JAFF Analysis

IOB - Indicator of Behavior (459)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en380
ru46
de12
zh8
es4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

ru184
us152
lv42
ua12
cn10

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Linux Kernel12
PHP10
Microsoft Windows10
Apache HTTP Server6
Google Android6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1Void Contact Form 7 Widget for Elementor Page Builder Plugin void_cf7_opt_in_user_data_track cross-site request forgery4.34.2$0-$5k$0-$5kNot DefinedNot Defined0.000630.00CVE-2022-47166
2PHP Link Directory Administration Page index.html cross site scripting4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.003740.98CVE-2007-0529
3Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaround0.020160.02CVE-2007-1192
4MGB OpenSource Guestbook email.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.013021.74CVE-2007-0354
5LogicBoard CMS away.php redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable0.000002.60
6Esoftpro Online Guestbook Pro ogp_show.php sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.001080.33CVE-2009-4935
7phpMyAdmin phpinfo.php information disclosure5.35.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.001420.05CVE-2016-9848
8Flat PHP Board path traversal3.33.3$0-$5k$0-$5kNot DefinedNot Defined0.000000.01
9Simple PHP Guestbook guestbook.php cross site scripting3.53.5$0-$5k$0-$5kNot DefinedNot Defined0.000000.02
10212cafe 212cafeboard view.php sql injection7.37.1$0-$5k$0-$5kHighUnavailable0.000640.06CVE-2008-4713
11Tenda AC15/AC1900 setUsbUnload injection8.58.5$0-$5k$0-$5kHighNot Defined0.959250.00CVE-2020-10987
12FreeBSD Ping pr_pack stack-based overflow7.37.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.000430.00CVE-2022-23093
13Googlemaps Plugin plugin_googlemap2_proxy.php resource consumption6.46.1$0-$5k$0-$5kNot DefinedOfficial Fix0.006040.04CVE-2013-7428
14nginx SPDY memory corruption7.36.4$0-$5k$0-$5kUnprovenOfficial Fix0.037110.04CVE-2014-0133
15Apache Spark UI command injection7.17.0$5k-$25k$0-$5kHighOfficial Fix0.972900.27CVE-2022-33891
16HP Router/Switch SNMP information disclosure3.73.4$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.002850.04CVE-2012-3268
17Microsoft Outlook Email Message access control5.95.8$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.006090.02CVE-2017-0204
18PHP unserialize use after free7.36.4$25k-$100k$0-$5kUnprovenOfficial Fix0.000000.05
19LushiWarPlaner register.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.008210.06CVE-2007-0864
20Lars Ellingsen Guestserver guestbook.cgi cross site scripting4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.001690.33CVE-2005-4222

IOC - Indicator of Compromise (37)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
16.43.51.17Jaff02/01/2019verifiedHigh
227.254.44.204JAFF01/01/2018verifiedHigh
331.202.130.2031-202-130-20-kh.maxnet.uaJAFF01/01/2018verifiedHigh
437.59.41.180ns3002298.ip-37-59-41.euJAFF01/01/2018verifiedHigh
546.17.46.214JAFF01/01/2018verifiedHigh
646.173.219.234JAFF01/01/2018verifiedHigh
747.91.107.213JAFF01/01/2018verifiedHigh
877.73.67.163JAFF01/01/2018verifiedHigh
9XX.XXX.XX.XXXxx-xxx-xx-xxx.xxx-xxx.xxxxxxx.xxxxxxxx.xxXxxx01/01/2018verifiedHigh
10XX.XXX.XXX.XXXXxxx01/01/2018verifiedHigh
11XX.XXX.XXX.XXxxx-xxxxxxxxxxx.xxxxxxxx.xxx.xxXxxx01/01/2018verifiedHigh
12XX.XXX.XX.XXxxxxxxxxxxx.xxxxxx.xxxXxxx01/01/2018verifiedHigh
13XX.XXX.XX.XXXXxxx01/01/2018verifiedHigh
14XX.XXX.XXX.XXXxxx01/01/2018verifiedHigh
15XX.XXX.XXX.XXXXxxx01/01/2018verifiedHigh
16XX.XX.XXX.XXxxxxxxx.xxXxxx01/01/2018verifiedHigh
17XX.XXX.XX.XXxxxx.xxxxx.xxXxxx01/01/2018verifiedHigh
18XX.XXX.XXX.XXXxxx01/01/2018verifiedHigh
19XX.XXX.XX.XXxxxxxxx.xxxxxxxxxxx.xxxxxx.xxXxxx01/01/2018verifiedHigh
20XX.XXX.XX.XXxxxxxxxxx.xxxxxxxxxx.xxxXxxx01/01/2018verifiedHigh
21XX.XXX.XXX.XXxxxxxx-xx.xxxxxxx.xxxXxxx01/01/2018verifiedHigh
22XX.XXX.XXX.XXXXxxx01/01/2018verifiedHigh
23XXX.XXX.XX.XXXXxxx01/01/2018verifiedHigh
24XXX.XXX.XX.XXxxxx-xxx-xxx-xx-xx.xxxxxx-xx-xxxxxx.xxXxxx01/01/2018verifiedHigh
25XXX.XXX.XX.XXxxxxxxxx.xxxxxx-xx-xxxxxx.xxXxxx01/01/2018verifiedHigh
26XXX.X.XX.XXXxx.xxxxxxx.xxxXxxx01/01/2018verifiedHigh
27XXX.XX.XXX.XXXxxx.xxx-xxxxxx.xxXxxx01/01/2018verifiedHigh
28XXX.XXX.XXX.XXXXxxx01/01/2018verifiedHigh
29XXX.XXX.XXX.XXXXxxx01/01/2018verifiedHigh
30XXX.XXX.XX.XXXxxxx.xxxxxxxxxxxx.xxxXxxx01/01/2018verifiedHigh
31XXX.XXX.XXX.XXxxxxxxxx.xxxxxxxx.xxXxxx01/01/2018verifiedHigh
32XXX.XXX.XXX.XXXxxxx.xxxxxxxxxx.xxXxxx01/01/2018verifiedHigh
33XXX.XXX.XXX.XXxxxx.xxxxxxxxxxxxx.xxxxxXxxx01/01/2018verifiedHigh
34XXX.XXX.XXX.XXXxxx-xxxxxxxxx-xxxxx.xxxxx-xxxxxxxx.xxxXxxx01/01/2018verifiedHigh
35XXX.XXX.XXX.XXXXxxx01/01/2018verifiedHigh
36XXX.XX.XX.XXXxxx01/01/2018verifiedHigh
37XXX.XX.XXX.XXXxxx01/01/2018verifiedHigh

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (205)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File.htaccesspredictiveMedium
2File/admin/maintenance/view_designation.phppredictiveHigh
3File/category/list?limit=10&offset=0&order=descpredictiveHigh
4File/cgi-bin/login_action.cgipredictiveHigh
5File/cgi-bin/supervisor/PwdGrp.cgipredictiveHigh
6File/cgi-bin/touchlist_sync.cgipredictiveHigh
7File/classes/Master.php?f=delete_brandpredictiveHigh
8File/diag_ping_admin.asppredictiveHigh
9File/forum/away.phppredictiveHigh
10File/forum/PostPrivateMessagepredictiveHigh
11File/goform/formSysCmdpredictiveHigh
12File/HNAP1predictiveLow
13File/owa/auth/logon.aspxpredictiveHigh
14File/pages/systemcall.php?command={COMMAND}predictiveHigh
15File/phppath/phppredictiveMedium
16File/setSystemAdminpredictiveHigh
17File/shellpredictiveLow
18File/spip.phppredictiveMedium
19File/SSOPOST/metaAlias/%realm%/idpv2predictiveHigh
20File/uncpath/predictiveMedium
21File/user/loader.php?api=1predictiveHigh
22File/usr/bin/pkexecpredictiveHigh
23File/webpages/datapredictiveHigh
24File/wp-admin/options.phppredictiveHigh
25File/xxx-xxx-xxxxx/xxxx/xxxpredictiveHigh
26File/__xx/predictiveLow
27Filexxxxxxx.xxxpredictiveMedium
28Filexxxxx/xxxx_xxxxx_xxxx.xxxpredictiveHigh
29Filexxxxx/xxxxxxxx.xxxpredictiveHigh
30Filexxxxx/xxxxx.xxxpredictiveHigh
31Filexxxxxxx.xxx?xxx=xxxxxpredictiveHigh
32Filexxxxx\xxxxx\xxxxxxx\xxxxxxxx.xxxpredictiveHigh
33Filexxxx/xxx/xxxx/xxxxxxxxxxxxxxxpredictiveHigh
34Filexxxx/xxx/xxxx/xxxxxxxxxxxpredictiveHigh
35Filexxx/xxxxxxxxxxx/xxxxxxx_xxxxxxxxxx.xxpredictiveHigh
36Filexxxx-xxxx.xpredictiveMedium
37Filexxxx.xxxpredictiveMedium
38Filexxxxxxxx.xxxpredictiveMedium
39Filexxxxxxxxxxx_xxxxxx.xxxpredictiveHigh
40Filexxxx.xpredictiveLow
41Filexxxx.xxxpredictiveMedium
42Filexxxxxxxxxxx.xxxpredictiveHigh
43Filexxxxxx-xxxxxxxx.xxxpredictiveHigh
44Filexxx-xxx/predictiveMedium
45Filexxx-xxx/xxxx_xxxx.xxxpredictiveHigh
46Filexxx_xxxx.xpredictiveMedium
47Filexx_xxxx.xxxpredictiveMedium
48Filexxxxxxxxx.xxxpredictiveHigh
49Filexxxxxxxxxxx/xxxxxx.xxxpredictiveHigh
50Filexxxxxx/xx/xx_xxxx.xpredictiveHigh
51Filexxxxxx.xxxpredictiveMedium
52Filexxxxxx.xpredictiveMedium
53Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
54Filexxxxxxxx.xxxpredictiveMedium
55Filexxxxxxxx_xxxx_xxxxxxxxxx.xxxxpredictiveHigh
56Filexxxxxxx/xxxxx/xxxxxx/xxxxxx-xxxxxxx.xpredictiveHigh
57Filexxxxx_xxxxxxxxxx.xpredictiveHigh
58Filexxxxx.xxxpredictiveMedium
59Filexxxxx-xxxxxx.xxxpredictiveHigh
60Filexxxx_xxxxxxxx.xxxpredictiveHigh
61Filexxxxxxxx.xxxpredictiveMedium
62Filexxx_xxxxxxxxxxx.xxxpredictiveHigh
63Filexxxxxx/xxxxxxxxxxxxpredictiveHigh
64Filexxxx.xxxpredictiveMedium
65Filexxxxxxxxx.xxxpredictiveHigh
66Filexxxxxxxxx.xxxpredictiveHigh
67Filexxxxxxxxxx/xxxxxxxxxx/xxxxxxxx/xxxxxxxxxxxxxxxxxxx.xxxpredictiveHigh
68Filexxx/xxxxxx.xxxpredictiveHigh
69Filexxxxxxxx/xxxxxxxxx.xxxpredictiveHigh
70Filexxxxx.xxxxpredictiveMedium
71Filexxxxx.xxxpredictiveMedium
72Filexxxxx.xxx/xxxx/xxxxx/xxxx/xxxx.xxxpredictiveHigh
73Filexxxxxxxxx/xxxxxxxxxpredictiveHigh
74Filexxxxxxx/xxxxxxxxxxxxx.xxxxpredictiveHigh
75Filexxxx.xxxpredictiveMedium
76Filexx.xxxpredictiveLow
77Filexxxxxxxxxxxx/xxxxxxxxx.xpredictiveHigh
78Filexxxxxxxx.xxxpredictiveMedium
79Filexxx_xxxx.xxxpredictiveMedium
80Filexxx_xxxxx_xxxx.xpredictiveHigh
81Filexxx/xxxxxxxxx/xx_xxxxxxxxx_xxx.xpredictiveHigh
82Filexxxx.xxxpredictiveMedium
83Filexxx_xxxx.xxxpredictiveMedium
84Filexxx.xpredictiveLow
85Filexxxxxxxxxxxxxxx.xxxpredictiveHigh
86Filexxx-xxxxxxxxx-xxxxxxxxxx-xxxxxx/xxxxx.xxxpredictiveHigh
87Filexxx.xxxpredictiveLow
88Filexxxxxxx.xxxpredictiveMedium
89Filexxxxxx_xxxxxxxxxx_xxxxx.xxxpredictiveHigh
90Filexxxxxx.xpredictiveMedium
91Filexxxxxxx.xxxpredictiveMedium
92Filexxxxxxx.xxx?xx=xxx_xxxxxxxxpredictiveHigh
93Filexxxx.xxxpredictiveMedium
94Filexxxxx.xxxpredictiveMedium
95Filexxxxxxxx.xxxpredictiveMedium
96Filexxxxxxxx.xxxpredictiveMedium
97Filexxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxxpredictiveHigh
98Filexxxxxxxx_xxxx.xxxpredictiveHigh
99Filexxx.xxxpredictiveLow
100Filexxxxxxxxxx_xxxxx.xxxxxxpredictiveHigh
101Filexxx_xxxx_xxxxxxxxx.xxpredictiveHigh
102Filexxx.xpredictiveLow
103Filexxxxxx.xxpredictiveMedium
104Filexxxxxxxxxxxxx.xxxpredictiveHigh
105Filexxxxxxxxxx.xxxpredictiveHigh
106Filexxxxxxxx/xxxx/xxxx.xxx?xxxxxx=xxxxxxxxxxxxxxxxpredictiveHigh
107Filexxx_xxxxxx_xxx.xxxpredictiveHigh
108Filexxxx/xxxxxxxxxx.xxxpredictiveHigh
109Filexxxxxxx.xxxpredictiveMedium
110Filexxxxxxxx-xxxxxxxx-xxxxxxxx.xxxpredictiveHigh
111Filexxxxxx.xxxpredictiveMedium
112Filexxxx/xxx/xxxx-xxxxx.xxxpredictiveHigh
113Filexxxx.xxxpredictiveMedium
114Filexxxxxx.xxxpredictiveMedium
115Filexxxxxxx.xxxpredictiveMedium
116Filexxx/xxxxx/xxxxx.xxxpredictiveHigh
117Filexxxxxxxx.xxxpredictiveMedium
118Filexxxxxxx.xxxpredictiveMedium
119Library/xxxxxxx/xxxxx/xxx.xxxpredictiveHigh
120Library/xxx/xxx/xxx/xxxx/xxxxxxxxxx/xxxxx/xxxxxx.xxxpredictiveHigh
121Library/xxx/xxx/xxx/xxxx/xxxxxxxxxx/xxxxx/xxxxxxxxxx.xxxpredictiveHigh
122ArgumentxxxxxxpredictiveLow
123ArgumentxxxxxxxpredictiveLow
124ArgumentxxxxxxxxxpredictiveMedium
125ArgumentxxxxxxxpredictiveLow
126ArgumentxxxxxxxxpredictiveMedium
127Argumentxxxxx xxxxpredictiveMedium
128ArgumentxxxpredictiveLow
129ArgumentxxxxxxxxpredictiveMedium
130Argumentxxxxxx/xxxxpredictiveMedium
131ArgumentxxxxxxxpredictiveLow
132ArgumentxxxxxxxxxpredictiveMedium
133ArgumentxxxxxxxxxxxxxpredictiveHigh
134ArgumentxxxxxxxxxxxxxxxxpredictiveHigh
135ArgumentxxxxpredictiveLow
136ArgumentxxxxxxxxxxxpredictiveMedium
137ArgumentxxxxxxxxxxpredictiveMedium
138ArgumentxxxxxxxpredictiveLow
139ArgumentxxxxxpredictiveLow
140ArgumentxxxxxxxxpredictiveMedium
141ArgumentxxxxxpredictiveLow
142ArgumentxxxxpredictiveLow
143ArgumentxxxxpredictiveLow
144ArgumentxxpredictiveLow
145ArgumentxxxxxpredictiveLow
146ArgumentxxpredictiveLow
147ArgumentxxxxpredictiveLow
148ArgumentxxxxxxxxpredictiveMedium
149ArgumentxxxxxxxxpredictiveMedium
150ArgumentxxxxpredictiveLow
151Argumentxxxx/xxxxxxpredictiveMedium
152ArgumentxxxxxxxxpredictiveMedium
153ArgumentxxxxxxxxpredictiveMedium
154Argumentxxxx_xxxxpredictiveMedium
155Argumentxxxxx_xxxx_xxxxpredictiveHigh
156ArgumentxxxxxxxxpredictiveMedium
157Argumentxxxxxxxx_xxxxxpredictiveHigh
158ArgumentxxxpredictiveLow
159ArgumentxxxxxxxxpredictiveMedium
160Argumentxxxxxx_xxxxpredictiveMedium
161ArgumentxxxxxxxxxxxxxxpredictiveHigh
162ArgumentxxxxxxxxpredictiveMedium
163ArgumentxxxxxxxxxpredictiveMedium
164Argumentxxxx_xxxxpredictiveMedium
165ArgumentxxxxxxxxxxxpredictiveMedium
166ArgumentxxxxxxxpredictiveLow
167Argumentxxxxxxx_xxxxx/xxxxxxx_xxxxxxx/xxxxxxx_xxxxxxxxxx/xxxxxxx_xxxxpredictiveHigh
168ArgumentxxxxxxxxxpredictiveMedium
169ArgumentxxpredictiveLow
170ArgumentxxxxpredictiveLow
171ArgumentxxxxxxxpredictiveLow
172Argumentxxxxxxx/xxxxxxxpredictiveHigh
173ArgumentxxxxxxpredictiveLow
174Argumentxxx_xxxxx/xxxx_xxxxx/xxxx_xxxxxpredictiveHigh
175Argumentxxxx_xxxxxxxxpredictiveHigh
176ArgumentxxxxpredictiveLow
177ArgumentxxxpredictiveLow
178Argumentxxxxxxxxxx_xxxx_xxxxxxxpredictiveHigh
179ArgumentxxxxxpredictiveLow
180ArgumentxxxxxxxxxxxxxxxpredictiveHigh
181Argumentxxxxxxxxxxx/xxxxxx/xxxxxxxxxx/xxxxxxxxpredictiveHigh
182Argumentx_xxxxxxpredictiveMedium
183ArgumentxxxxpredictiveLow
184Argumentxxxxx_xxxxxpredictiveMedium
185ArgumentxxxpredictiveLow
186ArgumentxxxpredictiveLow
187ArgumentxxxxpredictiveLow
188ArgumentxxxxxxxxpredictiveMedium
189ArgumentxxxxxpredictiveLow
190ArgumentxxxxxpredictiveLow
191Argumentxxxxx_xxx_xxx_xxpredictiveHigh
192ArgumentxxxxpredictiveLow
193ArgumentxxxxxpredictiveLow
194ArgumentxxxxxxpredictiveLow
195Argumentxxxx->xxxxxxxpredictiveHigh
196Argumentx-xxxxxxxxx-xxxxxxpredictiveHigh
197Argument_xxxxxxxpredictiveMedium
198Input Value%xxxxxx+-x+x+xx.x.xx.xxx%xx%xxpredictiveHigh
199Input Value../predictiveLow
200Input Value/%xxpredictiveLow
201Pattern|xx|xx|xx|predictiveMedium
202Network Portxxx/xxxxpredictiveMedium
203Network Portxxx/xxxxxpredictiveMedium
204Network Portxxx/xxx (xxx)predictiveHigh
205Network Portxxx/xxx (xxxx)predictiveHigh

References (3)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!