Mirrors
/
cyber_threat_intelligence
mirror of https://github.com/vuldb/cyber_threat_intelligence
6
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
cyber_threat_intelligence/actors/Zbot
History
Marc Ruef 4e0d577a2c Update 2022-04-23 11:50:32 +02:00
..
README.md Update 2022-04-23 11:50:32 +02:00

README.md

Zbot - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as Zbot. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.zbot

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Zbot:

There are 17 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of Zbot.

ID IP address Hostname Campaign Confidence
1 3.223.115.185 ec2-3-223-115-185.compute-1.amazonaws.com - Medium
2 12.96.218.170 - - High
3 13.32.204.55 server-13-32-204-55.iad66.r.cloudfront.net - High
4 18.207.9.28 ec2-18-207-9-28.compute-1.amazonaws.com - Medium
5 20.189.173.20 - - High
6 20.189.173.22 - - High
7 23.56.9.181 a23-56-9-181.deploy.static.akamaitechnologies.com - High
8 23.96.30.229 - - High
9 23.193.42.12 a23-193-42-12.deploy.static.akamaitechnologies.com - High
10 23.227.38.32 myshopify.com - High
11 23.253.126.58 - - High
12 24.115.94.180 24.115.94.180.res-cmts.ovr.ptd.net - High
13 24.120.165.58 wsip-24-120-165-58.lv.lv.cox.net - High
14 27.54.110.77 77.110.54.27.dhcp.mct.ne.jp - High
15 32.178.143.61 mobile-32-178-143-61.mycingular.net - High
16 34.72.197.182 182.197.72.34.bc.googleusercontent.com - Medium
17 35.177.71.77 ns1.symbiant.net - High
18 36.2.242.186 36-2-242-186.aichi.otk.vectant.ne.jp - High
19 39.116.90.10 - - High
20 41.168.5.140 - - High
21 45.60.77.201 - - High
22 46.165.243.51 - - High
23 49.212.235.209 www3469.sakura.ne.jp - High
24 50.7.252.125 - - High
25 50.72.177.24 S01069050ca30b943.wp.shawcable.net - High
26 50.116.43.143 li480-143.members.linode.com - High
27 51.178.156.9 ip9.ip-51-178-156.eu - High
28 52.85.132.44 server-52-85-132-44.iad50.r.cloudfront.net - High
29 52.137.90.34 - - High
30 52.168.117.173 - - High
31 52.182.143.212 - - High
32 52.185.71.28 - - High
33 58.1.158.10 ntaich204010.aich.nt.ngn.ppp.infoweb.ne.jp - High
34 58.68.2.214 - - High
35 58.185.131.158 - - High
36 59.90.221.6 static.bb.hyd.59.90.221.6.bsnl.in - High
37 60.244.81.6 60-244-81-6.apol.com.tw - High
38 61.7.235.35 - - High
39 61.32.242.131 - - High
40 62.49.180.189 - - High
41 62.76.47.5 62-76-47-5.vm.clodoserver.ru - High
42 62.76.178.192 ballistica.ru - High
43 62.76.185.233 62-76-185-233.vm.clodoserver.ru - High
44 62.76.188.38 62-76-188-38.vm.clodoserver.ru - High
45 64.219.121.189 - - High
46 ... ... ... ...

There are 178 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by Zbot. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
2 T1068 CWE-264, CWE-284 Execution with Unnecessary Privileges High
3 T1110.001 CWE-798 Improper Restriction of Excessive Authentication Attempts High
4 ... ... ... ...

There are 6 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Zbot. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File /?ajax-request=jnews High
2 File /admin/admin.php High
3 File /admin/imageslider/file.php High
4 File /cgi-bin/luci High
5 File /cgi-bin/viewcert High
6 File /core/vb/vurl.php High
7 File /etc/ldap.conf High
8 File /importTool/preview High
9 File /mods/_core/courses/users/create_course.php High
10 File /phppath/php Medium
11 File /plugins/Dashboard/Controller.php High
12 File /server-status High
13 File /uncpath/ Medium
14 File adclick.php Medium
15 File add_comment.php High
16 File admin-ajax.php High
17 File admin.php Medium
18 File admin/class-bulk-editor-list-table.php High
19 ... ... ...

There are 155 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2022 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!