.20.81.111.85) | - | - | High
|
||||
30 | [20.84.181.62](https://vuldb.com/?ip.20.84.181.62) | - | - | High
|
||||
31 | [20.103.85.33](https://vuldb.com/?ip.20.103.85.33) | - | - | High
|
||||
32 | [20.112.52.29](https://vuldb.com/?ip.20.112.52.29) | - | - | High
|
||||
33 | [23.3.13.88](https://vuldb.com/?ip.23.3.13.88) | a23-3-13-88.deploy.static.akamaitechnologies.com | - | High
|
||||
34 | [23.3.13.154](https://vuldb.com/?ip.23.3.13.154) | a23-3-13-154.deploy.static.akamaitechnologies.com | - | High
|
||||
35 | [23.21.109.69](https://vuldb.com/?ip.23.21.109.69) | ec2-23-21-109-69.compute-1.amazonaws.com | - | Medium
|
||||
36 | [23.21.252.4](https://vuldb.com/?ip.23.21.252.4) | ec2-23-21-252-4.compute-1.amazonaws.com | - | Medium
|
||||
37 | [23.46.238.193](https://vuldb.com/?ip.23.46.238.193) | a23-46-238-193.deploy.static.akamaitechnologies.com | - | High
|
||||
38 | [23.199.63.11](https://vuldb.com/?ip.23.199.63.11) | a23-199-63-11.deploy.static.akamaitechnologies.com | - | High
|
||||
39 | [23.199.63.83](https://vuldb.com/?ip.23.199.63.83) | a23-199-63-83.deploy.static.akamaitechnologies.com | - | High
|
||||
40 | [23.219.88.98](https://vuldb.com/?ip.23.219.88.98) | a23-219-88-98.deploy.static.akamaitechnologies.com | - | High
|
||||
41 | [23.221.72.41](https://vuldb.com/?ip.23.221.72.41) | a23-221-72-41.deploy.static.akamaitechnologies.com | - | High
|
||||
42 | [23.225.15.164](https://vuldb.com/?ip.23.225.15.164) | - | - | High
|
||||
43 | [31.13.65.36](https://vuldb.com/?ip.31.13.65.36) | edge-star-mini-shv-01-atl3.facebook.com | - | High
|
||||
44 | [31.13.65.174](https://vuldb.com/?ip.31.13.65.174) | instagram-p42-shv-01-atl3.fbcdn.net | - | High
|
||||
45 | [31.31.196.199](https://vuldb.com/?ip.31.31.196.199) | sbx42.hosting.reg.ru | - | High
|
||||
46 | [35.205.61.67](https://vuldb.com/?ip.35.205.61.67) | 67.61.205.35.bc.googleusercontent.com | - | Medium
|
||||
47 | [37.187.179.73](https://vuldb.com/?ip.37.187.179.73) | vps-48dadaca.vps.ovh.net | - | High
|
||||
48 | [37.228.108.132](https://vuldb.com/?ip.37.228.108.132) | lati.autoupdate.opera.com | - | High
|
||||
49 | [37.235.1.174](https://vuldb.com/?ip.37.235.1.174) | resolver1.freedns.zone.powered.by.virtexxa.com | - | High
|
||||
50 | [37.235.1.177](https://vuldb.com/?ip.37.235.1.177) | resolver2.freedns.zone.powered.by.virtexxa.com | - | High
|
||||
51 | [40.76.4.15](https://vuldb.com/?ip.40.76.4.15) | - | - | High
|
||||
52 | [40.112.72.205](https://vuldb.com/?ip.40.112.72.205) | - | - | High
|
||||
53 | [40.113.200.201](https://vuldb.com/?ip.40.113.200.201) | - | - | High
|
||||
54 | [45.139.236.6](https://vuldb.com/?ip.45.139.236.6) | - | - | High
|
||||
55 | [45.142.214.109](https://vuldb.com/?ip.45.142.214.109) | 4ser-1626242994.4server.su | - | High
|
||||
56 | [45.147.229.28](https://vuldb.com/?ip.45.147.229.28) | - | - | High
|
||||
57 | [45.147.229.198](https://vuldb.com/?ip.45.147.229.198) | - | - | High
|
||||
58 | [45.153.186.90](https://vuldb.com/?ip.45.153.186.90) | ip-45-153-186-90-64959.vps.hosted-by-mvps.net | - | High
|
||||
59 | [46.4.119.208](https://vuldb.com/?ip.46.4.119.208) | static.208.119.4.46.clients.your-server.de | - | High
|
||||
60 | [47.91.170.222](https://vuldb.com/?ip.47.91.170.222) | - | - | High
|
||||
61 | [50.19.96.218](https://vuldb.com/?ip.50.19.96.218) | ec2-50-19-96-218.compute-1.amazonaws.com | - | Medium
|
||||
62 | [50.19.252.36](https://vuldb.com/?ip.50.19.252.36) | ec2-50-19-252-36.compute-1.amazonaws.com | - | Medium
|
||||
63 | [51.15.40.85](https://vuldb.com/?ip.51.15.40.85) | 85-40-15-51.instances.scw.cloud | - | High
|
||||
64 | [51.89.19.244](https://vuldb.com/?ip.51.89.19.244) | hosted-by.100up.net | - | High
|
||||
65 | [52.232.252.84](https://vuldb.com/?ip.52.232.252.84) | - | - | High
|
||||
66 | [54.225.155.11](https://vuldb.com/?ip.54.225.155.11) | ec2-54-225-155-11.compute-1.amazonaws.com | - | Medium
|
||||
67 | [54.225.157.230](https://vuldb.com/?ip.54.225.157.230) | ec2-54-225-157-230.compute-1.amazonaws.com | - | Medium
|
||||
68 | [54.225.165.85](https://vuldb.com/?ip.54.225.165.85) | ec2-54-225-165-85.compute-1.amazonaws.com | - | Medium
|
||||
69 | [58.215.145.98](https://vuldb.com/?ip.58.215.145.98) | - | - | High
|
||||
70 | [58.215.145.108](https://vuldb.com/?ip.58.215.145.108) | - | - | High
|
||||
71 | [58.216.118.224](https://vuldb.com/?ip.58.216.118.224) | - | - | High
|
||||
72 | ... | ... | ... | ...
|
||||
|
||||
There are 123 more IOC items available. Please use our online service to access the data.
|
||||
There are 282 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
_Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK techniques used by _Razy_. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 14 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
These _indicators of attack_ (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Razy. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `.htpasswd` | Medium
|
||||
2 | File | `/../conf/config.properties` | High
|
||||
3 | File | `/drivers/infiniband/core/cm.c` | High
|
||||
4 | File | `/files.md5` | Medium
|
||||
5 | File | `/forum/away.php` | High
|
||||
6 | File | `/horde/util/go.php` | High
|
||||
7 | File | `/images/` | Medium
|
||||
8 | File | `/inc/parser/xhtml.php` | High
|
||||
9 | File | `/login` | Low
|
||||
10 | File | `/modules/profile/index.php` | High
|
||||
11 | File | `/one_church/userregister.php` | High
|
||||
12 | File | `/out.php` | Medium
|
||||
13 | File | `/public/plugins/` | High
|
||||
14 | File | `/SAP_Information_System/controllers/add_admin.php` | High
|
||||
15 | File | `/SASWebReportStudio/logonAndRender.do` | High
|
||||
16 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
17 | File | `/secure/admin/ViewInstrumentation.jspa` | High
|
||||
18 | File | `/system/proxy` | High
|
||||
19 | File | `/tmp/phpglibccheck` | High
|
||||
20 | File | `/v2/quantum/save-data-upload-big-file` | High
|
||||
21 | File | `4.edu.php` | Medium
|
||||
22 | File | `adclick.php` | Medium
|
||||
23 | File | `add.php` | Low
|
||||
24 | File | `addentry.php` | Medium
|
||||
25 | File | `addressbookprovider.php` | High
|
||||
26 | File | `admin.jcomments.php` | High
|
||||
27 | File | `admin/pageUploadCSV.php` | High
|
||||
28 | File | `ajax_udf.php` | Medium
|
||||
29 | File | `AppCompatCache.exe` | High
|
||||
30 | File | `application.js.php` | High
|
||||
31 | ... | ... | ...
|
||||
|
||||
There are 261 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
The following list contains _external sources_ which discuss the actor and the associated activities:
|
||||
|
||||
* https://blog.talosintelligence.com/2018/07/threat-roundup-0629-0706.html
|
||||
* https://blog.talosintelligence.com/2018/07/threat-roundup-0713-0720.html
|
||||
* https://blog.talosintelligence.com/2018/08/threat-roundup-0817-0824.html
|
||||
* https://blog.talosintelligence.com/2018/09/threat-roundup-0921-0928.html
|
||||
* https://blog.talosintelligence.com/2018/10/threat-roundup-0928-1005.html
|
||||
* https://blog.talosintelligence.com/2019/01/threat-roundup-0118-0125.html
|
||||
* https://blog.talosintelligence.com/2019/02/threat-roundup-0125-0201.html
|
||||
* https://blog.talosintelligence.com/2019/02/threat-roundup-for-feb-15-to-feb-22.html
|
||||
* https://blog.talosintelligence.com/2019/04/threat-roundup-0412-0419.html
|
||||
* https://blog.talosintelligence.com/2019/05/threat-roundup-0517-0524.html
|
||||
* https://blog.talosintelligence.com/2019/08/threat-roundup-0816-0823.html
|
||||
* https://blog.talosintelligence.com/2019/12/threat-roundup-1206-1213.html
|
||||
* https://blog.talosintelligence.com/2019/12/threat-roundup-1213-1220.html
|
||||
* https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html
|
||||
* https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html
|
||||
* https://blog.talosintelligence.com/2020/02/threat-roundup-0214-0221.html
|
||||
* https://blog.talosintelligence.com/2020/04/threat-roundup-0403-0410.html
|
||||
* https://blog.talosintelligence.com/2020/04/threat-roundup-0410-0417.html
|
||||
* https://blog.talosintelligence.com/2020/07/threat-roundup-0703-0710.html
|
||||
* https://blog.talosintelligence.com/2020/09/threat-roundup-0904-0911.html
|
||||
* https://blog.talosintelligence.com/2020/10/threat-roundup-1002-1009.html
|
||||
* https://blog.talosintelligence.com/2020/10/threat-roundup-1009-1016.html
|
||||
* https://blog.talosintelligence.com/2020/10/threat-roundup-1016-1023.html
|
||||
* https://blog.talosintelligence.com/2020/11/threat-roundup-1106-1113.html
|
||||
* https://blog.talosintelligence.com/2020/12/threat-roundup-1204-1211.html
|
||||
* https://blog.talosintelligence.com/2020/12/threat-roundup-1211-1218.html
|
||||
* https://blog.talosintelligence.com/2021/01/threat-roundup-0115-0122.html
|
||||
* https://blog.talosintelligence.com/2021/02/threat-roundup-0129-0205.html
|
||||
* https://blog.talosintelligence.com/2021/02/threat-roundup-0205-0212.html
|
||||
* https://blog.talosintelligence.com/2021/03/threat-roundup-0226-0305.html
|
||||
|
@ -72,6 +203,8 @@ The following list contains _external sources_ which discuss the actor and the a
|
|||
* https://blog.talosintelligence.com/2022/01/threat-roundup-0107-0114.html
|
||||
* https://blog.talosintelligence.com/2022/03/threat-roundup-0304-0311.html
|
||||
* https://blog.talosintelligence.com/2022/03/threat-roundup-0311-0318.html
|
||||
* https://blog.talosintelligence.com/2022/06/threat-roundup-0527-0603.html
|
||||
* https://blog.talosintelligence.com/2022/06/threat-roundup-0617-0624.html
|
||||
|
||||
## Literature
|
||||
|
||||
|
|
|
@ -27,88 +27,97 @@ These _indicators of compromise_ (IOC) indicate associated network resources whi
|
|||
|
||||
ID | IP address | Hostname | Campaign | Confidence
|
||||
-- | ---------- | -------- | -------- | ----------
|
||||
1 | [3.94.41.167](https://vuldb.com/?ip.3.94.41.167) | ec2-3-94-41-167.compute-1.amazonaws.com | - | Medium
|
||||
2 | [5.61.37.41](https://vuldb.com/?ip.5.61.37.41) | - | - | High
|
||||
3 | [5.181.234.139](https://vuldb.com/?ip.5.181.234.139) | - | - | High
|
||||
4 | [5.181.234.145](https://vuldb.com/?ip.5.181.234.145) | - | - | High
|
||||
5 | [5.249.226.166](https://vuldb.com/?ip.5.249.226.166) | uw19.uniweb.no | - | High
|
||||
6 | [8.253.139.120](https://vuldb.com/?ip.8.253.139.120) | - | - | High
|
||||
7 | [13.107.21.200](https://vuldb.com/?ip.13.107.21.200) | - | - | High
|
||||
8 | [13.107.42.12](https://vuldb.com/?ip.13.107.42.12) | 1drv.ms | - | High
|
||||
9 | [13.107.42.13](https://vuldb.com/?ip.13.107.42.13) | - | - | High
|
||||
10 | [13.107.43.12](https://vuldb.com/?ip.13.107.43.12) | - | - | High
|
||||
11 | [13.107.43.13](https://vuldb.com/?ip.13.107.43.13) | - | - | High
|
||||
12 | [13.225.230.20](https://vuldb.com/?ip.13.225.230.20) | server-13-225-230-20.jfk51.r.cloudfront.net | - | High
|
||||
13 | [13.250.255.10](https://vuldb.com/?ip.13.250.255.10) | ec2-13-250-255-10.ap-southeast-1.compute.amazonaws.com | - | Medium
|
||||
14 | [15.197.142.173](https://vuldb.com/?ip.15.197.142.173) | a4ec4c6ea1c92e2e6.awsglobalaccelerator.com | - | High
|
||||
15 | [18.214.132.216](https://vuldb.com/?ip.18.214.132.216) | ec2-18-214-132-216.compute-1.amazonaws.com | - | Medium
|
||||
16 | [20.36.253.92](https://vuldb.com/?ip.20.36.253.92) | - | - | High
|
||||
17 | [20.42.73.27](https://vuldb.com/?ip.20.42.73.27) | - | - | High
|
||||
18 | [20.190.151.7](https://vuldb.com/?ip.20.190.151.7) | - | - | High
|
||||
19 | [20.190.151.8](https://vuldb.com/?ip.20.190.151.8) | - | - | High
|
||||
20 | [20.190.151.68](https://vuldb.com/?ip.20.190.151.68) | - | - | High
|
||||
21 | [20.190.151.70](https://vuldb.com/?ip.20.190.151.70) | - | - | High
|
||||
22 | [20.190.151.131](https://vuldb.com/?ip.20.190.151.131) | - | - | High
|
||||
23 | [20.190.151.132](https://vuldb.com/?ip.20.190.151.132) | - | - | High
|
||||
24 | [20.190.151.133](https://vuldb.com/?ip.20.190.151.133) | - | - | High
|
||||
25 | [20.190.152.21](https://vuldb.com/?ip.20.190.152.21) | - | - | High
|
||||
26 | [20.190.154.139](https://vuldb.com/?ip.20.190.154.139) | - | - | High
|
||||
27 | [23.3.13.88](https://vuldb.com/?ip.23.3.13.88) | a23-3-13-88.deploy.static.akamaitechnologies.com | - | High
|
||||
28 | [23.3.13.154](https://vuldb.com/?ip.23.3.13.154) | a23-3-13-154.deploy.static.akamaitechnologies.com | - | High
|
||||
29 | [23.21.27.29](https://vuldb.com/?ip.23.21.27.29) | ec2-23-21-27-29.compute-1.amazonaws.com | - | Medium
|
||||
30 | [23.21.205.229](https://vuldb.com/?ip.23.21.205.229) | ec2-23-21-205-229.compute-1.amazonaws.com | - | Medium
|
||||
31 | [23.21.213.140](https://vuldb.com/?ip.23.21.213.140) | ec2-23-21-213-140.compute-1.amazonaws.com | - | Medium
|
||||
32 | [23.38.131.139](https://vuldb.com/?ip.23.38.131.139) | a23-38-131-139.deploy.static.akamaitechnologies.com | - | High
|
||||
33 | [23.46.239.18](https://vuldb.com/?ip.23.46.239.18) | a23-46-239-18.deploy.static.akamaitechnologies.com | - | High
|
||||
34 | [23.56.9.181](https://vuldb.com/?ip.23.56.9.181) | a23-56-9-181.deploy.static.akamaitechnologies.com | - | High
|
||||
35 | [23.78.173.83](https://vuldb.com/?ip.23.78.173.83) | a23-78-173-83.deploy.static.akamaitechnologies.com | - | High
|
||||
36 | [23.82.12.29](https://vuldb.com/?ip.23.82.12.29) | - | - | High
|
||||
37 | [23.105.131.209](https://vuldb.com/?ip.23.105.131.209) | - | - | High
|
||||
38 | [23.196.74.222](https://vuldb.com/?ip.23.196.74.222) | a23-196-74-222.deploy.static.akamaitechnologies.com | - | High
|
||||
39 | [23.199.63.11](https://vuldb.com/?ip.23.199.63.11) | a23-199-63-11.deploy.static.akamaitechnologies.com | - | High
|
||||
40 | [23.199.63.83](https://vuldb.com/?ip.23.199.63.83) | a23-199-63-83.deploy.static.akamaitechnologies.com | - | High
|
||||
41 | [23.223.37.181](https://vuldb.com/?ip.23.223.37.181) | a23-223-37-181.deploy.static.akamaitechnologies.com | - | High
|
||||
42 | [23.227.38.74](https://vuldb.com/?ip.23.227.38.74) | - | - | High
|
||||
43 | [34.96.116.138](https://vuldb.com/?ip.34.96.116.138) | 138.116.96.34.bc.googleusercontent.com | - | Medium
|
||||
44 | [34.102.136.180](https://vuldb.com/?ip.34.102.136.180) | 180.136.102.34.bc.googleusercontent.com | - | Medium
|
||||
45 | [34.117.168.233](https://vuldb.com/?ip.34.117.168.233) | 233.168.117.34.bc.googleusercontent.com | - | Medium
|
||||
46 | [34.192.250.175](https://vuldb.com/?ip.34.192.250.175) | ec2-34-192-250-175.compute-1.amazonaws.com | - | Medium
|
||||
47 | [34.197.12.81](https://vuldb.com/?ip.34.197.12.81) | ec2-34-197-12-81.compute-1.amazonaws.com | - | Medium
|
||||
48 | [34.202.33.33](https://vuldb.com/?ip.34.202.33.33) | ec2-34-202-33-33.compute-1.amazonaws.com | - | Medium
|
||||
49 | [35.205.61.67](https://vuldb.com/?ip.35.205.61.67) | 67.61.205.35.bc.googleusercontent.com | - | Medium
|
||||
50 | [35.214.144.124](https://vuldb.com/?ip.35.214.144.124) | 124.144.214.35.bc.googleusercontent.com | - | Medium
|
||||
51 | [37.1.206.16](https://vuldb.com/?ip.37.1.206.16) | free.ispiria.net | - | High
|
||||
52 | [37.19.193.217](https://vuldb.com/?ip.37.19.193.217) | unn-37-19-193-217.cdn77.com | - | High
|
||||
53 | [37.120.138.222](https://vuldb.com/?ip.37.120.138.222) | - | - | High
|
||||
54 | [37.123.118.150](https://vuldb.com/?ip.37.123.118.150) | - | - | High
|
||||
55 | [37.139.64.106](https://vuldb.com/?ip.37.139.64.106) | - | - | High
|
||||
56 | [37.230.130.153](https://vuldb.com/?ip.37.230.130.153) | - | - | High
|
||||
57 | [37.235.1.174](https://vuldb.com/?ip.37.235.1.174) | resolver1.freedns.zone.powered.by.virtexxa.com | - | High
|
||||
58 | [40.126.26.134](https://vuldb.com/?ip.40.126.26.134) | - | - | High
|
||||
59 | [40.126.28.12](https://vuldb.com/?ip.40.126.28.12) | - | - | High
|
||||
60 | [40.126.28.22](https://vuldb.com/?ip.40.126.28.22) | - | - | High
|
||||
61 | [44.230.27.49](https://vuldb.com/?ip.44.230.27.49) | ec2-44-230-27-49.us-west-2.compute.amazonaws.com | - | Medium
|
||||
62 | [44.238.161.76](https://vuldb.com/?ip.44.238.161.76) | ec2-44-238-161-76.us-west-2.compute.amazonaws.com | - | Medium
|
||||
63 | [45.15.143.148](https://vuldb.com/?ip.45.15.143.148) | - | - | High
|
||||
64 | [45.74.32.12](https://vuldb.com/?ip.45.74.32.12) | - | - | High
|
||||
65 | [45.95.168.62](https://vuldb.com/?ip.45.95.168.62) | maxko-hosting.com | - | High
|
||||
66 | [45.148.17.62](https://vuldb.com/?ip.45.148.17.62) | mail.spokel.se | - | High
|
||||
67 | [46.2.255.122](https://vuldb.com/?ip.46.2.255.122) | - | - | High
|
||||
68 | [46.105.127.143](https://vuldb.com/?ip.46.105.127.143) | ns385442.ip-46-105-127.eu | - | High
|
||||
69 | [46.243.147.194](https://vuldb.com/?ip.46.243.147.194) | - | - | High
|
||||
70 | [46.243.239.153](https://vuldb.com/?ip.46.243.239.153) | - | - | High
|
||||
71 | [46.243.249.150](https://vuldb.com/?ip.46.243.249.150) | - | - | High
|
||||
72 | [46.246.80.68](https://vuldb.com/?ip.46.246.80.68) | c-46-246-80-68.ip4.frootvpn.com | - | High
|
||||
73 | [47.254.172.117](https://vuldb.com/?ip.47.254.172.117) | - | - | High
|
||||
74 | [50.16.234.229](https://vuldb.com/?ip.50.16.234.229) | ec2-50-16-234-229.compute-1.amazonaws.com | - | Medium
|
||||
75 | [50.63.202.36](https://vuldb.com/?ip.50.63.202.36) | ip-50-63-202-36.ip.secureserver.net | - | High
|
||||
76 | [51.15.229.127](https://vuldb.com/?ip.51.15.229.127) | 127-229-15-51.instances.scw.cloud | - | High
|
||||
77 | [51.75.209.242](https://vuldb.com/?ip.51.75.209.242) | ip242.ip-51-75-209.eu | - | High
|
||||
78 | [51.91.236.193](https://vuldb.com/?ip.51.91.236.193) | cluster028.hosting.ovh.net | - | High
|
||||
79 | [51.103.16.165](https://vuldb.com/?ip.51.103.16.165) | - | - | High
|
||||
80 | ... | ... | ... | ...
|
||||
1 | [2.58.47.203](https://vuldb.com/?ip.2.58.47.203) | - | - | High
|
||||
2 | [3.13.31.214](https://vuldb.com/?ip.3.13.31.214) | ec2-3-13-31-214.us-east-2.compute.amazonaws.com | - | Medium
|
||||
3 | [3.64.163.50](https://vuldb.com/?ip.3.64.163.50) | ec2-3-64-163-50.eu-central-1.compute.amazonaws.com | - | Medium
|
||||
4 | [3.94.41.167](https://vuldb.com/?ip.3.94.41.167) | ec2-3-94-41-167.compute-1.amazonaws.com | - | Medium
|
||||
5 | [5.61.37.41](https://vuldb.com/?ip.5.61.37.41) | - | - | High
|
||||
6 | [5.181.234.139](https://vuldb.com/?ip.5.181.234.139) | - | - | High
|
||||
7 | [5.181.234.145](https://vuldb.com/?ip.5.181.234.145) | - | - | High
|
||||
8 | [5.249.226.166](https://vuldb.com/?ip.5.249.226.166) | uw19.uniweb.no | - | High
|
||||
9 | [8.253.139.120](https://vuldb.com/?ip.8.253.139.120) | - | - | High
|
||||
10 | [13.107.21.200](https://vuldb.com/?ip.13.107.21.200) | - | - | High
|
||||
11 | [13.107.42.12](https://vuldb.com/?ip.13.107.42.12) | 1drv.ms | - | High
|
||||
12 | [13.107.42.13](https://vuldb.com/?ip.13.107.42.13) | - | - | High
|
||||
13 | [13.107.43.12](https://vuldb.com/?ip.13.107.43.12) | - | - | High
|
||||
14 | [13.107.43.13](https://vuldb.com/?ip.13.107.43.13) | - | - | High
|
||||
15 | [13.225.230.20](https://vuldb.com/?ip.13.225.230.20) | server-13-225-230-20.jfk51.r.cloudfront.net | - | High
|
||||
16 | [13.250.255.10](https://vuldb.com/?ip.13.250.255.10) | ec2-13-250-255-10.ap-southeast-1.compute.amazonaws.com | - | Medium
|
||||
17 | [15.197.142.173](https://vuldb.com/?ip.15.197.142.173) | a4ec4c6ea1c92e2e6.awsglobalaccelerator.com | - | High
|
||||
18 | [18.214.132.216](https://vuldb.com/?ip.18.214.132.216) | ec2-18-214-132-216.compute-1.amazonaws.com | - | Medium
|
||||
19 | [20.36.253.92](https://vuldb.com/?ip.20.36.253.92) | - | - | High
|
||||
20 | [20.42.73.27](https://vuldb.com/?ip.20.42.73.27) | - | - | High
|
||||
21 | [20.106.94.110](https://vuldb.com/?ip.20.106.94.110) | - | - | High
|
||||
22 | [20.190.151.7](https://vuldb.com/?ip.20.190.151.7) | - | - | High
|
||||
23 | [20.190.151.8](https://vuldb.com/?ip.20.190.151.8) | - | - | High
|
||||
24 | [20.190.151.68](https://vuldb.com/?ip.20.190.151.68) | - | - | High
|
||||
25 | [20.190.151.70](https://vuldb.com/?ip.20.190.151.70) | - | - | High
|
||||
26 | [20.190.151.131](https://vuldb.com/?ip.20.190.151.131) | - | - | High
|
||||
27 | [20.190.151.132](https://vuldb.com/?ip.20.190.151.132) | - | - | High
|
||||
28 | [20.190.151.133](https://vuldb.com/?ip.20.190.151.133) | - | - | High
|
||||
29 | [20.190.152.21](https://vuldb.com/?ip.20.190.152.21) | - | - | High
|
||||
30 | [20.190.154.139](https://vuldb.com/?ip.20.190.154.139) | - | - | High
|
||||
31 | [23.3.13.88](https://vuldb.com/?ip.23.3.13.88) | a23-3-13-88.deploy.static.akamaitechnologies.com | - | High
|
||||
32 | [23.3.13.154](https://vuldb.com/?ip.23.3.13.154) | a23-3-13-154.deploy.static.akamaitechnologies.com | - | High
|
||||
33 | [23.21.27.29](https://vuldb.com/?ip.23.21.27.29) | ec2-23-21-27-29.compute-1.amazonaws.com | - | Medium
|
||||
34 | [23.21.205.229](https://vuldb.com/?ip.23.21.205.229) | ec2-23-21-205-229.compute-1.amazonaws.com | - | Medium
|
||||
35 | [23.21.213.140](https://vuldb.com/?ip.23.21.213.140) | ec2-23-21-213-140.compute-1.amazonaws.com | - | Medium
|
||||
36 | [23.38.131.139](https://vuldb.com/?ip.23.38.131.139) | a23-38-131-139.deploy.static.akamaitechnologies.com | - | High
|
||||
37 | [23.46.239.18](https://vuldb.com/?ip.23.46.239.18) | a23-46-239-18.deploy.static.akamaitechnologies.com | - | High
|
||||
38 | [23.56.9.181](https://vuldb.com/?ip.23.56.9.181) | a23-56-9-181.deploy.static.akamaitechnologies.com | - | High
|
||||
39 | [23.78.173.83](https://vuldb.com/?ip.23.78.173.83) | a23-78-173-83.deploy.static.akamaitechnologies.com | - | High
|
||||
40 | [23.82.12.29](https://vuldb.com/?ip.23.82.12.29) | - | - | High
|
||||
41 | [23.105.131.193](https://vuldb.com/?ip.23.105.131.193) | - | - | High
|
||||
42 | [23.105.131.209](https://vuldb.com/?ip.23.105.131.209) | - | - | High
|
||||
43 | [23.105.131.222](https://vuldb.com/?ip.23.105.131.222) | - | - | High
|
||||
44 | [23.196.74.222](https://vuldb.com/?ip.23.196.74.222) | a23-196-74-222.deploy.static.akamaitechnologies.com | - | High
|
||||
45 | [23.199.63.11](https://vuldb.com/?ip.23.199.63.11) | a23-199-63-11.deploy.static.akamaitechnologies.com | - | High
|
||||
46 | [23.199.63.83](https://vuldb.com/?ip.23.199.63.83) | a23-199-63-83.deploy.static.akamaitechnologies.com | - | High
|
||||
47 | [23.223.37.181](https://vuldb.com/?ip.23.223.37.181) | a23-223-37-181.deploy.static.akamaitechnologies.com | - | High
|
||||
48 | [23.227.38.74](https://vuldb.com/?ip.23.227.38.74) | - | - | High
|
||||
49 | [34.96.116.138](https://vuldb.com/?ip.34.96.116.138) | 138.116.96.34.bc.googleusercontent.com | - | Medium
|
||||
50 | [34.102.136.180](https://vuldb.com/?ip.34.102.136.180) | 180.136.102.34.bc.googleusercontent.com | - | Medium
|
||||
51 | [34.117.168.233](https://vuldb.com/?ip.34.117.168.233) | 233.168.117.34.bc.googleusercontent.com | - | Medium
|
||||
52 | [34.192.250.175](https://vuldb.com/?ip.34.192.250.175) | ec2-34-192-250-175.compute-1.amazonaws.com | - | Medium
|
||||
53 | [34.197.12.81](https://vuldb.com/?ip.34.197.12.81) | ec2-34-197-12-81.compute-1.amazonaws.com | - | Medium
|
||||
54 | [34.202.33.33](https://vuldb.com/?ip.34.202.33.33) | ec2-34-202-33-33.compute-1.amazonaws.com | - | Medium
|
||||
55 | [35.205.61.67](https://vuldb.com/?ip.35.205.61.67) | 67.61.205.35.bc.googleusercontent.com | - | Medium
|
||||
56 | [35.214.144.124](https://vuldb.com/?ip.35.214.144.124) | 124.144.214.35.bc.googleusercontent.com | - | Medium
|
||||
57 | [37.0.14.195](https://vuldb.com/?ip.37.0.14.195) | - | - | High
|
||||
58 | [37.0.14.217](https://vuldb.com/?ip.37.0.14.217) | - | - | High
|
||||
59 | [37.1.206.16](https://vuldb.com/?ip.37.1.206.16) | free.ispiria.net | - | High
|
||||
60 | [37.19.193.217](https://vuldb.com/?ip.37.19.193.217) | unn-37-19-193-217.cdn77.com | - | High
|
||||
61 | [37.120.138.222](https://vuldb.com/?ip.37.120.138.222) | - | - | High
|
||||
62 | [37.123.118.150](https://vuldb.com/?ip.37.123.118.150) | - | - | High
|
||||
63 | [37.139.64.106](https://vuldb.com/?ip.37.139.64.106) | - | - | High
|
||||
64 | [37.230.130.153](https://vuldb.com/?ip.37.230.130.153) | - | - | High
|
||||
65 | [37.235.1.174](https://vuldb.com/?ip.37.235.1.174) | resolver1.freedns.zone.powered.by.virtexxa.com | - | High
|
||||
66 | [40.126.26.134](https://vuldb.com/?ip.40.126.26.134) | - | - | High
|
||||
67 | [40.126.28.12](https://vuldb.com/?ip.40.126.28.12) | - | - | High
|
||||
68 | [40.126.28.22](https://vuldb.com/?ip.40.126.28.22) | - | - | High
|
||||
69 | [44.230.27.49](https://vuldb.com/?ip.44.230.27.49) | ec2-44-230-27-49.us-west-2.compute.amazonaws.com | - | Medium
|
||||
70 | [44.238.161.76](https://vuldb.com/?ip.44.238.161.76) | ec2-44-238-161-76.us-west-2.compute.amazonaws.com | - | Medium
|
||||
71 | [45.15.143.148](https://vuldb.com/?ip.45.15.143.148) | - | - | High
|
||||
72 | [45.74.32.12](https://vuldb.com/?ip.45.74.32.12) | - | - | High
|
||||
73 | [45.95.168.62](https://vuldb.com/?ip.45.95.168.62) | maxko-hosting.com | - | High
|
||||
74 | [45.133.174.177](https://vuldb.com/?ip.45.133.174.177) | - | - | High
|
||||
75 | [45.148.17.62](https://vuldb.com/?ip.45.148.17.62) | mail.spokel.se | - | High
|
||||
76 | [46.2.255.122](https://vuldb.com/?ip.46.2.255.122) | - | - | High
|
||||
77 | [46.105.127.143](https://vuldb.com/?ip.46.105.127.143) | ns385442.ip-46-105-127.eu | - | High
|
||||
78 | [46.243.147.194](https://vuldb.com/?ip.46.243.147.194) | - | - | High
|
||||
79 | [46.243.239.153](https://vuldb.com/?ip.46.243.239.153) | - | - | High
|
||||
80 | [46.243.249.150](https://vuldb.com/?ip.46.243.249.150) | - | - | High
|
||||
81 | [46.246.80.68](https://vuldb.com/?ip.46.246.80.68) | c-46-246-80-68.ip4.frootvpn.com | - | High
|
||||
82 | [47.254.172.117](https://vuldb.com/?ip.47.254.172.117) | - | - | High
|
||||
83 | [50.16.234.229](https://vuldb.com/?ip.50.16.234.229) | ec2-50-16-234-229.compute-1.amazonaws.com | - | Medium
|
||||
84 | [50.63.202.36](https://vuldb.com/?ip.50.63.202.36) | ip-50-63-202-36.ip.secureserver.net | - | High
|
||||
85 | [51.15.229.127](https://vuldb.com/?ip.51.15.229.127) | 127-229-15-51.instances.scw.cloud | - | High
|
||||
86 | [51.75.209.242](https://vuldb.com/?ip.51.75.209.242) | ip242.ip-51-75-209.eu | - | High
|
||||
87 | [51.91.236.193](https://vuldb.com/?ip.51.91.236.193) | cluster028.hosting.ovh.net | - | High
|
||||
88 | [51.103.16.165](https://vuldb.com/?ip.51.103.16.165) | - | - | High
|
||||
89 | ... | ... | ... | ...
|
||||
|
||||
There are 318 more IOC items available. Please use our online service to access the data.
|
||||
There are 351 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
|
@ -132,8 +141,8 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `.procmailrc` | Medium
|
||||
2 | File | `/anony/mjpg.cgi` | High
|
||||
3 | File | `/bin/mail` | Medium
|
||||
2 | File | `/admin/inquiries/view_details.php` | High
|
||||
3 | File | `/anony/mjpg.cgi` | High
|
||||
4 | File | `/blog/blog.php` | High
|
||||
5 | File | `/common/info.cgi` | High
|
||||
6 | File | `/data/vendor/tcl` | High
|
||||
|
@ -143,19 +152,20 @@ ID | Type | Indicator | Confidence
|
|||
10 | File | `/files.md5` | Medium
|
||||
11 | File | `/forum/away.php` | High
|
||||
12 | File | `/hy-cgi/devices.cgi` | High
|
||||
13 | File | `/include/chart_generator.php` | High
|
||||
14 | File | `/mgmt/tm/util/bash` | High
|
||||
15 | File | `/op/op.LockDocument.php` | High
|
||||
16 | File | `/plesk-site-preview/` | High
|
||||
17 | File | `/proc/self/setgroups` | High
|
||||
18 | File | `/proc/stat` | Medium
|
||||
19 | File | `/ram/pckg/security/nova/bin/ipsec` | High
|
||||
20 | File | `/rest/api/2/search` | High
|
||||
21 | File | `/rest/api/latest/projectvalidate/key` | High
|
||||
22 | File | `/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf` | High
|
||||
23 | ... | ... | ...
|
||||
13 | File | `/mgmt/tm/util/bash` | High
|
||||
14 | File | `/plesk-site-preview/` | High
|
||||
15 | File | `/plugin/jcapture/applet.php` | High
|
||||
16 | File | `/proc/self/setgroups` | High
|
||||
17 | File | `/proc/stat` | Medium
|
||||
18 | File | `/ram/pckg/security/nova/bin/ipsec` | High
|
||||
19 | File | `/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf` | High
|
||||
20 | File | `/uncpath/` | Medium
|
||||
21 | File | `/usr/bin/pkexec` | High
|
||||
22 | File | `/v2/quantum/save-data-upload-big-file` | High
|
||||
23 | File | `/webservices/api/v2.php` | High
|
||||
24 | ... | ... | ...
|
||||
|
||||
There are 191 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 200 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
@ -164,6 +174,7 @@ The following list contains _external sources_ which discuss the actor and the a
|
|||
* https://asec.ahnlab.com/en/31429/
|
||||
* https://asec.ahnlab.com/en/32085/
|
||||
* https://blog.morphisec.com/remcos-trojan-analyzing-attack-chain
|
||||
* https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities
|
||||
* https://blog.talosintelligence.com/2018/06/threat-roundup-0622-0629.html
|
||||
* https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html
|
||||
* https://blog.talosintelligence.com/2019/03/threat-roundup-0315-0322.html
|
||||
|
@ -205,10 +216,34 @@ The following list contains _external sources_ which discuss the actor and the a
|
|||
* https://blog.talosintelligence.com/2022/03/threat-roundup-0318-0325.html
|
||||
* https://blog.talosintelligence.com/2022/03/ukraine-invasion-scams-malware.html
|
||||
* https://blog.talosintelligence.com/2022/04/threat-roundup-0401-0408.html
|
||||
* https://blog.talosintelligence.com/2022/07/threat-roundup-0701-0708.html
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-08-17%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-08-19%20Remcos%20RAT%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-08-19%20Remcos%20RAT%20IOCs%202
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-09-15%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-10-12%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-11-04%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-12-06%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-12-08%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2021-12-16%20Remcos%20RAT%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-01-10%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-01-18%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-02-01%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-02-01%20Remcos%202%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-02-09%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-08%20Remcos_1%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-08%20Remcos_2%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-04-12%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-04-27%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-11%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-11%20Remcos%202%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-13%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-18%20Remcos_1%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-18%20Remcos_2%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-19%20Remcos%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-25%20Remcos%201%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-25%20Remcos%203%20IOCs
|
||||
* https://github.com/executemalware/Malware-IOCs/blob/main/2022-06-23%20Remcos%20IOCs
|
||||
* https://isc.sans.edu/forums/diary/Malspam+using+passwordprotected+Word+docs+to+push+Remcos+RAT/25292/
|
||||
* https://twitter.com/Paladin3161/status/1197842954037018625
|
||||
|
||||
|
|
|
@ -15,6 +15,7 @@ The following _campaigns_ are known and can be associated with Ripprbot:
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Ripprbot:
|
||||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -37,7 +38,7 @@ ID | Technique | Weakness | Description | Confidence
|
|||
3 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 11 more TTP items available. Please use our online service to access the data.
|
||||
There are 12 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -138,7 +139,7 @@ ID | Type | Indicator | Confidence
|
|||
91 | File | `config.php` | Medium
|
||||
92 | ... | ... | ...
|
||||
|
||||
There are 809 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 810 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -48,12 +48,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-307, CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 7 more TTP items available. Please use our online service to access the data.
|
||||
There are 18 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -61,55 +62,53 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `%PROGRAMDATA%\checkmk\agent\local` | High
|
||||
1 | File | `../FILEDIR` | Medium
|
||||
2 | File | `.htaccess` | Medium
|
||||
3 | File | `/#/CampaignManager/users` | High
|
||||
4 | File | `//` | Low
|
||||
5 | File | `/admin.php?action=themeinstall` | High
|
||||
6 | File | `/admin/?setting-base.htm` | High
|
||||
7 | File | `/admin/admin_login.php` | High
|
||||
8 | File | `/admin/ajax.php` | High
|
||||
9 | File | `/admin/login.php` | High
|
||||
10 | File | `/apply_noauth.cgi` | High
|
||||
11 | File | `/audit/log/log_management.php` | High
|
||||
12 | File | `/bin/login` | Medium
|
||||
13 | File | `/bin/sh` | Low
|
||||
14 | File | `/cgi-bin/login` | High
|
||||
15 | File | `/classes/profile.class.php` | High
|
||||
16 | File | `/debug/pprof` | Medium
|
||||
17 | File | `/dev/tty` | Medium
|
||||
18 | File | `/doorgets/app/requests/user/modulecategoryRequest.php` | High
|
||||
19 | File | `/downloads/` | Medium
|
||||
20 | File | `/goform/rlmswitchr_process` | High
|
||||
21 | File | `/goforms/rlminfo` | High
|
||||
22 | File | `/include/make.php` | High
|
||||
23 | File | `/index.php` | Medium
|
||||
24 | File | `/login` | Low
|
||||
25 | File | `/login.html` | Medium
|
||||
26 | File | `/magnoliaPublic/travel/members/login.html` | High
|
||||
27 | File | `/member/index/login.html` | High
|
||||
28 | File | `/modules/certinfo/index.php` | High
|
||||
4 | File | `/admin/admin_login.php` | High
|
||||
5 | File | `/admin/ajax.php` | High
|
||||
6 | File | `/admin/login.php` | High
|
||||
7 | File | `/bin/sh` | Low
|
||||
8 | File | `/CommunitySSORedirect.jsp` | High
|
||||
9 | File | `/ctpms/admin/?page=applications/view_application` | High
|
||||
10 | File | `/debug/pprof` | Medium
|
||||
11 | File | `/dev/tty` | Medium
|
||||
12 | File | `/doorgets/app/requests/user/modulecategoryRequest.php` | High
|
||||
13 | File | `/etc/quagga` | Medium
|
||||
14 | File | `/gaia-job-admin/user/add` | High
|
||||
15 | File | `/goform/rlmswitchr_process` | High
|
||||
16 | File | `/goforms/rlminfo` | High
|
||||
17 | File | `/HNAP1` | Low
|
||||
18 | File | `/include/make.php` | High
|
||||
19 | File | `/Items/*/RemoteImages/Download` | High
|
||||
20 | File | `/login` | Low
|
||||
21 | File | `/login.html` | Medium
|
||||
22 | File | `/magnoliaPublic/travel/members/login.html` | High
|
||||
23 | File | `/member/index/login.html` | High
|
||||
24 | File | `/ofrs/admin/?page=user/manage_user` | High
|
||||
25 | File | `/p1/p2/:name` | Medium
|
||||
26 | File | `/rdms/admin/?page=user/manage_user` | High
|
||||
27 | File | `/requests.php` | High
|
||||
28 | File | `/saml/login` | Medium
|
||||
29 | File | `/ScadaBR/login.htm` | High
|
||||
30 | File | `/system/tool/ping.php` | High
|
||||
31 | File | `/tmp/swhks.pid` | High
|
||||
32 | File | `/usr/bin/pkexec` | High
|
||||
30 | File | `/template/edit` | High
|
||||
31 | File | `/upload` | Low
|
||||
32 | File | `/upload/localhost` | High
|
||||
33 | File | `/var/adm/btmp` | High
|
||||
34 | File | `/zbzedit/php/zbz.php` | High
|
||||
35 | File | `?location=search` | High
|
||||
36 | File | `account/login.php` | High
|
||||
37 | File | `ad/login.asp` | Medium
|
||||
38 | File | `add.php` | Low
|
||||
39 | File | `admin.inc.php` | High
|
||||
40 | File | `admin.php` | Medium
|
||||
41 | File | `admin.php?m=backup&c=backup&a=doback` | High
|
||||
42 | File | `admin/conf_users_edit.php` | High
|
||||
43 | File | `admin/index.php` | High
|
||||
44 | File | `admin/login.asp` | High
|
||||
45 | File | `admin/login.php` | High
|
||||
46 | File | `admin/nos/login` | High
|
||||
47 | ... | ... | ...
|
||||
35 | File | `account/login.php` | High
|
||||
36 | File | `ad/login.asp` | Medium
|
||||
37 | File | `admin.inc.php` | High
|
||||
38 | File | `admin.php` | Medium
|
||||
39 | File | `admin/admin_ping.php` | High
|
||||
40 | File | `admin/index.php` | High
|
||||
41 | File | `admin/login.asp` | High
|
||||
42 | File | `admin/login.php` | High
|
||||
43 | File | `admin/navbar.php?action=add_page` | High
|
||||
44 | File | `admin/nos/login` | High
|
||||
45 | ... | ... | ...
|
||||
|
||||
There are 403 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 394 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -16,7 +16,7 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [RU](https://vuldb.com/?country.ru)
|
||||
* [IT](https://vuldb.com/?country.it)
|
||||
* [GB](https://vuldb.com/?country.gb)
|
||||
* ...
|
||||
|
||||
There are 13 more country items available. Please use our online service to access the data.
|
||||
|
@ -40,12 +40,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 2 more TTP items available. Please use our online service to access the data.
|
||||
There are 10 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -62,9 +62,10 @@ ID | Type | Indicator | Confidence
|
|||
7 | File | `admin/index.php` | High
|
||||
8 | File | `assets/add/registrar.php` | High
|
||||
9 | File | `books.php` | Medium
|
||||
10 | ... | ... | ...
|
||||
10 | File | `cart.php` | Medium
|
||||
11 | ... | ... | ...
|
||||
|
||||
There are 79 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 80 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -16,11 +16,11 @@ The following _campaigns_ are known and can be associated with Sandworm Team:
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Sandworm Team:
|
||||
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* ...
|
||||
|
||||
There are 22 more country items available. Please use our online service to access the data.
|
||||
There are 18 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -46,12 +46,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-266, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 4 more TTP items available. Please use our online service to access the data.
|
||||
There are 16 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -60,42 +61,37 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `//proc/kcore` | Medium
|
||||
2 | File | `/admin.php?mod=user&` | High
|
||||
3 | File | `/admin/dl_sendmail.php` | High
|
||||
4 | File | `/Ap4RtpAtom.cpp` | High
|
||||
2 | File | `/admin/dl_sendmail.php` | High
|
||||
3 | File | `/Ap4RtpAtom.cpp` | High
|
||||
4 | File | `/app/options.py` | High
|
||||
5 | File | `/bcms/admin/?page=user/list` | High
|
||||
6 | File | `/bsms/?page=manage_account` | High
|
||||
7 | File | `/cgi-bin/login.cgi` | High
|
||||
8 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
9 | File | `/dashboard/reports/logs/view` | High
|
||||
10 | File | `/debug/pprof` | Medium
|
||||
11 | File | `/dl/dl_print.php` | High
|
||||
12 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
13 | File | `/fuel/sitevariables/delete/4` | High
|
||||
14 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
15 | File | `/index/jobfairol/show/` | High
|
||||
16 | File | `/librarian/bookdetails.php` | High
|
||||
17 | File | `/mgmt/tm/util/bash` | High
|
||||
18 | File | `/moddable/xs/sources/xsDebug.c` | High
|
||||
19 | File | `/monitoring` | Medium
|
||||
20 | File | `/new` | Low
|
||||
21 | File | `/odfs/classes/Master.php?f=save_category` | High
|
||||
22 | File | `/proc/<pid>/status` | High
|
||||
23 | File | `/public/plugins/` | High
|
||||
24 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
25 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
26 | File | `/simple_chat_bot/admin/?page=user/manage_user` | High
|
||||
27 | File | `/src/main/java/com/dotmarketing/filters/CMSFilter.java` | High
|
||||
28 | File | `/StdC/Ap4StdCFileByteStream.cpp` | High
|
||||
29 | File | `/tmp` | Low
|
||||
30 | File | `/uncpath/` | Medium
|
||||
31 | File | `/usr/bin/pkexec` | High
|
||||
32 | File | `/views/directive/sys/SysConfigDataDirective.java` | High
|
||||
33 | File | `/wp-json/wc/v3/webhooks` | High
|
||||
34 | File | `14all.cgi/14all-1.1.cgi/traffic.cgi/mrtg.cgi` | High
|
||||
35 | ... | ... | ...
|
||||
8 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
9 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
10 | File | `/dashboard/reports/logs/view` | High
|
||||
11 | File | `/debug/pprof` | Medium
|
||||
12 | File | `/dl/dl_print.php` | High
|
||||
13 | File | `/etc/hosts` | Medium
|
||||
14 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
15 | File | `/fuel/sitevariables/delete/4` | High
|
||||
16 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
17 | File | `/index/jobfairol/show/` | High
|
||||
18 | File | `/librarian/bookdetails.php` | High
|
||||
19 | File | `/mgmt/tm/util/bash` | High
|
||||
20 | File | `/moddable/xs/sources/xsDebug.c` | High
|
||||
21 | File | `/new` | Low
|
||||
22 | File | `/odfs/classes/Master.php?f=save_category` | High
|
||||
23 | File | `/proc/<PID>/mem` | High
|
||||
24 | File | `/proc/<pid>/status` | High
|
||||
25 | File | `/public/plugins/` | High
|
||||
26 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
27 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
28 | File | `/simple_chat_bot/admin/?page=user/manage_user` | High
|
||||
29 | File | `/src/main/java/com/dotmarketing/filters/CMSFilter.java` | High
|
||||
30 | ... | ... | ...
|
||||
|
||||
There are 299 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 257 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -33,6 +33,10 @@ ID | Technique | Weakness | Description | Confidence
|
|||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264 | Execution with Unnecessary Privileges | High
|
||||
3 | T1202 | CWE-78 | Command Injection | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 1 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -9,11 +9,11 @@ _Live data_ and more _analysis capabilities_ are available at [https://vuldb.com
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Shadowcrew:
|
||||
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [NL](https://vuldb.com/?country.nl)
|
||||
* ...
|
||||
|
||||
There are 21 more country items available. Please use our online service to access the data.
|
||||
There are 19 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -750,12 +750,14 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-266, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 6 more TTP items available. Please use our online service to access the data.
|
||||
There are 18 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -764,37 +766,35 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `//proc/kcore` | Medium
|
||||
2 | File | `/advance_push/public/login` | High
|
||||
3 | File | `/Ap4RtpAtom.cpp` | High
|
||||
2 | File | `/Ap4RtpAtom.cpp` | High
|
||||
3 | File | `/app/options.py` | High
|
||||
4 | File | `/bcms/admin/?page=user/list` | High
|
||||
5 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
6 | File | `/debug/pprof` | Medium
|
||||
7 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
8 | File | `/fuel/sitevariables/delete/4` | High
|
||||
9 | File | `/mgmt/tm/util/bash` | High
|
||||
10 | File | `/monitoring` | Medium
|
||||
11 | File | `/new` | Low
|
||||
12 | File | `/proc/<pid>/status` | High
|
||||
13 | File | `/public/plugins/` | High
|
||||
14 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
15 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
16 | File | `/simple_chat_bot/admin/?page=user/manage_user` | High
|
||||
17 | File | `/src/main/java/com/dotmarketing/filters/CMSFilter.java` | High
|
||||
18 | File | `/tmp` | Low
|
||||
19 | File | `/uncpath/` | Medium
|
||||
20 | File | `/usr/bin/pkexec` | High
|
||||
21 | File | `/views/directive/sys/SysConfigDataDirective.java` | High
|
||||
22 | File | `/wp-admin/admin-ajax.php` | High
|
||||
23 | File | `/wp-json/wc/v3/webhooks` | High
|
||||
24 | File | `14all.cgi/14all-1.1.cgi/traffic.cgi/mrtg.cgi` | High
|
||||
25 | File | `AccountManagerService.java` | High
|
||||
26 | File | `actions/CompanyDetailsSave.php` | High
|
||||
27 | File | `ActiveServices.java` | High
|
||||
28 | File | `ActivityManagerService.java` | High
|
||||
29 | File | `admin.php` | Medium
|
||||
30 | ... | ... | ...
|
||||
5 | File | `/bsms/?page=manage_account` | High
|
||||
6 | File | `/cgi-bin/login.cgi` | High
|
||||
7 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
8 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
9 | File | `/dashboard/reports/logs/view` | High
|
||||
10 | File | `/debug/pprof` | Medium
|
||||
11 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
12 | File | `/fuel/sitevariables/delete/4` | High
|
||||
13 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
14 | File | `/index/jobfairol/show/` | High
|
||||
15 | File | `/librarian/bookdetails.php` | High
|
||||
16 | File | `/mgmt/tm/util/bash` | High
|
||||
17 | File | `/proc/<PID>/mem` | High
|
||||
18 | File | `/proc/<pid>/status` | High
|
||||
19 | File | `/public/plugins/` | High
|
||||
20 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
21 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
22 | File | `/simple_chat_bot/admin/?page=user/manage_user` | High
|
||||
23 | File | `/tmp` | Low
|
||||
24 | File | `/uncpath/` | Medium
|
||||
25 | File | `/usr/bin/pkexec` | High
|
||||
26 | File | `/views/directive/sys/SysConfigDataDirective.java` | High
|
||||
27 | File | `14all.cgi/14all-1.1.cgi/traffic.cgi/mrtg.cgi` | High
|
||||
28 | ... | ... | ...
|
||||
|
||||
There are 255 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 232 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -9,11 +9,11 @@ _Live data_ and more _analysis capabilities_ are available at [https://vuldb.com
|
|||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Silence:
|
||||
|
||||
* [CN](https://vuldb.com/?country.cn)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [ES](https://vuldb.com/?country.es)
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* ...
|
||||
|
||||
There are 25 more country items available. Please use our online service to access the data.
|
||||
There are 22 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -56,12 +56,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-266, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-294, CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-88, CWE-94 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 5 more TTP items available. Please use our online service to access the data.
|
||||
There are 16 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -69,45 +70,37 @@ These _indicators of attack_ (IOA) list the potential fragments used for technic
|
|||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/?module=users§ion=cpanel&page=list` | High
|
||||
2 | File | `/admin/powerline` | High
|
||||
3 | File | `/admin/syslog` | High
|
||||
4 | File | `/api/upload` | Medium
|
||||
5 | File | `/bcms/admin/?page=user/list` | High
|
||||
6 | File | `/cgi-bin` | Medium
|
||||
7 | File | `/cgi-bin/kerbynet` | High
|
||||
1 | File | `//proc/kcore` | Medium
|
||||
2 | File | `/Ap4RtpAtom.cpp` | High
|
||||
3 | File | `/app/options.py` | High
|
||||
4 | File | `/bcms/admin/?page=user/list` | High
|
||||
5 | File | `/bsms/?page=manage_account` | High
|
||||
6 | File | `/cgi-bin/login.cgi` | High
|
||||
7 | File | `/ci_hms/massage_room/edit/1` | High
|
||||
8 | File | `/context/%2e/WEB-INF/web.xml` | High
|
||||
9 | File | `/debug/pprof` | Medium
|
||||
10 | File | `/download` | Medium
|
||||
11 | File | `/fudforum/adm/hlplist.php` | High
|
||||
9 | File | `/dashboard/reports/logs/view` | High
|
||||
10 | File | `/debug/pprof` | Medium
|
||||
11 | File | `/etc/hosts` | Medium
|
||||
12 | File | `/fuel/index.php/fuel/logs/items` | High
|
||||
13 | File | `/login` | Low
|
||||
14 | File | `/Main_Login.asp?flag=1&productname=RT-AC88U&url=/downloadmaster/task.asp` | High
|
||||
15 | File | `/mgmt/tm/util/bash` | High
|
||||
16 | File | `/monitoring` | Medium
|
||||
17 | File | `/new` | Low
|
||||
18 | File | `/nova/bin/console` | High
|
||||
19 | File | `/proc/<pid>/status` | High
|
||||
20 | File | `/public/plugins/` | High
|
||||
21 | File | `/req_password_user.php` | High
|
||||
22 | File | `/scripts/killpvhost` | High
|
||||
23 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
24 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
25 | File | `/simple_chat_bot/admin/?page=user/manage_user` | High
|
||||
26 | File | `/src/main/java/com/dotmarketing/filters/CMSFilter.java` | High
|
||||
27 | File | `/tmp` | Low
|
||||
28 | File | `/tmp/redis.ds` | High
|
||||
29 | File | `/uncpath/` | Medium
|
||||
30 | File | `/views/directive/sys/SysConfigDataDirective.java` | High
|
||||
31 | File | `/WEB-INF/web.xml` | High
|
||||
32 | File | `/wp-admin` | Medium
|
||||
33 | File | `/wp-json/wc/v3/webhooks` | High
|
||||
34 | File | `14all.cgi/14all-1.1.cgi/traffic.cgi/mrtg.cgi` | High
|
||||
35 | File | `AccountManagerService.java` | High
|
||||
36 | File | `actions/CompanyDetailsSave.php` | High
|
||||
37 | ... | ... | ...
|
||||
13 | File | `/fuel/sitevariables/delete/4` | High
|
||||
14 | File | `/hprms/admin/doctors/manage_doctor.php` | High
|
||||
15 | File | `/index/jobfairol/show/` | High
|
||||
16 | File | `/librarian/bookdetails.php` | High
|
||||
17 | File | `/mgmt/tm/util/bash` | High
|
||||
18 | File | `/monitoring` | Medium
|
||||
19 | File | `/new` | Low
|
||||
20 | File | `/nova/bin/console` | High
|
||||
21 | File | `/out.php` | Medium
|
||||
22 | File | `/proc/<PID>/mem` | High
|
||||
23 | File | `/proc/<pid>/status` | High
|
||||
24 | File | `/public/plugins/` | High
|
||||
25 | File | `/secure/admin/InsightDefaultCustomFieldConfig.jspa` | High
|
||||
26 | File | `/secure/QueryComponent!Default.jspa` | High
|
||||
27 | File | `/simple_chat_bot/admin/?page=user/manage_user` | High
|
||||
28 | File | `/src/main/java/com/dotmarketing/filters/CMSFilter.java` | High
|
||||
29 | ... | ... | ...
|
||||
|
||||
There are 313 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 242 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -19,7 +19,7 @@ These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. acce
|
|||
* [CN](https://vuldb.com/?country.cn)
|
||||
* ...
|
||||
|
||||
There are 13 more country items available. Please use our online service to access the data.
|
||||
There are 14 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
|
@ -46,12 +46,14 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
|
||||
3 | T1055 | CWE-74 | Injection | High
|
||||
4 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
6 | ... | ... | ... | ...
|
||||
|
||||
There are 8 more TTP items available. Please use our online service to access the data.
|
||||
There are 18 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -101,7 +103,7 @@ ID | Type | Indicator | Confidence
|
|||
40 | File | `AudioService.java` | High
|
||||
41 | ... | ... | ...
|
||||
|
||||
There are 351 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 350 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -34,12 +34,13 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1110.001 | CWE-307, CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
1 | T1006 | CWE-21, CWE-22, CWE-23 | Pathname Traversal | High
|
||||
2 | T1055 | CWE-74 | Injection | High
|
||||
3 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
4 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
5 | ... | ... | ... | ...
|
||||
|
||||
There are 5 more TTP items available. Please use our online service to access the data.
|
||||
There are 17 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -34,8 +34,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
2 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1059.007 | CWE-79 | Cross Site Scripting | High
|
||||
3 | T1110.001 | CWE-798 | Improper Restriction of Excessive Authentication Attempts | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 4 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
|
@ -33,12 +33,12 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
2 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
3 | T1068 | CWE-264, CWE-269, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
1 | T1006 | CWE-22 | Pathname Traversal | High
|
||||
2 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
3 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 4 more TTP items available. Please use our online service to access the data.
|
||||
There are 13 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
@ -49,63 +49,63 @@ ID | Type | Indicator | Confidence
|
|||
1 | File | `.user` | Low
|
||||
2 | File | `/.perf` | Low
|
||||
3 | File | `/admin/` | Low
|
||||
4 | File | `/caucho-status` | High
|
||||
5 | File | `/cgi-bin/readfile.tcl` | High
|
||||
6 | File | `/etc/password` | High
|
||||
7 | File | `/php/` | Low
|
||||
8 | File | `/Pwrchute` | Medium
|
||||
9 | File | `/status` | Low
|
||||
10 | File | `/var/yp` | Low
|
||||
11 | File | `/_vti_pvt/access.cnf` | High
|
||||
12 | File | `1.TEXT` | Low
|
||||
13 | File | `14all.cgi` | Medium
|
||||
14 | File | `500error.jsp` | Medium
|
||||
15 | File | `ab.c` | Low
|
||||
16 | File | `account_update.php` | High
|
||||
17 | File | `add.php` | Low
|
||||
18 | File | `addentry.cgi` | Medium
|
||||
19 | File | `addressbook.php/options.php/search.php/help.php` | High
|
||||
20 | File | `admin.html` | Medium
|
||||
21 | File | `admin.php` | Medium
|
||||
22 | File | `admin/auth/checksession.php` | High
|
||||
23 | File | `administrator/phpinfo.php` | High
|
||||
24 | File | `AdminViewError/AdminAddadmin` | High
|
||||
25 | File | `admin_ug_auth.php` | High
|
||||
26 | File | `admin_user.db` | High
|
||||
27 | File | `advserver.exe` | High
|
||||
28 | File | `ad_member.php` | High
|
||||
29 | File | `agentadmin.php` | High
|
||||
30 | File | `aolsecurityprivate.class` | High
|
||||
31 | File | `article.php` | Medium
|
||||
32 | File | `artlist.php` | Medium
|
||||
33 | File | `astrocam.cgi` | Medium
|
||||
34 | File | `as_web.exe/as_web4.exe` | High
|
||||
35 | File | `athcgi.exe` | Medium
|
||||
36 | File | `auction.cgi` | Medium
|
||||
37 | File | `auth.inc.php` | Medium
|
||||
38 | File | `axspawn.c` | Medium
|
||||
39 | File | `backend.php/screen.php/comment.php` | High
|
||||
40 | File | `badmin.c` | Medium
|
||||
41 | File | `books.php` | Medium
|
||||
42 | File | `bttv-driver.c` | High
|
||||
43 | File | `bugzilla_email_append.pl` | High
|
||||
44 | File | `bug_update_advanced_page.php/bug_update_page.php/view_bug_advanced_page.php/view_bug_page.php` | High
|
||||
45 | File | `calendar.php` | Medium
|
||||
46 | File | `category.cfm` | Medium
|
||||
47 | File | `cgi-bin` | Low
|
||||
48 | File | `cgi-bin/` | Medium
|
||||
49 | File | `cgicso.c` | Medium
|
||||
50 | File | `cgitest.exe` | Medium
|
||||
51 | File | `charities.cron` | High
|
||||
52 | File | `check_me.mod.php` | High
|
||||
53 | File | `chetcpasswd.cgi` | High
|
||||
54 | File | `cio_main.c` | Medium
|
||||
55 | File | `clear_cookies.php` | High
|
||||
56 | File | `CodeBrws.asp` | Medium
|
||||
57 | File | `colegal.htm` | Medium
|
||||
4 | File | `/cgi-bin/readfile.tcl` | High
|
||||
5 | File | `/etc/password` | High
|
||||
6 | File | `/php/` | Low
|
||||
7 | File | `/Pwrchute` | Medium
|
||||
8 | File | `/status` | Low
|
||||
9 | File | `/var/yp` | Low
|
||||
10 | File | `/_vti_pvt/access.cnf` | High
|
||||
11 | File | `1.TEXT` | Low
|
||||
12 | File | `14all.cgi` | Medium
|
||||
13 | File | `500error.jsp` | Medium
|
||||
14 | File | `ab.c` | Low
|
||||
15 | File | `account_update.php` | High
|
||||
16 | File | `add.php` | Low
|
||||
17 | File | `addentry.cgi` | Medium
|
||||
18 | File | `addressbook.php/options.php/search.php/help.php` | High
|
||||
19 | File | `admin.html` | Medium
|
||||
20 | File | `admin.php` | Medium
|
||||
21 | File | `admin/auth/checksession.php` | High
|
||||
22 | File | `administrator/phpinfo.php` | High
|
||||
23 | File | `AdminViewError/AdminAddadmin` | High
|
||||
24 | File | `admin_ug_auth.php` | High
|
||||
25 | File | `admin_user.db` | High
|
||||
26 | File | `advserver.exe` | High
|
||||
27 | File | `ad_member.php` | High
|
||||
28 | File | `agentadmin.php` | High
|
||||
29 | File | `aolsecurityprivate.class` | High
|
||||
30 | File | `article.php` | Medium
|
||||
31 | File | `artlist.php` | Medium
|
||||
32 | File | `astrocam.cgi` | Medium
|
||||
33 | File | `as_web.exe/as_web4.exe` | High
|
||||
34 | File | `athcgi.exe` | Medium
|
||||
35 | File | `auction.cgi` | Medium
|
||||
36 | File | `auth.inc.php` | Medium
|
||||
37 | File | `axspawn.c` | Medium
|
||||
38 | File | `backend.php/screen.php/comment.php` | High
|
||||
39 | File | `badmin.c` | Medium
|
||||
40 | File | `books.php` | Medium
|
||||
41 | File | `bttv-driver.c` | High
|
||||
42 | File | `bugzilla_email_append.pl` | High
|
||||
43 | File | `bug_update_advanced_page.php/bug_update_page.php/view_bug_advanced_page.php/view_bug_page.php` | High
|
||||
44 | File | `calendar.php` | Medium
|
||||
45 | File | `category.cfm` | Medium
|
||||
46 | File | `cgi-bin` | Low
|
||||
47 | File | `cgi-bin/` | Medium
|
||||
48 | File | `cgicso.c` | Medium
|
||||
49 | File | `cgitest.exe` | Medium
|
||||
50 | File | `charities.cron` | High
|
||||
51 | File | `check_me.mod.php` | High
|
||||
52 | File | `chetcpasswd.cgi` | High
|
||||
53 | File | `cio_main.c` | Medium
|
||||
54 | File | `clear_cookies.php` | High
|
||||
55 | File | `CodeBrws.asp` | Medium
|
||||
56 | File | `colegal.htm` | Medium
|
||||
57 | File | `com.ms.vm.loader.cabcracker` | High
|
||||
58 | ... | ... | ...
|
||||
|
||||
There are 507 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
There are 506 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
|
|
|
@ -1,87 +0,0 @@
|
|||
# Swisyn - Cyber Threat Intelligence
|
||||
|
||||
These _indicators_ were reported, collected, and generated during the [VulDB CTI analysis](https://vuldb.com/?kb.cti) of the actor known as [Swisyn](https://vuldb.com/?actor.swisyn). The _activity monitoring_ correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique _predictive model_ uses _big data_ to forecast activities and their characteristics.
|
||||
|
||||
_Live data_ and more _analysis capabilities_ are available at [https://vuldb.com/?actor.swisyn](https://vuldb.com/?actor.swisyn)
|
||||
|
||||
## Countries
|
||||
|
||||
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Swisyn:
|
||||
|
||||
* [US](https://vuldb.com/?country.us)
|
||||
* [FR](https://vuldb.com/?country.fr)
|
||||
* [RS](https://vuldb.com/?country.rs)
|
||||
* ...
|
||||
|
||||
There are 7 more country items available. Please use our online service to access the data.
|
||||
|
||||
## IOC - Indicator of Compromise
|
||||
|
||||
These _indicators of compromise_ (IOC) indicate associated network resources which are known to be part of research and attack activities of Swisyn.
|
||||
|
||||
ID | IP address | Hostname | Campaign | Confidence
|
||||
-- | ---------- | -------- | -------- | ----------
|
||||
1 | [5.39.72.2](https://vuldb.com/?ip.5.39.72.2) | ns3065363.ip-5-39-72.eu | - | High
|
||||
2 | [20.42.65.92](https://vuldb.com/?ip.20.42.65.92) | - | - | High
|
||||
3 | [51.91.73.194](https://vuldb.com/?ip.51.91.73.194) | ns3164589.ip-51-91-73.eu | - | High
|
||||
4 | [51.254.45.43](https://vuldb.com/?ip.51.254.45.43) | ip-51-254-45-43.ddhosts.net | - | High
|
||||
5 | [58.221.32.3](https://vuldb.com/?ip.58.221.32.3) | - | - | High
|
||||
6 | [58.221.33.111](https://vuldb.com/?ip.58.221.33.111) | - | - | High
|
||||
7 | [58.221.35.121](https://vuldb.com/?ip.58.221.35.121) | - | - | High
|
||||
8 | [59.42.71.178](https://vuldb.com/?ip.59.42.71.178) | - | - | High
|
||||
9 | [59.188.239.165](https://vuldb.com/?ip.59.188.239.165) | - | - | High
|
||||
10 | [64.32.28.254](https://vuldb.com/?ip.64.32.28.254) | curtir.gicscorple.com | - | High
|
||||
11 | ... | ... | ... | ...
|
||||
|
||||
There are 38 more IOC items available. Please use our online service to access the data.
|
||||
|
||||
## TTP - Tactics, Techniques, Procedures
|
||||
|
||||
_Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK techniques used by _Swisyn_. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
2 | T1068 | CWE-264, CWE-284 | Execution with Unnecessary Privileges | High
|
||||
3 | T1211 | CWE-254 | 7PK Security Features | High
|
||||
4 | ... | ... | ... | ...
|
||||
|
||||
There are 1 more TTP items available. Please use our online service to access the data.
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
These _indicators of attack_ (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Swisyn. This data is unique as it uses our predictive model for actor profiling.
|
||||
|
||||
ID | Type | Indicator | Confidence
|
||||
-- | ---- | --------- | ----------
|
||||
1 | File | `/admin.php?action=themeinstall` | High
|
||||
2 | File | `/admin/admapi.php` | High
|
||||
3 | File | `/admin/config.php?display=disa&view=form` | High
|
||||
4 | File | `/admin/login.php` | High
|
||||
5 | File | `/admin/sysmon.php` | High
|
||||
6 | File | `/base/ecma-helpers-string.c` | High
|
||||
7 | File | `/EPOAGENTMETA/DisplayMSAPropsDetail.do` | High
|
||||
8 | File | `/etc/sysconfig/tomcat` | High
|
||||
9 | ... | ... | ...
|
||||
|
||||
There are 61 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.
|
||||
|
||||
## References
|
||||
|
||||
The following list contains _external sources_ which discuss the actor and the associated activities:
|
||||
|
||||
* https://blog.talosintelligence.com/2021/04/threat-roundup-0402-0409.html
|
||||
* https://blog.talosintelligence.com/2021/08/threat-roundup-0806-0813.html
|
||||
* https://blog.talosintelligence.com/2021/11/threat-roundup-1112-1119.html
|
||||
* https://blog.talosintelligence.com/2022/01/threat-roundup-0121-0128.html
|
||||
|
||||
## Literature
|
||||
|
||||
The following _articles_ explain our unique predictive cyber threat intelligence:
|
||||
|
||||
* [VulDB Cyber Threat Intelligence Documentation](https://vuldb.com/?kb.cti)
|
||||
* [Cyber Threat Intelligence - Early Anticipation of Attacks](https://www.scip.ch/en/?labs.20201022)
|
||||
|
||||
## License
|
||||
|
||||
(c) [1997-2022](https://vuldb.com/?kb.changelog) by [vuldb.com](https://vuldb.com/?kb.about). All data on this page is shared under the license [CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/). Questions? Check the [FAQ](https://vuldb.com/?kb.faq), read the [documentation](https://vuldb.com/?kb) or [contact us](https://vuldb.com/?contact)!
|
|
@ -25,7 +25,9 @@ _Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK
|
|||
|
||||
ID | Technique | Weakness | Description | Confidence
|
||||
-- | --------- | -------- | ----------- | ----------
|
||||
1 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
1 | T1059 | CWE-94 | Cross Site Scripting | High
|
||||
2 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
|
||||
3 | T1592 | CWE-200 | Configuration | High
|
||||
|
||||
## IOA - Indicator of Attack
|
||||
|
||||
|
|
Loading…
Reference in New Issue