PowerShell Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (43)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	44

Country

us	8
cn	8

Actors

Patchwork	1
Cobalt Strike	1
Baldr	1
Nemty	1
Sload	1

Activities

Interest

Timeline

Type

Forum Software	20
Not Defined	10
Operating System	2
Programming Language Software	2
Chip Software	2

Vendor

Not Defined	28
Linux	2
DZCP	2
Qualcomm	2
Laravel	2

Product

phpBB	10
vBulletin	6
PunBB	4
Linux Kernel	2
EDK II	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.02016	0.00	CVE-2007-1192
2	EDK II DxeCore memory corruption	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00181	0.00	CVE-2018-12183
3	Apache Tomcat Incomplete Fix CVE-2020-9484 deserialization	7.2	6.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00055	0.04	CVE-2021-25329
4	Qualcomm Snapdragon Mobile camx Driver use after free	6.5	6.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00044	0.06	CVE-2020-3701
5	PHP phpinfo cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.01960	0.05	CVE-2007-1287
6	Cisco PIX memory leak	7.5	6.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.01896	0.04	CVE-2009-1157
7	Adobe Acrobat Reader Smart Independent Glyphlets CoolType.dll memory corruption	5.0	4.8	$25k-$100k	$0-$5k	High	Official Fix	0.71252	0.00	CVE-2010-2883
8	Microsoft Windows Remote Desktop Service code injection	10.0	9.0	$100k and more	$0-$5k	High	Official Fix	0.78895	0.08	CVE-2012-0002
9	D-Link DIR-823G HNAP1 GetNetworkTomographyResult os command injection	8.5	8.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.71575	0.00	CVE-2019-7297
10	NASA RtRetrievalFramework deserialization	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00399	0.00	CVE-2018-1000048
11	Zend Framework Zend_Db_Select sql injection	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00895	0.04	CVE-2016-4861
12	Laravel Framework Permission .env writeNewEnvironmentFileWith Password information disclosure	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.11608	0.08	CVE-2017-16894
13	vBulletin decodeArguments input validation	7.3	7.3	$0-$5k	$0-$5k	High	Not Defined	0.74237	0.00	CVE-2015-7808
14	vBulletin cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01146	0.00	CVE-2004-1824
15	Tapatalk Plugin XMLRPC API unsubscribe_forum.php sql injection	8.5	7.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00242	0.00	CVE-2014-2023
16	phpBB Perl ucp_pm_options.php message_options cross-site request forgery	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00335	0.02	CVE-2015-1432
17	vBulletin sql injection	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00214	0.00	CVE-2014-5102
18	PunBB cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00199	0.00	CVE-2010-0455
19	vBulletin redirector.php	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00106	0.03	CVE-2018-6200
20	vBulletin Vbulletin Forum Remote Code Execution	9.8	8.5	$0-$5k	$0-$5k	Unproven	Official Fix	0.00620	0.00	CVE-2012-4328

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	45.76.53.253	45.76.53.253.vultrusercontent.com	PowerShell	10/07/2022	verified	High
2	XX.XX.XXX.XX		Xxxxxxxxxx	04/12/2022	verified	High
3	XXX.XXX.XXX.XXX	xxxxx.xx-xxx-xxx-xxx.xx	Xxxxxxxxxx	08/04/2022	verified	High

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
2	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX	CAPEC-108	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
5	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
7	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (35)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/.env	predictive	Low
2	File	/HNAP1	predictive	Low
3	File	ajax/api/hook/decodeArguments	predictive	High
4	File	breadcrumbs_create.php	predictive	High
5	File	data/gbconfiguration.dat	predictive	High
6	File	xxxxxxx/xxx/xxx/xxx/xxx_xxx.x	predictive	High
7	File	xxxxxxxxxxx/xxxxxxxx/xxxxxxxxxx.xxx	predictive	High
8	File	xxx/xxxxxx.xxx	predictive	High
9	File	xxxxxxxx/xxxxxxx.xxx	predictive	High
10	File	xxxxxxxx/xxx/xxx_xx_xxxxxxx.xxx	predictive	High
11	File	xxxxxxx.xxx	predictive	Medium
12	File	xxxxx.xxx	predictive	Medium
13	File	xxxxx.xxx	predictive	Medium
14	File	xxxxxxxx.xxx	predictive	Medium
15	File	xxxxxxx.xxx	predictive	Medium
16	File	xxxxxxxxxx.xxx	predictive	High
17	File	xxxxxxxx.xxx	predictive	Medium
18	File	xxxxx/xxx/xxxx/xxxx_xxxxxxxx.x	predictive	High
19	File	xxxxxxxxxxx_xxxxx.xxx	predictive	High
20	File	xxxxxxxxxxxxxx.xxx	predictive	High
21	Library	xxxxxxxx.xxx	predictive	Medium
22	Argument	xxxxxxxxx	predictive	Medium
23	Argument	xxxxxxxx	predictive	Medium
24	Argument	xxxxxxxxx	predictive	Medium
25	Argument	xxx_xxxx	predictive	Medium
26	Argument	xxxxx_xxxx_xxx	predictive	High
27	Argument	xxx	predictive	Low
28	Argument	xxxxxxx	predictive	Low
29	Argument	xxxx	predictive	Low
30	Argument	xxxxxxxxxxxxxxxx	predictive	High
31	Argument	xxxxx	predictive	Low
32	Argument	xxxxxx	predictive	Low
33	Argument	xxxxxxxxxx	predictive	Medium
34	Argument	xxx	predictive	Low
35	Network Port	xxx/xxxx (xxx)	predictive	High

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!