IMG Files Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (9)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

zh	4
de	4
en	2

Country

de	6
cn	4

Actors

Mekotio	1
Nanocore RAT	1

Activities

Interest

Timeline

Type

Programming Language Software	2
Game Console	2
Database Software	2
Web Server	2
Not Defined	2

Vendor

Maran	2
Sony	2
Oracle	2
Microsoft	2
VMware	2

Product

Maran PHP Shop	2
Sony Playstation 3	2
Oracle MySQL Server	2
Microsoft IIS	2
VMware RabbitMQ	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Oracle MySQL Server Packaging information disclosure	7.5	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00092	0.00	CVE-2022-43551
2	VMware RabbitMQ AMQP Client denial of service	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00134	0.06	CVE-2021-22116
3	RabbitMQ Management UI cross site scripting	2.4	2.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00096	0.04	CVE-2021-32718
4	Boxoft WAV to MP3 Converter memory corruption	5.3	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00000	0.01
5	Sony Playstation 3 Save Game PARAM.SFO privileges management	7.4	7.0	$25k-$100k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
6	GStreamer ID3v2 Tag memory corruption	7.3	6.4	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00000	0.02
7	Maran PHP Shop prod.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00137	0.05	CVE-2008-4879
8	Microsoft IIS cross site scripting	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.12	CVE-2017-0055
9	OpenLDAP LDAP Authentication krbv4_ldap_auth memory corruption	7.3	6.9	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.10779	0.02	CVE-2006-6493

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	185.101.94.172	kruxaw.de	IMG Files		01/16/2020	verified	High

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	High
2	TXXXX	CAPEC-122	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
3	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (4)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/uncpath/	predictive	Medium
2	File	xxxxx.xxx	predictive	Medium
3	File	xxxx.xxx	predictive	Medium
4	Argument	xxx	predictive	Low

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!