TitanStealer Analysis

IOB - Indicator of Behavior (531)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en470
de22
ru14
es8
pl4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us202
ru166
cn58
lv28
fr16

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Microsoft Windows12
Apache HTTP Server10
Microsoft Edge8
Microsoft ChakraCore8
Google Android6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1automad Dashboard cross site scripting3.53.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000540.08CVE-2022-1536
2Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaround0.020160.00CVE-2007-1192
3Open Networking Foundation ONOS API Documentation Dashboard cross site scripting4.84.8$0-$5k$0-$5kNot DefinedNot Defined0.000710.02CVE-2023-24279
4OpenSSH Authentication Username information disclosure5.34.8$5k-$25k$0-$5kHighOfficial Fix0.107370.28CVE-2016-6210
5Oracle MySQL Server InnoDB access control5.55.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000980.00CVE-2018-3185
6ISC BIND named resolver.c input validation8.68.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.733300.03CVE-2016-1286
7Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.005480.03CVE-2017-0055
8MGB OpenSource Guestbook email.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.013020.46CVE-2007-0354
9Oracle Communications Cloud Native Core Unified Data Repository Signaling protection mechanism9.99.7$25k-$100k$5k-$25kNot DefinedOfficial Fix0.002130.00CVE-2022-43403
10Googlemaps Plugin plugin_googlemap2_proxy.php resource consumption6.46.1$0-$5k$0-$5kNot DefinedOfficial Fix0.006040.03CVE-2013-7428
11nginx request smuggling6.96.9$0-$5k$0-$5kNot DefinedNot Defined0.002411.76CVE-2020-12440
12Microsoft IIS Frontpage Server Extensions shtml.dll Username information disclosure5.35.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.159580.11CVE-2000-0114
13OpenSSH ssh-agent double free5.85.6$25k-$100k$0-$5kNot DefinedOfficial Fix0.001840.04CVE-2021-28041
14TikiWiki tiki-register.php input validation7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.010758.11CVE-2006-6168
15Coppermine Photo Gallery init.inc.php file inclusion7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.083070.05CVE-2004-1988
16PC Keyboard Server missing authentication9.89.8$0-$5k$0-$5kNot DefinedNot Defined0.003610.00CVE-2022-45479
17Apache HTTP Server HTTP Digest Authentication Challenge improper authentication8.58.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.018150.08CVE-2018-1312
18XiongMai IP Camera/DVR NetSurveillance Web Interface memory corruption8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.003720.07CVE-2017-16725
19ONLYOFFICE Document Server WebSocket API sql injection8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.001740.00CVE-2020-11537
20nginx ngx_http_mp4_module information disclosure5.95.8$0-$5k$0-$5kNot DefinedOfficial Fix0.001980.05CVE-2018-16845

IOC - Indicator of Compromise (35)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
137.220.87.23ipn-37-220-87-23.artem-catv.ruTitanStealer03/17/2023verifiedHigh
237.220.87.48ipn-37-220-87-48.artem-catv.ruTitanStealer03/30/2023verifiedHigh
337.220.87.60ipn-37-220-87-60.artem-catv.ruTitanStealer02/21/2023verifiedHigh
445.9.74.63TitanStealer02/21/2023verifiedHigh
545.15.156.137TitanStealer04/05/2023verifiedHigh
645.15.156.211TitanStealer02/21/2023verifiedHigh
745.15.156.242TitanStealer04/05/2023verifiedHigh
8XX.XX.XXX.XXXXxxxxxxxxxxx04/05/2023verifiedHigh
9XX.XX.XXX.XXXXxxxxxxxxxxx04/05/2023verifiedHigh
10XX.X.XXX.XXxxxxxx.xxxxxxxxx.xxXxxxxxxxxxxx10/28/2023verifiedHigh
11XX.XX.XXX.XXXxxxxxxxxxxx10/28/2023verifiedHigh
12XX.XX.XX.XXXxxxxxxxxxxx03/30/2023verifiedHigh
13XX.XX.XX.XXXxxxx.xxxx.xxxxxxxXxxxxxxxxxxx05/08/2023verifiedHigh
14XX.XXX.XXX.XXxxxxxxx-xxxx.xxxx.xxxxxxxXxxxxxxxxxxx04/05/2023verifiedHigh
15XX.XXX.XXX.XXXxxxxxxxxxxx-xxxxx.xxxx.xxxxxxxXxxxxxxxxxxx10/28/2023verifiedHigh
16XX.XX.XXX.XXxxxxxx-xxxx.xxxx.xxxxxxxXxxxxxxxxxxx04/05/2023verifiedHigh
17XX.XXX.XXX.XXXxxxxxxxxxxx04/05/2023verifiedHigh
18XX.XXX.XXX.XXXXxxxxxxxxxxx04/05/2023verifiedHigh
19XX.XXX.XXX.XXXXxxxxxxxxxxx04/05/2023verifiedHigh
20XX.XXX.XXX.XXXxx-xxxxxxx-xxx.xxxxxXxxxxxxxxxxx04/23/2023verifiedHigh
21XX.XX.XXX.XXXxxxx-xx-xx-xxx-xxx.xxxxxx-xx-xxxxxx.xxXxxxxxxxxxxx02/21/2023verifiedHigh
22XX.XX.XX.XXXXxxxxxxxxxxx04/05/2023verifiedHigh
23XX.XX.XX.XXXXxxxxxxxxxxx10/28/2023verifiedHigh
24XX.XXX.XXX.XXXxxxxxxxxxxx04/05/2023verifiedHigh
25XX.XXX.XXX.XXXxxxxxxxxxxx10/28/2023verifiedHigh
26XX.XXX.XXX.XXXXxxxxxxxxxxx03/17/2023verifiedHigh
27XX.XXX.XXX.XXXXxxxxxxxxxxx10/28/2023verifiedHigh
28XX.XXX.XXX.XXXXxxxxxxxxxxx10/28/2023verifiedHigh
29XXX.XXX.X.XXXxxxxxx.xxx.x.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxxxxxxxxx04/05/2023verifiedHigh
30XXX.XX.XX.XXXxxxxxx.xxx.xx.xx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxxxxxxxxx03/30/2023verifiedHigh
31XXX.XX.XX.XXxxxxxx.xx.xx.xx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxxxxxxxxx10/28/2023verifiedHigh
32XXX.XXX.XX.XXXXxxxxxxxxxxx02/21/2023verifiedHigh
33XXX.XXX.XX.XXxxxxxxxxxx-xxxxx.xxxx.xxxxxxxXxxxxxxxxxxx04/05/2023verifiedHigh
34XXX.XXX.XX.XXXxxxxxx-xxxx.xxxx.xxxxxxxXxxxxxxxxxxx04/05/2023verifiedHigh
35XXX.XXX.XXX.XXxxxxx-xxxxxx-xxxxxxx-xxxxxxx.xxxxxx-xx-xxxxx.xxxXxxxxxxxxxxx10/28/2023verifiedHigh

TTP - Tactics, Techniques, Procedures (19)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (191)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/+CSCOE+/logon.htmlpredictiveHigh
2File/.envpredictiveLow
3File/category.phppredictiveHigh
4File/category/list?limit=10&offset=0&order=descpredictiveHigh
5File/cgi-bin/cstecgi.cgi?action=loginpredictiveHigh
6File/cgi-bin/delete_CApredictiveHigh
7File/classes/Master.php?f=delete_brandpredictiveHigh
8File/Config/SaveUploadedHotspotLogoFilepredictiveHigh
9File/display/mappredictiveMedium
10File/downloadpredictiveMedium
11File/forum/away.phppredictiveHigh
12File/forum/PostPrivateMessagepredictiveHigh
13File/get_getnetworkconf.cgipredictiveHigh
14File/GponForm/device_Form?script/predictiveHigh
15File/includes/rrdtool.inc.phppredictiveHigh
16File/Main_AdmStatus_Content.asppredictiveHigh
17File/NAGErrorspredictiveMedium
18File/sgms/TreeControlpredictiveHigh
19File/src/admin/content_batchup_action.phppredictiveHigh
20File/st_reg.phppredictiveMedium
21File/tmppredictiveLow
22File/xxxxxxx/predictiveMedium
23File/xxxxxx/xxxxxx.xxxpredictiveHigh
24File/xxx/xxx/xxxxxxpredictiveHigh
25File/xxx/xxx/xxxxxpredictiveHigh
26File/xxx-xxx-xxxxx/xxxx/xxxpredictiveHigh
27File/xx/xxxxx.xxxpredictiveHigh
28Filexx.xxxpredictiveLow
29Filexxxxx/xxxxxxx.xxxpredictiveHigh
30Filexxxxx/xxxxxx_xxxx.xxxpredictiveHigh
31Filexxxxx/xxxx.xxxxxxx.xxxpredictiveHigh
32Filexxxxx/xxxx.xxxx.xxxpredictiveHigh
33Filexxxxx\xxxxxxxxxx\xxxxxxxxxx.xxxpredictiveHigh
34Filexxxxx\xxxxx\xxxx_xxxx.xxxpredictiveHigh
35Filexxxxxxxxxxx.xxpredictiveHigh
36Filexxxxxxx.xxpredictiveMedium
37Filexxx/xxxxxxxxxxx/xxxxxxx_xxxxxxxxxx.xxpredictiveHigh
38Filexxxxxxxxxxxxx.xxpredictiveHigh
39Filexxxxxxx.xxxpredictiveMedium
40Filexxx_xxxxx.xxxpredictiveHigh
41Filexxxxxxx/xxxxxxx/xxxxxxx.xxxx?xxxxpredictiveHigh
42Filexxx_xxxxxxxx.xxxpredictiveHigh
43Filexxxxxx_xxxx.xxxpredictiveHigh
44Filexxxxxxxxxxx.xxxpredictiveHigh
45Filexxxxxxxxxx_xxxxx.xxxpredictiveHigh
46Filexxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
47Filexxxxxx.xxxpredictiveMedium
48Filexxxxxxxx_xxxxxxx.xxxpredictiveHigh
49Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
50Filexx.x/xxxxxxxx.xpredictiveHigh
51Filexxxxxxxxx.xxxpredictiveHigh
52Filexxxxxxxxxxxxxxxx.xxxpredictiveHigh
53Filexxxxxxx/xxxxxxx/xxxx-xxxxxxx-xx.xpredictiveHigh
54Filexxxxxxx/xxxxx/xxxxxx/xxxxxx-xxxxxxx.xpredictiveHigh
55Filexxxxxxx.xxpredictiveMedium
56Filexxxxx.xxxpredictiveMedium
57Filexxxxxxxx/xxx-xxxx.xxxpredictiveHigh
58Filexxxxxxxx.xxxpredictiveMedium
59Filexxxxxxx.xxxxpredictiveMedium
60Filexxxxxxx.xxx_predictiveMedium
61Filexxxxxxxx/xxxx_xxxxpredictiveHigh
62Filexxxx_xxxx.xpredictiveMedium
63Filexxx/xxxxxx.xxxpredictiveHigh
64Filexxxxxxx\xxxxxxx\xxxxxxx_xxxxx.xxxpredictiveHigh
65Filexxxxxxx\xxxxxxx\xxxxxxx_xxxxxx.xxxpredictiveHigh
66Filexxxxx.xxxxpredictiveMedium
67Filexxxxx.xxxpredictiveMedium
68Filexxxxxxxx.xxxpredictiveMedium
69Filexxxx.xxx.xxxpredictiveMedium
70Filexx.xxxpredictiveLow
71Filexxxxxxxxx/xxxxxx.xxx.xxxpredictiveHigh
72Filexxxxxxxx.xxxpredictiveMedium
73Filexxxxxxxx.xxpredictiveMedium
74Filexxxxxx.xxxpredictiveMedium
75Filexxxxxx_xxxxxx.xxxpredictiveHigh
76Filexxx-xxxxxxxx.xxpredictiveHigh
77Filexxxxxxxx.xxxpredictiveMedium
78Filexxx-xxxxxxxxx-xxxxxxxxxx-xxxxxx/xxxxx.xxxpredictiveHigh
79Filexxxxxxx.xxxpredictiveMedium
80Filexxx_xxxxxxxxx.xpredictiveHigh
81Filexxxxxxx/xxxxxxxxxxxxxxxx/xxxxxxxxx/xxxxxxxx.xxxxpredictiveHigh
82Filexxxxxx_xxxxxxxxxx_xxxxx.xxxpredictiveHigh
83Filexxxxxxxx.xxpredictiveMedium
84Filexxxxx.xpredictiveLow
85Filexxxxx.xxxpredictiveMedium
86Filexxxxxxx.xxpredictiveMedium
87Filexxxxxxxx.xxxpredictiveMedium
88Filexxxxxxxx.xxxpredictiveMedium
89Filexxx_xxxx_xxxxxxxxx.xxpredictiveHigh
90Filexxxxxx_xxxxxxx.xxxpredictiveHigh
91Filexxxxxxxx/xxxx/xxxx.xxx?xxxxxx=xxxxxxxxxxxxxxxxpredictiveHigh
92Filexxxxxxxxxxxxxxxxxxxxxxxxxx.xx/xxxxxxxxxx.xx/xxxxxxxxxxx.xxpredictiveHigh
93Filexxxx/xxxxxxxxxx.xxxpredictiveHigh
94Filexxxxxxxxxxx.xpredictiveHigh
95Filexxx/xx_xxx.xpredictiveMedium
96Filexxxxxxxx.xxxxx.xxxpredictiveHigh
97Filexxxx-xxxxxxxx.xxxpredictiveHigh
98Filexx.xxxpredictiveLow
99Filexxxxxxxxxx.xxxpredictiveHigh
100Filexxxxxxx.xxxpredictiveMedium
101Filexxxxxxx.xxxpredictiveMedium
102Filexxxx_xxxx.xxxpredictiveHigh
103Filexxx_xxxxx.xxx?xxxx=xxxxxxxxpredictiveHigh
104Filexxx-xxxxx.xxxpredictiveHigh
105Filexxxxxxx.xxxpredictiveMedium
106Filexx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxxpredictiveHigh
107Filexx-xxxxx.xxxpredictiveMedium
108Filexxxx.xxpredictiveLow
109File~/.xxxxxxxpredictiveMedium
110Library/_xxx_xxx/xxxxx.xxxpredictiveHigh
111LibraryxxxxxxxxxpredictiveMedium
112Argument--xxxxxx/--xxxxxxxxpredictiveHigh
113Argumentxxxxxxxxxx xxx xxxxxxxpredictiveHigh
114ArgumentxxxxxxxpredictiveLow
115ArgumentxxxxxpredictiveLow
116ArgumentxxxxxxxxpredictiveMedium
117ArgumentxxxxxxxpredictiveLow
118ArgumentxxxxxpredictiveLow
119Argumentxxxx xxxxx/xxxx xxxxxxpredictiveHigh
120Argumentxxxxx xxxxpredictiveMedium
121Argumentxxxxx_xxxx/xx_xxxxx_xxxxx_xx/xx_xxxxx_xxxxx_xxxxx_xxxx_xxxx/xxxxx_xxxxxxxxx_xxxx/xxxxxx_xxxxxx_xxxxxpredictiveHigh
122ArgumentxxxxxxxxpredictiveMedium
123Argumentxxxxxxxx/xxxxxxpredictiveHigh
124ArgumentxxxpredictiveLow
125ArgumentxxxxxxxxpredictiveMedium
126Argumentxxx_x_xxxpredictiveMedium
127ArgumentxxpredictiveLow
128Argumentxxxx_xxxxxx=xxxxpredictiveHigh
129ArgumentxxxxxpredictiveLow
130ArgumentxxxxxpredictiveLow
131ArgumentxxxxxxxxpredictiveMedium
132ArgumentxxxxxpredictiveLow
133ArgumentxxxxpredictiveLow
134ArgumentxxxxxxxxpredictiveMedium
135ArgumentxxxxxxxxpredictiveMedium
136ArgumentxxxxpredictiveLow
137ArgumentxxpredictiveLow
138ArgumentxxxxxpredictiveLow
139ArgumentxxxxpredictiveLow
140ArgumentxxxxpredictiveLow
141Argumentxxxx_xxxxxxxpredictiveMedium
142ArgumentxxpredictiveLow
143ArgumentxxxxxxxxxxpredictiveMedium
144Argumentxxxxxxxx_xxxpredictiveMedium
145ArgumentxxxxpredictiveLow
146ArgumentxxxxxpredictiveLow
147ArgumentxxxxxxxxpredictiveMedium
148ArgumentxxxpredictiveLow
149Argumentxxxx/xxxxxxxx/xxxxxxxx/xxxxxxxxpredictiveHigh
150Argumentxxxxxxx/xxxxpredictiveMedium
151ArgumentxxpredictiveLow
152ArgumentxxxxxpredictiveLow
153Argumentxxxxxxx_xxxxx_xxxxxxx_xxxxx[x]predictiveHigh
154ArgumentxxxxpredictiveLow
155ArgumentxxxxxxxxpredictiveMedium
156ArgumentxxxxxxxxpredictiveMedium
157ArgumentxxxxxxxxpredictiveMedium
158ArgumentxxxxpredictiveLow
159Argumentxxxxxx_xxxxxxxpredictiveHigh
160ArgumentxxxxpredictiveLow
161ArgumentxxxxxxxpredictiveLow
162ArgumentxxxxxxxxxxxpredictiveMedium
163Argumentxxxxxx_xxxxpredictiveMedium
164ArgumentxxxxxxxxxxxxxxpredictiveHigh
165ArgumentxxxxxxxxxxpredictiveMedium
166Argumentxxxx_xxxxpredictiveMedium
167ArgumentxxxxxxxxxpredictiveMedium
168ArgumentxxxxxxxxxpredictiveMedium
169ArgumentxxxxpredictiveLow
170Argumentxxxxxxx/xxxxxxxpredictiveHigh
171ArgumentxxxpredictiveLow
172Argumentx_xxpredictiveLow
173ArgumentxxxxpredictiveLow
174ArgumentxxxxxxxpredictiveLow
175ArgumentxxxxxpredictiveLow
176ArgumentxxxxpredictiveLow
177ArgumentxxxpredictiveLow
178Argumentxxxxxxxx/xxxxxxxxpredictiveHigh
179ArgumentxxxxpredictiveLow
180Argumentx-xxxxxxxxx-xxxpredictiveHigh
181Argumentxx-xxxxxx_xxxxpredictiveHigh
182Input Value%xxxxxx+-x+x+xx.x.xx.xxx%xx%xxpredictiveHigh
183Input Value-x+xxxxx+xxxxxx+x,x,xxxxxxx()predictiveHigh
184Input Value../predictiveLow
185Input Value<xxxxxxxx>\xpredictiveMedium
186Input Value<xxxxxx>xxxxx(x)</xxxxxx>predictiveHigh
187Input Valuexxxx</xxxxx><xxxxxx>xxxxx("xxxx")</xxxxxx><xxxxx>predictiveHigh
188Pattern|xx|xx|xx|predictiveMedium
189Network Portxxx/xxxxpredictiveMedium
190Network Portxxx/xxxx (xx-xxx)predictiveHigh
191Network Portxxx/xxx (xxx)predictiveHigh

References (9)

The following list contains external sources which discuss the actor and the associated activities:

Do you need the next level of professionalism?

Upgrade your account now!