Mirrors/cyber_threat_intelligence
6
0
Fork 0
mirror of https://github.com/vuldb/cyber_threat_intelligence synced 2024-06-27 09:28:52 +00:00
Code Issues Packages Projects Releases Wiki Activity
9acd7aff46
cyber_threat_intelligence/actors/Viper RAT
History
Marc Ruef 9acd7aff46 Update February 2024
2024-02-02 10:19:44 +01:00
..
README.md Update February 2024 2024-02-02 10:19:44 +01:00

README.md

Viper RAT - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as Viper RAT. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.viper_rat

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Viper RAT:

There are 20 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of Viper RAT.

ID IP address Hostname Campaign Confidence
1 1.12.75.100 - - High
2 1.13.15.130 - - High
3 1.13.23.114 - - High
4 1.13.171.183 - - High
5 1.14.8.189 - - High
6 1.14.12.127 - - High
7 1.14.65.18 - - High
8 1.14.65.206 - - High
9 1.14.71.236 - - High
10 1.14.95.143 - - High
11 1.14.96.24 - - High
12 1.14.194.105 - - High
13 1.15.56.125 - - High
14 1.15.134.123 - - High
15 1.15.147.201 - - High
16 1.15.180.75 - - High
17 1.15.181.217 - - High
18 1.15.184.125 - - High
19 1.92.72.148 ecs-1-92-72-148.compute.hwclouds-dns.com - High
20 1.92.92.107 ecs-1-92-92-107.compute.hwclouds-dns.com - High
21 1.92.94.117 ecs-1-92-94-117.compute.hwclouds-dns.com - High
22 1.94.50.200 ecs-1-94-50-200.compute.hwclouds-dns.com - High
23 1.94.51.173 ecs-1-94-51-173.compute.hwclouds-dns.com - High
24 1.116.129.79 - - High
25 1.117.49.216 - - High
26 1.117.60.33 - - High
27 1.117.175.65 - - High
28 5.181.132.208 - - High
29 8.130.19.53 - - High
30 8.130.24.188 - - High
31 8.130.27.180 - - High
32 8.130.66.61 - - High
33 8.130.81.170 - - High
34 8.130.109.15 - - High
35 8.130.126.1 - - High
36 8.130.127.102 - - High
37 8.130.128.17 - - High
38 8.130.166.74 - - High
39 8.131.50.94 - - High
40 8.134.36.228 - - High
41 8.137.19.128 - - High
42 8.140.178.180 - - High
43 8.140.205.192 - - High
44 8.143.2.128 - - High
45 8.210.65.48 - - High
46 8.216.65.10 - - High
47 8.216.65.42 - - High
48 8.217.7.168 - - High
49 8.217.9.3 - - High
50 8.217.122.103 - - High
51 8.218.173.44 - - High
52 13.54.184.24 ec2-13-54-184-24.ap-southeast-2.compute.amazonaws.com - Medium
53 14.29.193.58 - - High
54 14.116.159.128 - - High
55 15.235.130.6 ip6.ip-15-235-130.net - High
56 20.48.42.49 - - High
57 20.205.107.249 - - High
58 23.95.85.102 23-95-85-102-host.colocrossing.com - High
59 23.95.216.185 23-95-216-185-host.colocrossing.com - High
60 23.105.204.184 23.105.204.184.16clouds.com - High
61 23.105.212.241 23.105.212.241.16clouds.com - High
62 23.105.214.104 glowing-silo-1.localdomain - High
63 23.105.218.197 23.105.218.197.16clouds.com - High
64 23.224.182.202 - - High
65 23.224.182.203 - - High
66 23.224.182.204 - - High
67 23.224.182.205 - - High
68 23.224.182.206 - - High
69 27.9.166.52 - - High
70 27.124.4.114 - - High
71 31.220.80.167 vmi1501573.contaboserver.net - High
72 34.87.124.185 185.124.87.34.bc.googleusercontent.com - Medium
73 34.148.58.3 3.58.148.34.bc.googleusercontent.com - Medium
74 35.78.65.63 ec2-35-78-65-63.ap-northeast-1.compute.amazonaws.com - Medium
75 36.111.166.231 - - High
76 36.137.213.118 - - High
77 38.6.173.33 - - High
78 38.54.40.156 - - High
79 38.147.172.103 - - High
80 39.98.62.58 - - High
81 39.98.91.137 - - High
82 39.98.180.254 - - High
83 39.99.154.30 - - High
84 39.104.20.54 - - High
85 39.104.209.210 - - High
86 39.105.5.221 - - High
87 39.105.38.7 - - High
88 39.105.121.115 - - High
89 39.106.141.206 - - High
90 39.106.148.186 - - High
91 39.107.93.206 - - High
92 39.108.110.213 - - High
93 39.108.114.127 - - High
94 39.108.154.219 - - High
95 42.51.45.241 - - High
96 42.192.40.114 - - High
97 42.192.90.239 - - High
98 42.192.211.60 - - High
99 42.193.52.56 - - High
100 42.194.134.61 - - High
101 42.194.190.162 - - High
102 42.194.192.253 - - High
103 42.194.226.38 - - High
104 43.130.135.47 - - High
105 43.132.237.202 - - High
106 43.134.77.110 - - High
107 43.135.1.12 - - High
108 43.136.166.140 - - High
109 43.136.171.160 - - High
110 43.136.218.157 - - High
111 43.136.235.58 - - High
112 43.138.28.143 - - High
113 43.138.30.109 - - High
114 43.138.39.212 - - High
115 43.138.46.20 - - High
116 43.138.51.97 - - High
117 43.138.107.242 - - High
118 43.138.143.146 - - High
119 43.138.159.166 - - High
120 43.138.179.199 - - High
121 43.138.181.49 - - High
122 43.138.182.38 - - High
123 43.138.195.98 - - High
124 43.138.196.105 - - High
125 43.138.212.90 - - High
126 43.138.235.42 - - High
127 43.139.9.72 - - High
128 43.139.42.219 - - High
129 43.139.107.237 - - High
130 43.139.167.77 - - High
131 43.139.168.217 - - High
132 43.139.190.82 - - High
133 43.139.225.42 - - High
134 43.139.227.213 - - High
135 43.139.241.58 - - High
136 43.142.177.236 - - High
137 43.143.7.85 - - High
138 43.143.56.207 - - High
139 43.143.62.167 - - High
140 43.143.87.41 - - High
141 ... ... ... ...

There are 560 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by Viper RAT. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1006 CWE-21, CWE-22, CWE-23, CWE-25, CWE-425 Pathname Traversal High
2 T1040 CWE-319 Authentication Bypass by Capture-replay High
3 T1055 CWE-74 Injection High
4 T1059 CWE-94, CWE-1321 Cross Site Scripting High
5 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
6 ... ... ... ...

There are 21 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Viper RAT. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File %SYSTEMDRIVE%\node_modules\.bin\wmic.exe High
2 File //proc/kcore Medium
3 File /admin/action/delete-vaccine.php High
4 File /admin/index2.html High
5 File /admin/save.php High
6 File /api/download High
7 File /api/v1/alerts High
8 File /api/v1/terminal/sessions/?limit=1 High
9 File /api /v3/auth High
10 File /app/index/controller/Common.php High
11 File /b2b-supermarket/shopping-cart High
12 File /bitrix/admin/ldap_server_edit.php High
13 File /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini High
14 File /category.php High
15 File /categorypage.php High
16 File /cgi-bin/luci/api/wireless High
17 File /cgi-bin/vitogate.cgi High
18 File /change-language/de_DE High
19 File /Content/Template/root/reverse-shell.aspx High
20 File /debug/pprof Medium
21 File /devinfo Medium
22 File /dist/index.js High
23 File /fcgi/scrut_fcgi.fcgi High
24 File /forms/doLogin High
25 File /forum/away.php High
26 File /geoserver/gwc/rest.html High
27 File /goform/formSysCmd High
28 File /HNAP1 Low
29 File /hosts/firewall/ip High
30 File /index.php/ccm/system/file/upload High
31 File /jeecg-boot/sys/common/upload High
32 File /listplace/user/ticket/create High
33 File /log/decodmail.php High
34 File /oauth/idp/.well-known/openid-configuration High
35 File /OA_HTML/cabo/jsps/a.jsp High
36 File /php/ping.php High
37 File /proxy Low
38 File /RPS2019Service/status.html High
39 File /s/index.php?action=statistics High
40 File /setting Medium
41 File /sicweb-ajax/tmproot/ High
42 File /spip.php Medium
43 File /subsys/net/l2/wifi/wifi_shell.c High
44 ... ... ...

There are 378 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2024 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!