Big Head Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (69)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	70

Country

tr	70

Actors

Big Head	1

Activities

Interest

Timeline

Type

Not Defined	22
Programming Language Software	12
Operating System	8
Content Management System	4
WordPress Plugin	4

Vendor

Not Defined	30
Microsoft	6
Linux	4
Apple	4
PHPGurukul	2

Product

PHP	6
Linux Kernel	4
WordPress	4
PHPGurukul Hospital Management System in PHP	2
CKEditor4	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Google Chrome WebRTC heap-based overflow	6.3	6.0	$25k-$100k	$5k-$25k	High	Official Fix	0.01152	0.00	CVE-2022-2294
2	nginx request smuggling	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	1.97	CVE-2020-12440
3	Telegram information disclosure	4.9	4.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00048	0.00	CVE-2021-27205
4	Joget Workflow account_new input validation	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00091	0.03	CVE-2019-14352
5	KLog Server authenticate.php os command injection	5.5	5.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.95712	0.04	CVE-2020-35729
6	Havelsan Dialogue ACL permission assignment	8.3	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00087	0.00	CVE-2024-3375
7	Nagios XI monitoringwizard.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00043	0.08	CVE-2024-24401
8	Microsoft Windows code injection	10.0	9.5	$100k and more	$0-$5k	Not Defined	Official Fix	0.85597	0.05	CVE-2009-2512
9	Python SimpleHTTPServer Module SimpleHTTPServer.py list_directory cross site scripting	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00422	0.04	CVE-2011-4940
10	CKeditor Paste cross site scripting	5.2	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00123	0.03	CVE-2018-17960
11	CKEditor4 Advanced Content Filter cross site scripting	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00448	0.04	CVE-2021-41164
12	OpenSSH improper authentication	7.3	7.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.02241	0.02	CVE-2010-4478
13	MikroTik RouterOS Web Server out-of-bounds write	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00045	0.04	CVE-2023-30800
14	Microsoft .NET Framework Array Copy memory corruption	7.3	7.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.24098	0.05	CVE-2015-2504
15	CodeBard Patron Button and Widgets for Patreon Plugin cross site scripting	5.6	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00046	0.00	CVE-2023-30491
16	phpBB Error Message memberlist.php input validation	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01803	0.03	CVE-2006-2219
17	WordPress REST API class-wp-rest-users-controller.php information disclosure	5.3	5.1	$5k-$25k	$0-$5k	Functional	Official Fix	0.87410	0.04	CVE-2017-5487
18	Ovidentia CMS index.php sql injection	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00089	0.07	CVE-2021-29343
19	Zoho ManageEngine Desktop Central MSP DLL dcinventory.exe uncontrolled search path	7.0	7.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00102	0.05	CVE-2020-9367
20	Apple macOS Bluetooth memory corruption	4.4	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00057	0.00	CVE-2022-42854

IOC - Indicator of Compromise (20)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	13.107.21.200		Big Head	08/10/2023	verified	High
2	20.99.133.109		Big Head	08/10/2023	verified	High
3	20.99.184.37		Big Head	08/10/2023	verified	High
4	23.41.86.106	a23-41-86-106.deploy.static.akamaitechnologies.com	Big Head	08/10/2023	verified	High
5	XX.XX.XX.XXX	xxx-xx-xx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
6	XX.XX.XXX.XXX	xxx-xx-xxx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
7	XX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
8	XX.XXX.XXX.XX	xxx-xxx-xxx-xx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
9	XX.XXX.XXX.XX	xxx-xxx-xxx-xx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
10	XX.XXX.XX.XX	xx.xx.xxx.xx.xxx.xxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
11	XXX.XX.XXX.XX	xxxx-xx-xxx-xx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
12	XXX.XXX.XXX.XXX	xxxx-xxx-xxx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
13	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxx.xxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
14	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxx.xxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
15	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxx.xxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
16	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxx.xxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
17	XXX.XX.XXX.XXX	xx-xxx-xx-xxx-xxx-xxx.xxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High
18	XXX.XXX.X.X		Xxx Xxxx	08/10/2023	verified	High
19	XXX.XXX.XXX.XXX		Xxx Xxxx	08/10/2023	verified	High
20	XXX.XX.XXX.XXX	x-xxxx.x-xxxxxx.xxx	Xxx Xxxx	08/10/2023	verified	High

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
4	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
6	TXXXX	CAPEC-108	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
9	TXXXX	CAPEC-38	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
10	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
11	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (36)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/alumni/admin/ajax.php?action=save_settings	predictive	High
2	File	/cwp_{SESSION_HASH}/admin/loader_ajax.php	predictive	High
3	File	actions/authenticate.php	predictive	High
4	File	admin/dashboard.php	predictive	High
5	File	college_website/admin/ajax.php?action=login	predictive	High
6	File	xxxxxxxxxx/xxx.xx	predictive	High
7	File	xxxxxxxxx/xxxxxxx/xxxx.xxx	predictive	High
8	File	xxxxxxxxxxx.xxx	predictive	High
9	File	xxxxxxxx/xxxxxxxx.x	predictive	High
10	File	xxx/xxxxxxx.xxx	predictive	High
11	File	xxxxxxx_xxxx_xxxxxx.xxx	predictive	High
12	File	xxxx_xxxxxxx.xxx.xxx	predictive	High
13	File	xxxxx.xxx	predictive	Medium
14	File	xx/xxx/xxxxxxxx/xxx_xxxxxxxxx/xxx_xxxxxxxx_xxxxx/_/xxxxxxx_xxx	predictive	High
15	File	xxxxxxxxxx.xxx	predictive	High
16	File	xxxxxxx/xxxx/xxxx_xxxx.xx	predictive	High
17	File	xxxxxxxxxxxxxxxx.xxx	predictive	High
18	File	xxx/xxxxxx/xx_xxxxxx.x	predictive	High
19	File	xxxxxxxxxxxxxxxx.xx	predictive	High
20	File	xxx/xxxxxxx.x	predictive	High
21	File	xxxxxxxxx.x	predictive	Medium
22	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	High
23	File	\xxx\xxxxx_xxxxxxxxxxxx.xxx	predictive	High
24	Library	xxxxxxxx.xxx	predictive	Medium
25	Argument	xxxxxxx xx/xxxxxxx xxxx	predictive	High
26	Argument	xxxxxxxxxxx	predictive	Medium
27	Argument	xxxxxxxx	predictive	Medium
28	Argument	xx	predictive	Low
29	Argument	xxxxxxxxxxxxxxx	predictive	High
30	Argument	xxxxxxxxx	predictive	Medium
31	Argument	xxxx_xxxxxxx	predictive	Medium
32	Argument	xxxx	predictive	Low
33	Argument	xxxx	predictive	Low
34	Input Value	xxxxxxxx	predictive	Medium
35	Input Value	xxxx+x@!xxxx+	predictive	High
36	Pattern	() {	predictive	Low

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!