Capesand Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (82)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	78
zh	4

Country

us	68
cn	10
gb	2
id	2

Actors

Capesand	2
NjRAT	1

Activities

Interest

Timeline

Type

Not Defined	34
Content Management System	6
Programming Language Software	6
Smartphone Operating System	4
Reporting Software	4

Vendor

Not Defined	28
Microsoft	4
Adobe	4
Awpcp	2
Zenhelpdesk	2

Product

Dnsmasq	2
elliptic	2
WordPress	2
Awpcp Another WordPress Classifieds Plugin	2
Portainer	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Adobe ColdFusion xml external entity reference	6.9	6.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00246	0.00	CVE-2017-11286
2	ThinkPad Compact USB Keyboard Driver unquoted search path	6.5	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2017-3751
3	GNU binutils libbfd mach-o.c bfd_mach_o_read_symtab_strtab out-of-bounds write	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00112	0.00	CVE-2017-12459
4	GNU binutils libbfd section.c bfd_make_section_with_flags null pointer dereference	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00095	0.00	CVE-2017-12457
5	puppet Configuration File certificate validation	5.9	5.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00113	0.00	CVE-2014-3250
6	Arris TG1682G ajax_managed_services.php Stored cross site scripting	5.2	4.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00116	0.00	CVE-2017-16836
7	flatCore CMS Configuration cross-site request forgery	6.5	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00588	0.00	CVE-2017-7877
8	mcart.xls Module mcart_xls_import.php sql injection	7.1	7.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00465	0.00	CVE-2015-8356
9	elFinder LocalVolumeDriver Connector elFinderVolumeLocalFileSystem.class.php _joinPath path traversal	6.0	5.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00063	0.02	CVE-2023-35840
10	Fuji Xerox ApeosPort-V 5070 PJL Command command injection	8.5	7.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01097	0.02	CVE-2018-16709
11	Virtual Programming VP-ASP Shopping Cart shopreviewlist.asp sql injection	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00187	0.04	CVE-2004-2412
12	Saskia Bruckner Saskias Shopsystem content.php path traversal	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00445	0.00	CVE-2010-0957
13	AeroCMS sql injection	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00085	0.00	CVE-2022-38812
14	SourceCodester Garage Management System manage_website.php unrestricted upload	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00104	0.00	CVE-2022-37184
15	elliptic secp256k1 key.js cryptographic issues	5.6	5.3	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00116	0.09	CVE-2020-28498
16	Sangoma NetBorder/Vega Session Controller Web Interface access control	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00498	0.00	CVE-2017-17430
17	Zenhelpdesk Zen Help Desk Login adminlogin.asp sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00107	0.03	CVE-2009-2604
18	Apple iOS/iPadOS IOMobileFrameBuffer memory corruption	7.8	7.5	$25k-$100k	$5k-$25k	High	Official Fix	0.00263	0.04	CVE-2022-22587
19	Todd Miller sudo sudoedit sudoers access control	7.8	7.0	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00061	0.05	CVE-2015-5602
20	Oracle WebCenter Sites Advanced UI information disclosure	8.6	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00623	0.00	CVE-2019-2578

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	107.167.244.67		Capesand	11/08/2019	verified	High
2	XXX.XX.XX.XXX	xxx.xxxxxxxxxxxxxxxxxxxxx.xxx	Xxxxxxxx	11/08/2019	verified	High
3	XXX.XXX.XXX.X		Xxxxxxxx	11/08/2019	verified	High

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
4	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-19	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
9	TXXXX.XXX	CAPEC-	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	High
10	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
11	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
12	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
13	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (38)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/etc/sudoers	predictive	Medium
2	File	/REBOOTSYSTEM	predictive	High
3	File	/src/helper.c	predictive	High
4	File	/uncpath/	predictive	Medium
5	File	actionHandler/ajax_managed_services.php	predictive	High
6	File	xxxxx/xxxxx_xxx_xxxxxx.xxx	predictive	High
7	File	xxxxxxxxxx.xxx	predictive	High
8	File	xxx/xxxx-x.x	predictive	Medium
9	File	xxxxxxxxxx.xxx	predictive	High
10	File	xxxxxxx.xxx	predictive	Medium
11	File	xxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx	predictive	High
12	File	xxxxxxxx/xx/xxx.xx	predictive	High
13	File	xxxxxxxxxxxxx.xxx	predictive	High
14	File	xxxx.xxx	predictive	Medium
15	File	xxxxx.xxx	predictive	Medium
16	File	xxxxxxx.xxx	predictive	Medium
17	File	xxxx_xxxx.xxx	predictive	High
18	File	xxxxxx_xxxxxxx.xxx	predictive	High
19	File	xxxxxx/xxxxxxx_xxxx.xxx	predictive	High
20	File	xxxxxxxxxxxxx.xxx	predictive	High
21	File	xxxxxx.xxx	predictive	Medium
22	File	xxx.x	predictive	Low
23	File	xxxxxxx.x	predictive	Medium
24	File	xxxxxxxxxxxxxx.xxx	predictive	High
25	File	xxxxxx.xxx	predictive	Medium
26	File	xxx-xxxxx.x	predictive	Medium
27	Library	xxx/xxxxxxxxx/xxx.x	predictive	High
28	Argument	xxxxx	predictive	Low
29	Argument	xxxxxx	predictive	Low
30	Argument	xxxxxxxxx	predictive	Medium
31	Argument	xxxx_xx	predictive	Low
32	Argument	xxxxxx_xxxxxxx_xxxxxx	predictive	High
33	Argument	xx	predictive	Low
34	Argument	xxxxxxxxxx	predictive	Medium
35	Argument	xxxxxxx	predictive	Low
36	Argument	xxxxxxx	predictive	Low
37	Argument	xxxxxxxx	predictive	Medium
38	Argument	xxx_xxxxxx_xxxxxxx_xx_xxx	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!