Scar Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (16)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	14
it	2

Country

us	8
ru	6
it	2

Actors

Scar	2
TA505	1
Cobalt Strike	1
RedLine Stealer	1
Raccoon	1

Activities

Interest

Timeline

Type

Not Defined	6
Operating System	2
Content Management System	2
Router Operating System	2
File Compression Software	2

Vendor

Not Defined	4
Genymotion	2
Linux	2
TP-LINK	2
HelpSystems	2

Product

Genymotion Desktop	2
Linux Kernel	2
Joomla	2
systemd	2
TP-LINK TL-WR740N	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	nginx HTTP/2 resource consumption	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.09699	0.04	CVE-2018-16843
2	Microsoft Windows Runtime Remote Code Execution	8.1	7.7	$25k-$100k	$5k-$25k	High	Official Fix	0.40028	0.00	CVE-2022-21971
3	Joomla Usergroup Table input validation	4.6	4.6	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00103	0.00	CVE-2021-26036
4	Bitrix24 Web Application Firewall cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00113	0.07	CVE-2020-13483
5	Linux Kernel Netfilter x_tables.c out-of-bounds write	8.8	8.4	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00256	0.04	CVE-2021-22555
6	Linux Kernel ptrace.c access control	7.8	7.6	$5k-$25k	$0-$5k	High	Official Fix	0.00052	0.00	CVE-2019-13272
7	HelpSystems Cobalt Strike Server Screenshot readCountedBytes Hotcobalt denial of service	3.5	3.2	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00280	0.05	CVE-2021-36798
8	Cisco ASA/Firepower Threat Defense Network Address Translation security check	5.4	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00111	0.00	CVE-2021-34790
9	systemd unit-name.c alloca allocation of resources	6.5	6.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.02	CVE-2021-33910
10	Hikvision Product Message command injection	5.5	5.5	$0-$5k	$0-$5k	High	Not Defined	0.97485	0.03	CVE-2021-36260
11	RARLAB WinRAR memory corruption	10.0	9.0	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00469	0.00	CVE-2008-7144
12	TP-LINK TL-WR740N Firmware Local Privilege Escalation	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00000	0.04
13	TP-LINK TL-WR841N Web Service buffer overflow	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02223	0.04	CVE-2019-17147
14	Genymotion Desktop Clipboard information disclosure	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00594	0.00	CVE-2021-27549
15	Oracle Database Server OJVM access control	9.9	9.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00165	0.00	CVE-2017-10202

IOC - Indicator of Compromise (27)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	35.186.232.167	167.232.186.35.bc.googleusercontent.com	Scar	05/06/2022	verified	Medium
2	52.85.151.4	server-52-85-151-4.iad89.r.cloudfront.net	Scar	07/17/2021	verified	High
3	52.85.151.59	server-52-85-151-59.iad89.r.cloudfront.net	Scar	07/17/2021	verified	High
4	64.186.131.47		Scar	04/12/2022	verified	High
5	67.228.31.225	e1.1f.e443.ip4.static.sl-reverse.com	Scar	04/12/2022	verified	High
6	72.21.81.240		Scar	05/05/2022	verified	High
7	XX.XXX.XXX.XX	xxxxxx.xx-xxx-xxx-xx.xxxxxxx.xxxx-xxxxxx.xx	Xxxx	07/17/2021	verified	High
8	XX.XXX.XXX.XXX		Xxxx	07/17/2021	verified	High
9	XX.XX.XXX.XX	xxxxxx-xx-xx-xxx-xx.xxxxx.x.xxxxxxxxxx.xxx	Xxxx	07/17/2021	verified	High
10	XX.XX.XXX.XXX	xxxxxx-xx-xx-xxx-xxx.xxxxx.x.xxxxxxxxxx.xxx	Xxxx	07/17/2021	verified	High
11	XXX.XXX.XX.XXX	xxxxxxxx-xx-xxx.xxxxx.xxx	Xxxx	05/05/2022	verified	High
12	XXX.XXX.XXX.XX	xx-xx-xxx.xxxxx.xxx	Xxxx	05/06/2022	verified	High
13	XXX.XXX.XXX.XXX	xx-xx-xxxx.xxxxx.xxx	Xxxx	05/06/2022	verified	High
14	XXX.XXX.XXX.XX	xx.xx.xxxx.xxx.xxxxxx.xx-xxxxxxx.xxx	Xxxx	05/05/2022	verified	High
15	XXX.XXX.XX.XX	xx-xx-xxx.xxxxx.xxx	Xxxx	05/06/2022	verified	High
16	XXX.XXX.XX.XXX	xx-xx-xxxx.xxxxx.xxx	Xxxx	05/06/2022	verified	High
17	XXX.XXX.XXX.XXX	xx-xx-xxxx.xxxxx.xxx	Xxxx	05/06/2022	verified	High
18	XXX.XXX.X.XX		Xxxx	07/17/2021	verified	High
19	XXX.XXX.X.XX	xxxxxx.xxxxxxxxxxx.xxx	Xxxx	07/17/2021	verified	High
20	XXX.XXX.XXX.XXX		Xxxx	04/12/2022	verified	High
21	XXX.XX.XX.XXX	xx-xx.xxxxxxxxxx.xxx	Xxxx	05/06/2022	verified	High
22	XXX.XX.XXX.XXX	x-xxxx.x-xxxxxx.xxx	Xxxx	05/06/2022	verified	High
23	XXX.XXX.XXX.XX	xxxx.xxxxx.xxx	Xxxx	05/05/2022	verified	High
24	XXX.XXX.XXX.XX	xxxx.xxxxx.xxx	Xxxx	05/05/2022	verified	High
25	XXX.XX.XXX.XXX	xxx.xxxxx.xxx.xx	Xxxx	05/05/2022	verified	High
26	XXX.XX.XXX.XX	xx-xx-xxx.xxxxx.xxx	Xxxx	05/06/2022	verified	High
27	XXX.XX.XXX.XX	xx-xx-xxx.xxxxx.xxx	Xxxx	05/06/2022	verified	High

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
2	TXXXX	CAPEC-19	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
3	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
5	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (5)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	basic/unit-name.c	predictive	High
2	File	components/bitrix/mobileapp.list/ajax.php/	predictive	High
3	File	xxxxxx/xxxxxx.x	predictive	High
4	File	xxx/xxxxxxxxx/x_xxxxxx.x	predictive	High
5	Argument	xxxxx[xxxxx][xx]	predictive	High

References (5)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!