Mirrors/cyber_threat_intelligence
6
0
Fork 0
mirror of https://github.com/vuldb/cyber_threat_intelligence synced 2024-07-05 18:01:41 +00:00
Code Issues Packages Projects Releases Wiki Activity
0955ba53e2
cyber_threat_intelligence/actors/Quasar RAT/README.md
Marc Ruef 0955ba53e2 Update June 2023
2023-06-23 09:10:04 +02:00

10 KiB
Raw Blame History

Quasar RAT - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as Quasar RAT. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.quasar_rat

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Quasar RAT:

There are 2 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of Quasar RAT.

ID IP address Hostname Campaign Confidence
1 1.234.41.14 - - High
2 2.133.130.23 2.133.130.23.megaline.telecom.kz - High
3 3.18.3.168 ec2-3-18-3-168.us-east-2.compute.amazonaws.com - Medium
4 3.71.116.67 ec2-3-71-116-67.eu-central-1.compute.amazonaws.com - Medium
5 3.83.129.253 ec2-3-83-129-253.compute-1.amazonaws.com - Medium
6 3.121.208.125 ec2-3-121-208-125.eu-central-1.compute.amazonaws.com - Medium
7 5.61.44.125 - - High
8 5.102.157.70 - - High
9 5.161.113.202 static.202.113.161.5.clients.your-server.de - High
10 5.161.184.38 static.38.184.161.5.clients.your-server.de - High
11 5.181.166.139 - - High
12 13.233.24.14 ec2-13-233-24-14.ap-south-1.compute.amazonaws.com - Medium
13 14.32.99.105 - - High
14 14.225.204.247 static.vnpt.vn - High
15 14.225.254.32 - - High
16 15.165.236.45 ec2-15-165-236-45.ap-northeast-2.compute.amazonaws.com - Medium
17 15.204.13.245 ip245.ip-15-204-13.us - High
18 20.123.197.130 - - High
19 20.218.120.153 - - High
20 20.223.155.39 - - High
21 20.231.104.157 - - High
22 23.105.131.196 mail196.nessfist.com - High
23 27.11.235.246 - - High
24 27.72.56.186 dynamic-ip-adsl.viettel.vn - High
25 31.7.63.14 rack223ch.idfnv.ne - High
26 31.220.15.249 - - High
27 34.96.240.37 37.240.96.34.bc.googleusercontent.com - Medium
28 34.125.93.181 181.93.125.34.bc.googleusercontent.com - Medium
29 34.146.234.67 67.234.146.34.bc.googleusercontent.com - Medium
30 35.79.36.216 ec2-35-79-36-216.ap-northeast-1.compute.amazonaws.com - Medium
31 35.157.111.131 ec2-35-157-111-131.eu-central-1.compute.amazonaws.com - Medium
32 35.177.17.33 ec2-35-177-17-33.eu-west-2.compute.amazonaws.com - Medium
33 37.0.11.118 - - High
34 37.0.14.205 - - High
35 37.48.117.136 - - High
36 37.120.206.86 - - High
37 37.120.210.219 - - High
38 38.242.128.85 vmi1149994.contaboserver.net - High
39 39.107.242.96 - - High
40 40.117.196.252 - - High
41 41.79.11.214 - - High
42 41.102.117.114 - - High
43 41.143.172.69 - - High
44 41.232.207.130 host-41.232.207.130.tedata.net - High
45 41.234.44.38 host-41.234.44.38.tedata.net - High
46 41.234.46.29 host-41.234.46.29.tedata.net - High
47 42.192.132.19 - - High
48 43.154.232.190 - - High
49 43.240.48.46 - - High
50 45.12.213.244 vm2521174.52ssd.had.wf - High
51 45.14.13.20 free.example.com - High
52 ... ... ... ...

There are 206 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by Quasar RAT. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1006 CWE-21, CWE-22, CWE-23, CWE-24, CWE-29, CWE-425 Pathname Traversal High
2 T1040 CWE-319 Authentication Bypass by Capture-replay High
3 T1055 CWE-74 Injection High
4 T1059 CWE-94 Cross Site Scripting High
5 ... ... ... ...

There are 16 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Quasar RAT. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File /admin/?page=user/list High
2 File /admin/addproduct.php High
3 File /admin/ajax.php?action=save_area High
4 File /admin/contacts/organizations/edit/2 High
5 File /admin/modal_add_product.php High
6 File /admin/reportupload.aspx High
7 File /admin/update_s6.php High
8 File /ajax.php?action=read_msg High
9 File /ajax.php?action=save_company High
10 File /Applications/Google\ Drive.app/Contents/MacOS High
11 File /authenticationendpoint/login.do High
12 File /bin/login Medium
13 File /cgi-bin/luci High
14 File /cgi-bin/wlogin.cgi High
15 File /changeimage.php High
16 File /classes/Users.php?f=save High
17 File /DXR.axd Medium
18 File /forum/away.php High
19 File /HNAP1 Low
20 File /Log/Query?appid=0B736354-9473-4D66-B9C0-15CAC149EB05&tabid=tab_0B73635494734D66B9C015CAC149EB05 High
21 File /mc Low
22 File /note/index/delete High
23 File /owa/auth/logon.aspx High
24 File /php-inventory-management-system/product.php High
25 File /send_order.cgi?parameter=restart High
26 File /tmp/boa-temp High
27 File /userfs/bin/tcapi High
28 File /var/log/nginx High
29 File /wp-admin/admin-ajax.php High
30 ... ... ...

There are 254 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2023 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!