DarkVNC Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (53)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	30
it	12
ru	4
es	4
fr	2

Country

it	26
us	16
fr	6
gb	4
de	2

Actors

DarkVNC	5
RedLine Stealer	2
IcedID	2
BazarBackdoor	1
Stealc	1

Activities

Interest

Timeline

Type

Not Defined	12
Content Management System	10
Web Server	6
File Transfer Software	6
Photo Gallery Software	4

Vendor

Not Defined	16
Microsoft	6
FileZilla	4
ESMI	2
Gallarific	2

Product

Microsoft IIS	4
ESMI PayPal Storefront	2
Gallarific PHP Photo Gallery script	2
Ovidentia	2
Microsoft Windows	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Secomea GateManager insufficient privileges	5.9	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00054	0.04	CVE-2022-25782
2	Ovidentia fileman.php privileges management	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.35203	0.02	CVE-2006-2811
3	Plohni Shoutbox index.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00186	0.00	CVE-2009-4767
4	FileZilla FileZilla Server Terminal FTP Command memory corruption	7.5	7.5	$0-$5k	$0-$5k	High	Not Defined	0.55865	0.05	CVE-2005-3589
5	Sendmail Access Restriction cryptographic issues	7.3	6.6	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00541	0.05	CVE-2009-4565
6	sitepress-multilingual-cms Plugin class-wp-installer.php cross-site request forgery	6.5	6.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00579	0.04	CVE-2020-10568
7	Canonical Linux SSL Certificate authentication spoofing	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00598	0.00	CVE-2011-4408
8	SBLIM Small Footprint CIM Broker POST Request cimom null pointer dereference	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00063	0.03	CVE-2018-6644
9	php-fusion downloads.php cross site scripting	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00159	0.00	CVE-2020-12708
10	Gallarific PHP Photo Gallery script gallery.php sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00136	0.05	CVE-2011-0519
11	Gallery My Photo Gallery image.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
12	Host Web Server phpinfo.php phpinfo information disclosure	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Workaround	0.00000	0.05
13	ESMI PayPal Storefront products1h.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.05468	0.00	CVE-2005-0936
14	Ecommerce Online Store Kit shop.php sql injection	9.8	9.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03763	0.05	CVE-2004-0300
15	Simple Real Estate Portal System sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00172	0.00	CVE-2022-28410
16	Infoblox NIOS access control	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00044	0.00	CVE-2018-10239
17	Microsoft Windows Win32k privileges management	7.3	6.3	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00043	0.03	CVE-2021-1709
18	php-fpm link following	5.4	5.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00042	0.00	CVE-2015-3211
19	ProFTPD mod_sftp/mod_sftp_pam kbdint.c resp_count numeric error	7.5	7.1	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.01980	0.02	CVE-2013-4359
20	EmbedThis GoAhead cgi.c cgiHandler input validation	7.7	7.5	$0-$5k	$0-$5k	High	Official Fix	0.97455	0.00	CVE-2017-17562

Campaigns (1)

These are the campaigns that can be associated with the actor:

DarkVNC

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	2.152.208.135	2.152.208.135.dyn.user.ono.com	DarkVNC	08/13/2023	verified	High
2	20.211.121.138		DarkVNC	10/13/2023	verified	High
3	XX.XX.XXX.XXX	xx.xx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx	04/06/2024	verified	High
4	XX.XXX.XX.XX		Xxxxxxx	06/29/2022	verified	High
5	XXX.XXX.XXX.XXX		Xxxxxxx	07/27/2022	verified	High
6	XXX.XX.XXX.XXX		Xxxxxxx	11/01/2022	verified	High
7	XXX.XXX.XX.XX		Xxxxxxx	08/12/2022	verified	High

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
2	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
6	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
7	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (28)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/cimom	predictive	Low
2	File	/my_photo_gallery/image.php	predictive	High
3	File	/reps/classes/Users.php?f=delete_agent	predictive	High
4	File	/uncpath/	predictive	Medium
5	File	xxx.x	predictive	Low
6	File	xxxxxxxxx/xxxxxxxxx.xxx	predictive	High
7	File	xxxxxxx.xxx	predictive	Medium
8	File	xxxxx_xxxxxxxx.x	predictive	High
9	File	xxxxxxx.xxx	predictive	Medium
10	File	xxxxxxxx/xxxxx-xx-xxxxxxxxx.xxx	predictive	High
11	File	xxxxx.xxx	predictive	Medium
12	File	xxxxxx.x	predictive	Medium
13	File	xxxxxxx.xxx	predictive	Medium
14	File	xxxxxxxxxx.xxx	predictive	High
15	File	xxxx.xxx	predictive	Medium
16	File	xxxxxxxx.xxx	predictive	Medium
17	File	xxxxxxxx.xxx	predictive	Medium
18	File	xx-xxxxx/xxxxx-xxxxxx.xxx	predictive	High
19	Argument	xxxxxx	predictive	Low
20	Argument	xxxxxxxxxxxxxx	predictive	High
21	Argument	xxx_xx	predictive	Low
22	Argument	xx	predictive	Low
23	Argument	xxxxx	predictive	Low
24	Argument	xxxx	predictive	Low
25	Argument	xxxxxx_xxxx	predictive	Medium
26	Input Value	//	predictive	Low
27	Input Value	x xxxxx xxx xxxxxx xxxx,xxxx,xxxx,xxxx,xxxxxx(xxxxxxxxxxxx,xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx,xxxxxxxxxxxx)--	predictive	High
28	Network Port	xxx/xxxx (xxx)	predictive	High

References (9)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!