Sagent Analysis

IOB - Indicator of Behavior (437)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en398
de22
es12
fr4
zh2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us372
de24
co14
au6
es4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Google Android18
Oracle Java SE10
Adobe Experience Manager8
Foxit Reader8
Microsoft Windows6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1LogicBoard CMS away.php redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable0.000001.99
2Omron CX-One CX-Programmer Password Storage information disclosure5.95.7$0-$5k$0-$5kNot DefinedOfficial Fix0.000420.00CVE-2015-0988
3OpenX adclick.php redirect5.34.7$0-$5k$0-$5kUnprovenUnavailable0.004400.23CVE-2014-2230
4Oracle Java SE/JRE SunToolkit rt.jar setAccessible privileges management9.89.4$25k-$100k$0-$5kHighOfficial Fix0.975230.04CVE-2012-4681
5D-Link DIR-636L NCC Service improper authentication9.39.1$5k-$25k$0-$5kHighOfficial Fix0.938310.00CVE-2015-1187
6Google Chrome Prerendering privileges management5.65.4$100k and more$0-$5kNot DefinedOfficial Fix0.006120.05CVE-2013-2887
7Google Android APK Package Signature cryptographic issues8.17.3$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.001400.00CVE-2013-4787
8LG Optimus G E973 HiddenMenu User access control4.44.2$25k-$100k$0-$5kProof-of-ConceptNot Defined0.000500.04CVE-2013-3666
9Apple iOS Locking code injection4.03.6$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.546530.00CVE-2013-0912
10Belkin WeMo Distribution Feed cryptographic issues5.34.6$0-$5k$0-$5kUnprovenOfficial Fix0.001010.04CVE-2013-6950
11Microsoft Internet Explorer Event resource management6.35.9$25k-$100k$0-$5kHighOfficial Fix0.966720.06CVE-2010-0249
12OpenSSL TLS/DTLS Heartbeat t1_lib.c dtls1_process_heartbeat memory corruption7.57.3$25k-$100k$0-$5kHighOfficial Fix0.974850.03CVE-2014-0160
13Microsoft Windows Kerberos KDC EsikmoRoll access control8.88.4$25k-$100k$0-$5kHighOfficial Fix0.972090.04CVE-2014-6324
14Mozilla Bugzilla Account Creation access control5.34.6$5k-$25k$0-$5kUnprovenOfficial Fix0.012090.03CVE-2014-1572
15Kaonmedia CG2001-AN22A/CG2001-UDBNA/CG2001-UN2NA Credentials credentials management7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.004570.02CVE-2018-20390
16nginx request smuggling6.96.9$0-$5k$0-$5kNot DefinedNot Defined0.002411.92CVE-2020-12440
17Pyrophobia out.php cross site scripting4.34.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.001820.06CVE-2007-1159
18GetSimpleCMS index.php redirect6.66.6$0-$5k$0-$5kNot DefinedNot Defined0.001230.00CVE-2019-9915
19SourceCodester Microfinance Management System addcustomerHandler.php cross site scripting4.33.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.000720.04CVE-2022-1081
20Serendipity exit.php privileges management6.36.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.26

IOC - Indicator of Compromise (64)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
18.249.225.254Sagent05/05/2022verifiedHigh
28.253.45.248Sagent05/05/2022verifiedHigh
38.253.131.111Sagent05/05/2022verifiedHigh
48.253.131.120Sagent05/05/2022verifiedHigh
513.32.202.80server-13-32-202-80.iad66.r.cloudfront.netSagent05/06/2022verifiedHigh
623.199.71.185a23-199-71-185.deploy.static.akamaitechnologies.comSagent05/05/2022verifiedHigh
723.199.71.200a23-199-71-200.deploy.static.akamaitechnologies.comSagent05/05/2022verifiedHigh
837.187.11.160ns315812.ip-37-187-11.euSagent05/05/2022verifiedHigh
943.229.62.186rocket-cheese.bnr.laSagent04/12/2022verifiedHigh
1043.229.84.164mail.intelligence.com.sgSagent05/05/2022verifiedHigh
1165.99.252.200hv3svg038.neubox.netSagent04/29/2022verifiedHigh
1267.217.34.70ek.hosting-mexico.netSagent04/29/2022verifiedHigh
1368.66.224.4az1-sr1.supercp.comSagent04/12/2022verifiedHigh
14XX.XX.XX.XXXXxxxxx04/29/2022verifiedHigh
15XX.XX.XX.XXXXxxxxx05/05/2022verifiedHigh
16XX.XXX.XXX.XXxx.xxxxxxxxxx.xxxXxxxxx04/29/2022verifiedHigh
17XX.XX.XXX.XXXxxxxxxxx-xx-xx-xxx-xxx.xxxxx.xxxxXxxxxx04/29/2022verifiedHigh
18XX.XX.XXX.XXxxxxxxxxxxxxxx-xxx-x-x-xx.xxx-xx.xxx.xxxxxxx.xxXxxxxx04/29/2022verifiedHigh
19XX.XX.XXX.XXXxxxxxxxx.xxxxxxxxxxxxxx.xxxXxxxxx05/05/2022verifiedHigh
20XX.XXX.XXX.XXXxx-xxx-xxx-xxx.xxxxx.xxx.xxxxxxx.xxXxxxxx04/12/2022verifiedHigh
21XX.XXX.XXX.XXxx-xxx-xxx-xx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxx04/29/2022verifiedHigh
22XX.XXX.XXX.Xxxx.xxx-xxxxxxxxx.xxxXxxxxx04/29/2022verifiedHigh
23XX.XXX.XXX.XXXxxxxxxxxxxxx.xxx.xxXxxxxx04/29/2022verifiedHigh
24XXX.XX.XX.XXXxxxxx04/29/2022verifiedHigh
25XXX.XX.XXX.XXXXxxxxx04/29/2022verifiedHigh
26XXX.XXX.XX.XXXXxxxxx04/29/2022verifiedHigh
27XXX.XXX.XXX.XXXxxxxx04/29/2022verifiedHigh
28XXX.XXX.XXX.XXXXxxxxx04/29/2022verifiedHigh
29XXX.X.X.XXXXxxxxx05/05/2022verifiedHigh
30XXX.X.X.XXXxxxx.xxxxxxxxxxxxx.xxxXxxxxx04/12/2022verifiedHigh
31XXX.XX.XX.XXXXxxxxx04/12/2022verifiedHigh
32XXX.XX.XX.XXXXxxxxx04/12/2022verifiedHigh
33XXX.XXX.XXX.XXXxxxxx.xxxxxxxxx.xxxXxxxxx04/29/2022verifiedHigh
34XXX.XXX.XX.XXxx.xx.xxx.xxx-xxx.xxxxxxxxxxx.xxxXxxxxx04/29/2022verifiedHigh
35XXX.XX.XX.XXXxxx-xx-xx-xxx.xxxxxx.xxx.xxx.xxx.xxXxxxxx04/29/2022verifiedHigh
36XXX.XXX.XXX.XXXxxxxxx.xxx-xxxxxxxxx-xx.xxxXxxxxx04/29/2022verifiedHigh
37XXX.XXX.XX.XXXxx.xxxxxxxx.xxxXxxxxx04/12/2022verifiedHigh
38XXX.XX.XX.XXxxxxxxxx.xxxxxxxxx.xxXxxxxx04/29/2022verifiedHigh
39XXX.XXX.X.XXXXxxxxx05/05/2022verifiedHigh
40XXX.XXX.XX.XXXXxxxxx05/05/2022verifiedHigh
41XXX.XXX.XXX.XXXXxxxxx05/05/2022verifiedHigh
42XXX.XXX.XXX.XXXXxxxxx05/05/2022verifiedHigh
43XXX.XXX.XXX.XXXXxxxxx05/05/2022verifiedHigh
44XXX.XXX.XXX.XXXXxxxxx04/29/2022verifiedHigh
45XXX.XXX.XX.XXXXxxxxx04/08/2022verifiedHigh
46XXX.XX.XXX.XXxxxx-xxx-xxx-xxx-xxx.xx.xxx.xx.xxxXxxxxx05/05/2022verifiedHigh
47XXX.XXX.XXX.XXXxxx-xxx-xxx-xxx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxx04/29/2022verifiedHigh
48XXX.XX.XX.XXXxxxx-xxx-xx-xx-xxx.xxxxxxxxxxxx.xxXxxxxx04/12/2022verifiedHigh
49XXX.XXX.XXX.XXXxxxxx-xxx-xxx-xxx-xxx.xxxxxxxxx.xxxXxxxxx04/12/2022verifiedHigh
50XXX.XX.XX.XXXxxxxxx.xxx.xx.xx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxxx04/12/2022verifiedHigh
51XXX.X.XX.XXXxxxxxx-xxxxxxxxxx-x-xx-xxx.xxx.xxx.xxXxxxxx04/12/2022verifiedHigh
52XXX.X.XXX.XXxxxxxx.xxxxxxxxxxxxxxx.xxx.xxXxxxxx04/29/2022verifiedHigh
53XXX.XXX.XX.XXXXxxxxx04/12/2022verifiedHigh
54XXX.XXX.XXX.XXXXxxxxx04/29/2022verifiedHigh
55XXX.XX.XX.Xxxxxxxxx.xxxXxxxxx04/08/2022verifiedHigh
56XXX.XX.XX.XXXXxxxxx04/08/2022verifiedHigh
57XXX.XXX.XXX.XXxxxxxx.xxxxxxxxxxxxxx.xxxXxxxxx04/12/2022verifiedHigh
58XXX.XXX.XX.XXXXxxxxx05/05/2022verifiedHigh
59XXX.XX.XX.XXXxxxx.xxx.xxx.xxXxxxxx04/29/2022verifiedHigh
60XXX.XX.XXX.XXXxxxxxx.xxxxxxxx.xxxXxxxxx04/29/2022verifiedHigh
61XXX.XXX.XXX.XXxxxxxxxx-xxx-xxx-xx.xxxxxxx.xxx.xxXxxxxx04/12/2022verifiedHigh
62XXX.XXX.XXX.XXxxxx.xxxxx.xxxXxxxxx05/05/2022verifiedHigh
63XXX.XXX.XXX.XXxxxx.xxxxx.xxxXxxxxx05/05/2022verifiedHigh
64XXX.XXX.XXX.XXXXxxxxx05/05/2022verifiedHigh

TTP - Tactics, Techniques, Procedures (20)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (164)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File.htaccesspredictiveMedium
2File/dev/dri/card1predictiveHigh
3File/forum/away.phppredictiveHigh
4File/integrations.jsonpredictiveHigh
5File/login/bin/set_parampredictiveHigh
6File/mims/app/addcustomerHandler.phppredictiveHigh
7File/nidp/app/loginpredictiveHigh
8File/scripts/unlock_tasks.phppredictiveHigh
9File/uncpath/predictiveMedium
10File/webconsole/APIControllerpredictiveHigh
11File1.user.phppredictiveMedium
12Fileadclick.phppredictiveMedium
13Fileadmin.jcomments.phppredictiveHigh
14Fileadmin/batch_manager_unit.phppredictiveHigh
15Fileadmin/index.phppredictiveHigh
16Fileadmin/user.php?form=update_f&user_namepredictiveHigh
17Fileadmincp.phppredictiveMedium
18FileajaxServerSettingsChk.phppredictiveHigh
19Fileapp/system/language/admin/language_general.class.phppredictiveHigh
20Filexxx/xxxxxx/xxxxxxx/xxxxx/xxxxxxx_xxxxx.xxxxx.xxxpredictiveHigh
21Filexxxxxx/xx/xxxxxx.xxxxxxxxxx.xxxxxxx.xxpredictiveHigh
22Filexx-xxxxxx/xxxxxxxx.xxxxx.xxxpredictiveHigh
23Filexxxxxxxxx.xxxpredictiveHigh
24Filexxxxxxxxxxxxxx.xxxpredictiveHigh
25Filexxxxxxxxxx.xpredictiveMedium
26Filexxxxxxxxxx.xxxpredictiveHigh
27Filexxxxxx.xxxpredictiveMedium
28Filexxxxxxxxxxxxx.xxxxpredictiveHigh
29Filexxxxxxx=xxxxxxxxxx&xxxx=xxxx&xxxxxxxxxxxxx=/predictiveHigh
30Filexxxxxxxxxx/xxxxxx/xxxxxxxxx.xxxx/xxxx.xxx/predictiveHigh
31Filexxxxxxx/xxxxx-xxxx-xxx/xxxxx-xxxx-xxx.xpredictiveHigh
32Filexxxxxx/xxxxxxxpredictiveHigh
33Filexxxxxx/xxxxxx/xxx_xxxx.xpredictiveHigh
34Filexxxxxxxxxxxx.xxxpredictiveHigh
35Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
36Filexxxxxxx.xxxpredictiveMedium
37Filexxxxxx_xxxxxxx.xxxpredictiveHigh
38Filexxx_xxxxxx_xxxx_xxxxxx.xpredictiveHigh
39Filexxxxxx.xxxpredictiveMedium
40Filexxxxxxxx.xxxpredictiveMedium
41Filexxxxxxxxxx.xxxpredictiveHigh
42Filexxxxxxxxx_xxxxxx.xxxpredictiveHigh
43Filexxxxxxxxx_xxxx.xxxpredictiveHigh
44Filexxxx.xxxpredictiveMedium
45Filexxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
46Filexxxxx/xxxxxxx/xxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
47Filexxxxxx.xxxpredictiveMedium
48Filexxx_xxxx.xpredictiveMedium
49Filexxxxxxxxxx/xxxxxxx.xxxxpredictiveHigh
50Filexxxx.xxxpredictiveMedium
51Filexxx/xxxxxxxxx-xxxxx.xxxpredictiveHigh
52Filexxx/xxxxxx.xxxpredictiveHigh
53Filexxxxxxxx/xxx/xxx_xxxxxxx.xxxpredictiveHigh
54Filexxxxx.xxxpredictiveMedium
55Filexxxx.xxxpredictiveMedium
56Filexxxx.xxxxxxpredictiveMedium
57Filexxxxx.xxxxx.xxxx.xxxxx.xxxxxxxxxxxx.xxxxxxxxxxxpredictiveHigh
58Filexxx/xxxpredictiveLow
59Filexxxxx_xxxxx_xxxx.xpredictiveHigh
60Filexx.xxxpredictiveLow
61Filexxxxxxxx.xxxpredictiveMedium
62Filexxxxxxx.xxxpredictiveMedium
63Filexxxxxxxxxx/xxx.xpredictiveHigh
64Filexxxxxxx_xxxxxxxxx_xxxxx.xpredictiveHigh
65Filexxxxxx_xxxxxxxx_xxxxxxxxxxx.xpredictiveHigh
66Filexxxxxxx/xxxxxxxx_xxxxx.xxxpredictiveHigh
67Filexxxxxxx/xxxxx/xx/xxxxxx.xxxxx.xxxpredictiveHigh
68Filexxxxx.xxxpredictiveMedium
69Filexxxxxxxxxx.xxxpredictiveHigh
70Filexxxxx_x.xxpredictiveMedium
71Filexxxxxx.xxxpredictiveMedium
72Filexxxxxxx/xxx.xxxpredictiveHigh
73Filexxx/xxx/xxx_xxxxxx.xpredictiveHigh
74Filexxx/xxxx/xxx.xpredictiveHigh
75Filexxx_xxx_xxx.xxpredictiveHigh
76Filexxx/xxxx/xxxxx/xxxxxxx.xxpredictiveHigh
77Filexxxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
78Filexxxxx/xxxxxxx/predictiveHigh
79Filexxxxxxxxx.xxxpredictiveHigh
80Filexxxxxxxxxxxxxxxx.xxxpredictiveHigh
81Filexxxxxxx.xxxpredictiveMedium
82Filexxxxx_xxxxxxxx_xx.xxpredictiveHigh
83Filexxxxxxxxxx.xpredictiveMedium
84Filexxxxx.xxxpredictiveMedium
85Filexxxxxxxx.xxxpredictiveMedium
86Filexxx_xxxx.xpredictiveMedium
87Filexx.xxxpredictiveLow
88Filexx_xxx.xxpredictiveMedium
89Filexxxxxx.xxxx.xxxpredictiveHigh
90Filexxxxxxxxxxx_xxxxx.xxxpredictiveHigh
91Filexxxxxxxx_xxxxxxxxxxxxx_xxxxx.xxxpredictiveHigh
92Filexxxx-xxxx-xxxx.xpredictiveHigh
93Filexxxx/xxxxpredictiveMedium
94Filexxxxx/predictiveLow
95Filexxxxxx.xxxpredictiveMedium
96Filexxxx.xpredictiveLow
97Filexxx_xxxxxxxx.xxxpredictiveHigh
98FilexxxxxxxxxpredictiveMedium
99Filexxxxxx.xxxpredictiveMedium
100File~/xxxxxxxx-xxxxxxxx.xxxpredictiveHigh
101Libraryxxxxxx.xxxpredictiveMedium
102Libraryxxxxxx.xxxxxxxxx.xxxxxxx.xxxxx_xxxxx.xxxpredictiveHigh
103Libraryxxxxxxxxx.xxxxx.xxxxx.xxxxxx.xxxxxx.xxxxxxxx.xxxpredictiveHigh
104Libraryxxx/xxxxxxx.xxpredictiveHigh
105Libraryxxxxxx.xxxpredictiveMedium
106Libraryxxxxxxx.xxxpredictiveMedium
107Libraryxxx/xx_xxx.xpredictiveMedium
108Libraryxxxx.xxxpredictiveMedium
109Argumentxxxxxx-xxxxxxxxpredictiveHigh
110ArgumentxxxxxpredictiveLow
111ArgumentxxxxxxxxxpredictiveMedium
112ArgumentxxxxxpredictiveLow
113ArgumentxxxxxxxxpredictiveMedium
114Argumentxxxx/xxxxxx/xxxxxx/xxxx/xxxxxxx/xxxxxxxxxpredictiveHigh
115ArgumentxxxxxxxxxxpredictiveMedium
116ArgumentxxxxxxxpredictiveLow
117ArgumentxxxxxxpredictiveLow
118ArgumentxxxpredictiveLow
119ArgumentxxxxxxxxxxpredictiveMedium
120ArgumentxxxxxpredictiveLow
121Argumentxx_xxxxpredictiveLow
122ArgumentxxxxpredictiveLow
123Argumentxxxx_xxxx_xxpredictiveMedium
124Argumentxxxxxxx_xxxpredictiveMedium
125ArgumentxxxxxxxxxpredictiveMedium
126Argumentxxxxxxxxxx_xxxxpredictiveHigh
127ArgumentxxxxpredictiveLow
128Argumentxxxxx_xxxxpredictiveMedium
129Argumentxxxxx_xxxx/xxxxxx_xxxx/xxxxxxxpredictiveHigh
130ArgumentxxpredictiveLow
131ArgumentxxxxpredictiveLow
132ArgumentxxpredictiveLow
133Argumentxxxxx[xxxxx][xx]predictiveHigh
134Argumentxxxx_xxpredictiveLow
135ArgumentxxxpredictiveLow
136ArgumentxxxxpredictiveLow
137Argumentxxxx xxxxpredictiveMedium
138ArgumentxxxxpredictiveLow
139ArgumentxxxxxpredictiveLow
140ArgumentxxxxxpredictiveLow
141ArgumentxxxxpredictiveLow
142ArgumentxxxxxpredictiveLow
143ArgumentxxxxxxxxxpredictiveMedium
144ArgumentxxxxxxxxpredictiveMedium
145ArgumentxxxxxxxxpredictiveMedium
146ArgumentxxxxxxxxxpredictiveMedium
147ArgumentxxxxxxpredictiveLow
148ArgumentxxxxxxxxxpredictiveMedium
149ArgumentxxxxpredictiveLow
150ArgumentxxxxpredictiveLow
151ArgumentxxxxxpredictiveLow
152ArgumentxxxxxxxxxxxxxxxxxpredictiveHigh
153ArgumentxxxpredictiveLow
154ArgumentxxxxxxxxpredictiveMedium
155Argumentxxxxxxxx/xxxx xxxx/xxxxxpredictiveHigh
156Argumentxxxxxxxxxxxxxxxxxx=xxxx:/xxxxxxxxx:xxxx/xxxxxxxxxxxxx/predictiveHigh
157Argumentx-xxxxxxxxx-xxxpredictiveHigh
158Argumentx-xxxxxxxxx-xxxpredictiveHigh
159Argumentxxx_xxxxxx/xxx_xxxxxxxxpredictiveHigh
160ArgumentxxxxpredictiveLow
161Input Value/%xx/predictiveLow
162Input Valuexxxxxxxxx/xxxxxxxxxpredictiveHigh
163Pattern|xx xx xx|predictiveMedium
164Network Portxxx/xxxpredictiveLow

References (8)

The following list contains external sources which discuss the actor and the associated activities:

Want to stay up to date on a daily basis?

Enable the mail alert feature now!