Deep Panda Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (73)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	70
zh	2
pl	2

Country

us	54
ca	12
cn	6

Actors

Deep Panda	4
Shell Crew	1

Activities

Interest

Timeline

Type

Not Defined	16
Operating System	6
Router Operating System	2
Content Management System	2
Programming Language Software	2

Vendor

Not Defined	26
DZCP	2
Kailash Nadh	2
Linux	2
Thomas R. Pasawicz	2

Product

Unix	2
DZCP deV!L`z Clanportal	2
Smartstore	2
WonderCMS	2
Kailash Nadh boastMachine	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.73	CVE-2010-0966
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.02016	0.00	CVE-2007-1192
3	vsftpd deny_file unknown vulnerability	3.7	3.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00312	0.09	CVE-2015-1419
4	HAProxy Header Field request smuggling	8.2	8.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00207	0.00	CVE-2023-25725
5	nginx request smuggling	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	1.73	CVE-2020-12440
6	Exacq exacqVision Enterprise System Manager improper authorization	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00112	0.00	CVE-2019-7588
7	Smartstore WebApi Authentication improper authentication	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00309	0.00	CVE-2020-15243
8	codemirror Regular Expression incorrect regex	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01484	0.05	CVE-2020-7760
9	WordPress Pingback server-side request forgery	5.7	5.7	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00120	0.00	CVE-2022-3590
10	WordPress Private Post access control	4.6	4.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00272	0.04	CVE-2020-11028
11	Oracle Solaris Common Desktop Environment format string	8.3	7.9	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00043	0.00	CVE-2022-43752
12	JunosOS J-Web input validation	7.8	7.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00275	0.00	CVE-2022-22241
13	Microsoft Windows Workstation Service stack-based overflow	7.3	6.8	$100k and more	$0-$5k	High	Official Fix	0.96352	0.02	CVE-2006-4691
14	Todd Miller sudo sudoedit sudoers access control	7.8	7.0	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00061	0.05	CVE-2015-5602
15	WonderCMS Plugin Installer index.php addCustomThemePluginRepository server-side request forgery	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.12296	0.00	CVE-2020-35313
16	PostgreSQL os command injection	5.9	5.9	$0-$5k	$0-$5k	High	Not Defined	0.97490	0.05	CVE-2019-9193
17	Dovecot Indexer-Worker Process memory corruption	8.1	8.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.00	CVE-2019-7524
18	SmartStoreNET Privilege Escalation	7.6	7.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00353	0.00	CVE-2020-27996
19	CutePHP CuteNews unrestricted upload	7.5	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02107	0.08	CVE-2019-11447
20	Cisco Firepower System Software Detection Engine input validation	6.9	6.8	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00140	0.02	CVE-2019-12697

Campaigns (1)

These are the campaigns that can be associated with the actor:

Log4Shell

IOC - Indicator of Compromise (9)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	1.9.5.38		Deep Panda		01/01/2021	verified	High
2	103.224.80.76		Deep Panda		08/04/2022	verified	High
3	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxxx.xxxxxxxxx.xxx	Xxxx Xxxxx	Xxxxxxxxx	04/01/2022	verified	High
4	XXX.XX.XX.XXX	xxx.xxx.xxxx	Xxxx Xxxxx		12/16/2020	verified	High
5	XXX.XX.XXX.X		Xxxx Xxxxx		12/16/2020	verified	High
6	XXX.XX.XX.XX	xxxx.xx-xxx-xx-xx.xxx	Xxxx Xxxxx	Xxxxxxxxx	04/01/2022	verified	High
7	XXX.XXX.XXX.XXX		Xxxx Xxxxx		12/16/2020	verified	High
8	XXX.XXX.XX.XXX		Xxxx Xxxxx		01/01/2021	verified	High
9	XXX.XX.XXX.X	xxxxxxxxxxxx.xxxxxx.xxxxx.xxx	Xxxx Xxxxx		01/01/2021	verified	High

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	TXXXX.XXX	CAPEC-18	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX	CAPEC-108	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
6	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
9	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
10	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (17)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/etc/sudoers	predictive	Medium
2	File	data/gbconfiguration.dat	predictive	High
3	File	fs/aio.c	predictive	Medium
4	File	xxx/xxxxxx.xxx	predictive	High
5	File	xxxxx.xxx	predictive	Medium
6	File	xxxxx.xxx?xxx=xxxx&xxx=xxxxxxxx	predictive	High
7	File	xxxxx_xx.xxxx	predictive	High
8	File	xxx/xxxx/xxxx.xx	predictive	High
9	File	xxxxxxxx.x	predictive	Medium
10	File	xxxxxxxx.xxx	predictive	Medium
11	File	xxxxxx/xxx/xx/xxx.xx	predictive	High
12	Argument	xxxxxx_xxxx	predictive	Medium
13	Argument	xxxxxxxx	predictive	Medium
14	Argument	xxxxxx_xx	predictive	Medium
15	Argument	xx_xxxxxx	predictive	Medium
16	Argument	xxx	predictive	Low
17	Pattern	\|xx xx\|	predictive	Low

References (7)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!