Creal Stealer Analysis

IOB - Indicator of Behavior (860)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en786
es36
fr16
de6
ru4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us108
ca40
cn18
cz16
gb16

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Google Chrome38
Adobe Experience Manager30
Microsoft Edge26
Microsoft Windows14
Apple macOS14

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1Symantec Data Loss Prevention cross site scripting3.83.8$0-$5k$0-$5kNot DefinedNot Defined0.961690.00CVE-2019-9701
2Microsoft Edge v8 out-of-bounds write6.36.0$25k-$100k$5k-$25kHighOfficial Fix0.602840.00CVE-2021-30632
3PostgreSQL Client Application downgrade5.65.3$0-$5k$0-$5kNot DefinedOfficial Fix0.003820.04CVE-2020-25694
4Intel Driver & Support Assistant permission6.15.9$5k-$25k$0-$5kNot DefinedOfficial Fix0.000440.00CVE-2020-12302
5Huawei AR3200 SCTP Message integer overflow6.46.4$5k-$25k$5k-$25kNot DefinedNot Defined0.002090.00CVE-2017-15344
6I-O DATA DEVICE TS-WRLP/TS-WRLA Credentials information disclosure6.46.4$0-$5k$0-$5kNot DefinedNot Defined0.002000.00CVE-2016-7814
7IBOS OA export&checkids=x sql injection7.57.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000770.31CVE-2023-4545
8Cisco SD-WAN vManage REST API access control9.89.4$5k-$25k$5k-$25kNot DefinedOfficial Fix0.001020.05CVE-2023-20214
9typcn Blogile server.js getNav sql injection6.96.9$0-$5k$0-$5kNot DefinedOfficial Fix0.001480.09CVE-2014-125049
10HPI-Information-Systems ProLOD sql injection6.96.9$0-$5k$0-$5kNot DefinedOfficial Fix0.001480.14CVE-2015-10017
11D-Link DIR-825 xupnpd command injection8.88.8$5k-$25k$5k-$25kNot DefinedNot Defined0.000830.07CVE-2022-43642
12Linux Kernel NFSD buffer size7.57.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.001150.04CVE-2022-43945
13Apple iOS/iPadOS WebKit out-of-bounds write6.36.0$25k-$100k$25k-$100kHighOfficial Fix0.005260.00CVE-2022-32893
14Google Chrome Interest Groups use after free6.36.0$25k-$100k$5k-$25kNot DefinedOfficial Fix0.007310.02CVE-2022-2157
15Nagios XI AutoDiscovery path traversal6.36.0$0-$5k$0-$5kNot DefinedOfficial Fix0.484560.03CVE-2021-37343
16Microsoft Edge memory corruption7.57.1$25k-$100k$5k-$25kHighOfficial Fix0.040960.05CVE-2021-26411
17Google Android MessageQueueBase.h beginRead out-of-bounds write6.05.7$25k-$100k$0-$5kNot DefinedOfficial Fix0.000420.00CVE-2021-0585
18Oracle Business Intelligence Enterprise Edition Analytics Actions unknown vulnerability8.27.8$5k-$25k$0-$5kNot DefinedOfficial Fix0.001920.00CVE-2020-14815
19Advanced Poll comments.php cross site scripting4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.001930.00CVE-2006-1617
20Siemens SIMATIC S7-300 CPU S7 Packet resource management6.46.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.001030.05CVE-2018-16561

IOC - Indicator of Compromise (16)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (26)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueClassVulnerabilitiesAccess VectorTypeConfidence
1T1006CAPEC-126CWE-22, CWE-23, CWE-25, CWE-35Path TraversalpredictiveHigh
2T1040CAPEC-102CWE-319Authentication Bypass by Capture-replaypredictiveHigh
3T1055CAPEC-10CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveHigh
4T1059CAPEC-137CWE-88, CWE-94Argument InjectionpredictiveHigh
5T1059.007CAPEC-209CWE-79, CWE-80Cross Site ScriptingpredictiveHigh
6T1068CAPEC-122CWE-264, CWE-269, CWE-284Execution with Unnecessary PrivilegespredictiveHigh
7TXXXXCAPEC-150CWE-XXXXxxx Xxx Xxxxxxxxx Xxxxxxxxxxx XxxxxxxxpredictiveHigh
8TXXXX.XXXCAPEC-16CWE-XXX, CWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveHigh
9TXXXXCAPEC-136CWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveHigh
10TXXXX.XXXCAPEC-178CWE-XXXXxxx XxxxxxxxpredictiveHigh
11TXXXXCAPEC-CWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveHigh
12TXXXXCAPEC-CWE-XXXXXxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxx Xxxxxxxx Xxxx Xx X Xxxxxxxx XxxxxxpredictiveHigh
13TXXXXCAPEC-1CWE-XXX, CWE-XXXXxxxxxxxxx XxxxxxpredictiveHigh
14TXXXXCAPEC-108CWE-XXXxx XxxxxxxxxpredictiveHigh
15TXXXX.XXXCAPEC-1CWE-XXXXxxxxxxx XxxxxxxxxxxxxpredictiveHigh
16TXXXXCAPEC-102CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveHigh
17TXXXXCAPEC-102CWE-XXXXxxxxxx Xxxxxxxxxx Xx Xxx-xxxxxxxxpredictiveHigh
18TXXXX.XXXCAPEC-220CWE-XXXXxxxxxxxx XxxxxxxxxpredictiveHigh
19TXXXX.XXXCAPEC-154CWE-XXXXxxxxxxxxxxxpredictiveHigh
20TXXXXCAPEC-38CWE-XXX, CWE-XXXXxxxxxxxx Xxxxxx XxxxpredictiveHigh
21TXXXX.XXXCAPEC-459CWE-XXXXxxxxxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHigh
22TXXXXCAPEC-116CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveHigh
23TXXXXCAPEC-157CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveHigh
24TXXXX.XXXCAPEC-112CWE-XXX, CWE-XXX, CWE-XXXXxx Xxxxxxxxxx XxxxxpredictiveHigh
25TXXXX.XXXCAPEC-1CWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveHigh
26TXXXXCAPEC-CWE-XXXXxxxxxxxxxx XxxxxxpredictiveHigh

IOA - Indicator of Attack (220)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File.htaccesspredictiveMedium
2File/?r=recruit/resume/edit&op=statuspredictiveHigh
3File/admin/conferences/get-all-status/predictiveHigh
4File/admin/store.phppredictiveHigh
5File/admin_ping.htmpredictiveHigh
6File/ample/app/action/edit_product.phppredictiveHigh
7File/api/dashboard/activitypredictiveHigh
8File/api/system/sessionspredictiveHigh
9File/app/api/controller/default/Sqlite.phppredictiveHigh
10File/BRS_netgear_success.htmlpredictiveHigh
11File/cgi-bin/cstecgi.cgipredictiveHigh
12File/cgi-bin/cstecgi.cgi?action=loginpredictiveHigh
13File/cgi-bin/system_mgr.cgipredictiveHigh
14File/dana-admin/user/update.cgipredictiveHigh
15File/dashboard/depositpredictiveHigh
16File/goform/setAutoPingpredictiveHigh
17File/home/<user>/SecurityOnion/setup/so-setuppredictiveHigh
18File/importexport.phppredictiveHigh
19File/loginpredictiveLow
20File/LoginAdminpredictiveMedium
21File/myprofile.phppredictiveHigh
22File/rom-0predictiveLow
23File/scripts/uistrings.cgipredictiveHigh
24File/Supply_Management_System/admin/edit_retailer.phppredictiveHigh
25File/trx_addons/v2/get/sc_layoutpredictiveHigh
26File/typo3/record/editpredictiveHigh
27File/xxxxxxx/predictiveMedium
28File/xxxx/xxx/xxxxxxxxxx.xxxpredictiveHigh
29File/xxx/xxxxx/xxx/xxxxxxxxxx_xxxx_xxxxxx.xxxpredictiveHigh
30File/xxxxxxxxxpredictiveMedium
31File/xxx/xxxxx/xxxxpredictiveHigh
32File?x=xxxxxxx/xxxxxxxx/xxxxxx&xxxxxxxx=xpredictiveHigh
33Filexxxxxx/xxxx/xxxxxx.xxxxpredictiveHigh
34Filexxx.xxxpredictiveLow
35Filexxxxx/xxxxxx/xxxxxx.xxxpredictiveHigh
36Filexxxxx/xxxx-xxxxxx-xxxxxxxxxxxxxx.xxxpredictiveHigh
37Filexxxxx/xxxxx.xxxpredictiveHigh
38Filexxx/xxpredictiveLow
39Filexxx/xxxx/xxxxx/xxxx.xxxpredictiveHigh
40Filexxx/xxxxx/xxxxxx/xxxxx/xxxxx.xxxpredictiveHigh
41Filexxxxx.xxxpredictiveMedium
42Filexxxx-xxxxxx.xpredictiveHigh
43Filexxxxxxxx.xxxpredictiveMedium
44Filexx_xxxxxxx.xxxpredictiveHigh
45Filexx-xxxxx/xx-xxxxx.xxxpredictiveHigh
46Filexxxx_xxxx_xxxxxxx.xxxpredictiveHigh
47Filexxx-xxx/xxxxxxxxxpredictiveHigh
48Filexxx-xxx/xxxxx_xxx_xxxpredictiveHigh
49Filexxx.xxxpredictiveLow
50Filexxxxxx/xxx.xpredictiveMedium
51Filexxxxxx/xxxx.xpredictiveHigh
52Filexxxxxxxx.xxxpredictiveMedium
53Filexxx_xxxxxxx_xxxxxxxxx_xxxxxxxxx_xxxxxxxxxxxxxx.xxxpredictiveHigh
54Filexxxxxx/xxxx/xx/xxxx.xxxpredictiveHigh
55Filexxxxxxx.xxxpredictiveMedium
56Filexxxxxxxxxxxxxx.xxxpredictiveHigh
57Filexxxxxx.xxxpredictiveMedium
58Filexxxxx.xpredictiveLow
59Filexxxxxxxxxx.xxxpredictiveHigh
60Filexxxx.xpredictiveLow
61Filexxxxxxxxxx.xpredictiveMedium
62Filexxxxx.xxxpredictiveMedium
63Filexxxxxxxx.xxxpredictiveMedium
64Filexxxxxxx/xxxxx/xxxxxxxx/xxxxxpredictiveHigh
65Filexxxxx.xxxpredictiveMedium
66Filexxxxxxxxxxx/xxxx-xxxxxx-xxxxxx.xxxpredictiveHigh
67Filexxxxx.xxxpredictiveMedium
68Filexxxxx.xxxpredictiveMedium
69Filexxxxxx/xxxxxxxxxxx/xxxxxxxxxx/xxxxxxxxpredictiveHigh
70Filexxxxxxxxxxxxxxxxx.xxxpredictiveHigh
71Filexxxxxxxxxxx.xxxpredictiveHigh
72Filexx/xxxxx_xxx.xpredictiveHigh
73Filexxxxxxx/xxxxxx/xxxxxx_xxxxx/xxxxxx/xxxxxx.xxxpredictiveHigh
74Filexxxxxxx/xxxx/xxxxxx/xxxxxx.xxxpredictiveHigh
75Filexxxx_xxxxxxx.xxx.xxxpredictiveHigh
76Filexxxxxxx-xxxxxx/xxxx/xxxxxx.xxxpredictiveHigh
77Filexxxxxxx/xxxxx/xxxxx.xpredictiveHigh
78Filexxxxxxxx/xxxxxxxxx.xxxpredictiveHigh
79Filexxxxx.xxxpredictiveMedium
80Filexx_xxx_xxxxxx_xxx.xpredictiveHigh
81Filexxxxxx.xpredictiveMedium
82Filexxxxxxxxxxxx/xxx_xxxxxxx.xpredictiveHigh
83Filexxxxx.xxxpredictiveMedium
84Filexxxxx/xxxxxx-xxxxxx.xpredictiveHigh
85Filexxxxxx/xxxxxxxxx.xxxpredictiveHigh
86Filexxxxxxxxxxxxxxxx.xpredictiveHigh
87Filexxx_xxxx.xxxpredictiveMedium
88Filexxxxxxx/xxxxxxxxxx/xxxx_xxxxxxx.xxxpredictiveHigh
89Filexxxxxxxx_xxx.xxxpredictiveHigh
90Filexxx/xxxx/xxxx_xxxxxxxxxx_xxxx.xpredictiveHigh
91Filexxx/xxxx/xxx_xxxxxx.xpredictiveHigh
92Filexxx/xxxx/xxxx.xpredictiveHigh
93Filexxx/xxx_xx.xpredictiveMedium
94Filexxxxx.xpredictiveLow
95Filexxxxxxxxxxxx.xxxxpredictiveHigh
96Filexxxxxxxx.xpredictiveMedium
97Filexxxxx.xxxxpredictiveMedium
98Filexxxxxxxxx.xxxpredictiveHigh
99Filexxxxxxxxxxxxx.xxxpredictiveHigh
100Filexxxxxx_xxxxx/xxxx_xxxxxxxxpredictiveHigh
101Filexxxxxxxxxxxx.xxxxpredictiveHigh
102Filexxxxxxxxxxxxxx.xxxpredictiveHigh
103Filexxxxxx/xxxxx.xxxpredictiveHigh
104Filexxxxxx.xxpredictiveMedium
105Filexxxx.xxxpredictiveMedium
106Filexxxx.xxx?xxxxxxx=xxxxxxxxxxpredictiveHigh
107Filexxx.xxxpredictiveLow
108Filexxx/xxxxxxx/xxxxxxxxxxxxxx.xxxpredictiveHigh
109Filexxx/xxxx_xx_xxx.xpredictiveHigh
110Filexxxxxx/xxxxx/xxxxxxxxxx.xxxpredictiveHigh
111Filexxx.xxxpredictiveLow
112Filexxxxx.xpredictiveLow
113Filexxxx.xxxpredictiveMedium
114Filexxxxxxxxxxxxxxx.xxxpredictiveHigh
115Filexxxx.xpredictiveLow
116Filexxx/xxx_xxx.xpredictiveHigh
117Filexxxxx.xpredictiveLow
118Filexxxxxxx.xxxpredictiveMedium
119Filexxx/xxxx/xxxx_xxxxx.xxxpredictiveHigh
120Filexx-xxxxxxxx/xxxxx-xx-xxxxx.xxxpredictiveHigh
121Library/xxx/xxxx/xxxxx.x/xx-xxxx-xxxxxxx.xxxxxpredictiveHigh
122Libraryxxxxxxxxx.xxxpredictiveHigh
123Libraryxxx/xxx-xxxx.xpredictiveHigh
124Libraryxxx/xxxxxxxxxxxxxxxx.xxxpredictiveHigh
125Libraryxxxxxxxxx.xxpredictiveMedium
126Libraryxxxxx.xxxpredictiveMedium
127Libraryxxxxxxxxx.xxxpredictiveHigh
128Libraryxxxxxxxxxxxxxxx.xxxpredictiveHigh
129Argumentxxxxxxxx_xxxxpredictiveHigh
130ArgumentxxxxxxxxxpredictiveMedium
131Argumentxxx_xxxxpredictiveMedium
132ArgumentxxxxxxxxxpredictiveMedium
133Argumentxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxx/xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxpredictiveHigh
134ArgumentxxxxxxxxxxxpredictiveMedium
135ArgumentxxxxxxpredictiveLow
136Argumentxxx[x]['xxxxxxx']/xxx[x]['xxxx']/xxxxxx['xxxxxxx']predictiveHigh
137ArgumentxxxxxpredictiveLow
138ArgumentxxxpredictiveLow
139ArgumentxxxxpredictiveLow
140Argumentxxxxxxx/xxxxxxxxxxxpredictiveHigh
141Argumentxxxxxxx-xxxxxxpredictiveHigh
142Argumentxxxx[xxx_xxxx_xxxxxxx]*[xxxx][xxxx][xxxx][xxxxxxxx][xxxx]predictiveHigh
143Argumentxxx_xxxpredictiveLow
144Argumentxxxxxx_xxxpredictiveMedium
145ArgumentxxxxxxxxxxxxxxxxxxxpredictiveHigh
146Argumentxxx_xxxxxpredictiveMedium
147ArgumentxxxxxxpredictiveLow
148ArgumentxxxpredictiveLow
149ArgumentxxxxxpredictiveLow
150ArgumentxxxxpredictiveLow
151ArgumentxxxxxxxxpredictiveMedium
152ArgumentxxxxxxxxpredictiveMedium
153ArgumentxxxxxxxxxxpredictiveMedium
154ArgumentxxxxpredictiveLow
155ArgumentxxxxxxxpredictiveLow
156ArgumentxxpredictiveLow
157Argumentxx/xxxxxpredictiveMedium
158Argumentxx_xxxxxxxpredictiveMedium
159Argumentxxxx_xxxx/xxxx_xxxxpredictiveHigh
160Argumentxxxx[]predictiveLow
161ArgumentxxxxxxxpredictiveLow
162ArgumentxxxxpredictiveLow
163Argumentxxxx_xxxxx/xxxx_xxxxxx/xxxx_xxxx_xxx/xxxx_xxx_xxxx_xxx/xxxx_xxxxxxxx/xxxx_xxxxxxxxxxxpredictiveHigh
164ArgumentxxxxxxxxxpredictiveMedium
165ArgumentxxxxxxxxxxxxxxxxxpredictiveHigh
166ArgumentxxxxpredictiveLow
167ArgumentxxxxpredictiveLow
168Argumentxxxx_xpredictiveLow
169ArgumentxxxxxxxxxxxpredictiveMedium
170Argumentxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxpredictiveHigh
171ArgumentxxxxxxxpredictiveLow
172Argumentxxx_xxxxxx_xxxxxxxxpredictiveHigh
173Argumentxx/xxxxpredictiveLow
174ArgumentxxxxpredictiveLow
175ArgumentxxxxxxxxxxxxxxpredictiveHigh
176ArgumentxxxxxxxpredictiveLow
177Argumentxxxxx_xxpredictiveMedium
178Argumentxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx$xxxxxxxxxpredictiveHigh
179ArgumentxxxxxxxpredictiveLow
180ArgumentxxxxxxxxpredictiveMedium
181ArgumentxxxxxpredictiveLow
182ArgumentxxxxxxxxpredictiveMedium
183Argumentxxxx_xxpredictiveLow
184Argumentxxxx_xxxxxxpredictiveMedium
185Argumentxxxx_xxpredictiveLow
186ArgumentxxxxpredictiveLow
187ArgumentxxxxxxxxxpredictiveMedium
188ArgumentxxxxxpredictiveLow
189ArgumentxxxxxxxxpredictiveMedium
190ArgumentxxxxxxxpredictiveLow
191ArgumentxxxxxxxxpredictiveMedium
192Argumentxxxxxx_xxxxx/xxxx_xxxxxxxxpredictiveHigh
193Argumentxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxpredictiveHigh
194ArgumentxxpredictiveLow
195ArgumentxxxxxxxpredictiveLow
196ArgumentxxxxxxxxxxpredictiveMedium
197ArgumentxxxpredictiveLow
198ArgumentxxxpredictiveLow
199ArgumentxxxxpredictiveLow
200ArgumentxxxxxpredictiveLow
201ArgumentxxxxxpredictiveLow
202ArgumentxxxxxxxxxpredictiveMedium
203ArgumentxxxxpredictiveLow
204ArgumentxxxxpredictiveLow
205ArgumentxxxxxxxxpredictiveMedium
206Argumentxxxxxxxx/xxxxxxxxpredictiveHigh
207ArgumentxxxxxpredictiveLow
208Argumentxxx_xxxxxxxx_xxxpredictiveHigh
209Argument__xxxxxxpredictiveMedium
210Input Value%xxx%xxx%xxx%xxxpredictiveHigh
211Input Valuex%xxxx%xxx=xpredictiveMedium
212Input Valuexxx[…]predictiveMedium
213Input ValuexxxpredictiveLow
214Pattern|xx xx xx xx|predictiveHigh
215Network Portxxx/xxx (xxx)predictiveHigh
216Network Portxxxx/xxxxxpredictiveMedium
217Network Portxxxx xxxxxxxpredictiveMedium
218Network Portxxx/xxxx (xxx)predictiveHigh
219Network PortxxxpredictiveLow
220Network Portxxx xxxxxx xxxxpredictiveHigh

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Might our Artificial Intelligence support you?

Check our Alexa App!