Western Sahara Unknown Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (15)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	10
fr	4
de	2

Country

us	12
fr	4

Actors

Rancor	1
FTP Info Stealer	1
Gabon	1

Activities

Interest

Timeline

Type

Not Defined	10
Operating System	2
Anti-Malware Software	2
Content Management System	2

Vendor

Not Defined	6
SoftMaker	2
Microsoft	2
SonicWALL	2
ZTE	2

Product

Keycloak	2
SoftMaker FlexiPDF	2
Microsoft Windows	2
SonicWALL AntiSpam	2
SonicWALL EMail Security Appliance	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Keycloak cross site scripting	3.5	3.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00088	0.04	CVE-2022-1438
2	Microsoft Windows Multimedia Library winmm.dll memory corruption	10.0	9.5	$100k and more	$0-$5k	High	Official Fix	0.97281	0.00	CVE-2012-0003
3	ZTE ZXHN H108N information disclosure	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00120	0.03	CVE-2019-3420
4	Django defaulttags.py path traversal	7.3	6.6	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00539	0.05	CVE-2013-4315
5	SquirrelMail PHP Interface webmail.php improper authentication	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00500	0.03	CVE-2009-0030
6	Softbiz FAQ Script add_comment.php sql injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01302	0.00	CVE-2005-3938
7	SonicWALL AntiSpam / EMail Security Appliance MTA Queue Report Module reports_mta_queue_status.html cross site scripting	8.0	7.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.00
8	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.02016	0.00	CVE-2007-1192
9	Wordpress wp-trackback.php sql injection	7.3	7.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00296	0.04	CVE-2005-1687
10	Joomla CMS sql injection	7.3	6.9	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00264	0.00	CVE-2013-1453
11	Joomla CMS File Upload media.php input validation	6.3	6.0	$5k-$25k	$0-$5k	High	Official Fix	0.79864	0.05	CVE-2013-5576
12	Joomla CMS HTTP Header input validation	7.3	7.0	$5k-$25k	$0-$5k	High	Official Fix	0.97311	0.03	CVE-2015-8562
13	WordPress Widget Title cross-site request forgery	4.3	4.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00874	0.00	CVE-2015-5731
14	SoftMaker FlexiPDF Installer Library privileges management	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	0.02
15	XenForo privileges management	8.6	7.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.04

IOC - Indicator of Compromise (9)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	45.12.70.66	executioner.get-eye.com	Western Sahara Unknown	11/16/2022	verified	High
2	45.12.71.66		Western Sahara Unknown	11/16/2022	verified	High
3	XX.XX.XXX.XX	xx.xxx.xx.xx.xx-xxxx.xxxx	Xxxxxxx Xxxxxx Xxxxxxx	11/16/2022	verified	High
4	XXX.XXX.X.X		Xxxxxxx Xxxxxx Xxxxxxx	02/21/2023	verified	High
5	XXX.XXX.X.X		Xxxxxxx Xxxxxx Xxxxxxx	11/16/2022	verified	High
6	XXX.XXX.XX.X		Xxxxxxx Xxxxxx Xxxxxxx	11/16/2022	verified	High
7	XXX.XXX.XXX.XXX		Xxxxxxx Xxxxxx Xxxxxxx	11/16/2022	verified	High
8	XXX.XX.XX.XX		Xxxxxxx Xxxxxx Xxxxxxx	11/16/2022	verified	High
9	XXX.XX.XXX.XX		Xxxxxxx Xxxxxx Xxxxxxx	11/16/2022	verified	High

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
3	TXXXX	CAPEC-122	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (15)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	add_comment.php	predictive	High
2	File	administrator/components/com_media/helpers/media.php	predictive	High
3	File	data/gbconfiguration.dat	predictive	High
4	File	xxxxxxx_xxx_xxxxx_xxxxxx.xxxx	predictive	High
5	File	xxxxxxxx/xxxxxxxxxxx.xx	predictive	High
6	File	xxxxxxx.xxx	predictive	Medium
7	File	xx-xxxxxxxxx.xxx	predictive	High
8	Library	xxxxx.xxx	predictive	Medium
9	Argument	xxxxxxx_xxxxxxx_xxxxx	predictive	High
10	Argument	xxxxxxxxx	predictive	Medium
11	Argument	xxxxxxxx	predictive	Medium
12	Argument	xx	predictive	Low
13	Argument	xx_xx	predictive	Low
14	Argument	xxxx-xxxxx	predictive	Medium
15	Input Value	../	predictive	Low

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!