DeimosC2 Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (35)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	30
fr	4
de	2

Country

cn	16
us	14

Actors

DeimosC2	4
Cobalt Strike	2
Raccoon	1
Conti	1
SideWinder	1

Activities

Interest

Timeline

Type

Not Defined	10
Content Management System	6
WordPress Plugin	4
Programming Language Software	2
Web Browser	2

Vendor

Not Defined	12
Synology	2
Mozilla	2
Peplink	2
CeNova/Night OWL/Novo/Pulnix/QSee/Securus	2

Product

TYPO3	4
PHP	2
Synology Video Station	2
Mozilla Firefox	2
Mondula Multi Step Form Plugin	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	VeronaLabs wp-statistics Plugin API Endpoint Blind sql injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00250	0.00	CVE-2019-13275
2	RoundCube Webmail Email Message rcube_string_replacer.php linkref_addindex cross site scripting	3.5	3.4	$0-$5k	$0-$5k	High	Official Fix	0.00612	0.04	CVE-2020-35730
3	Peplink Balance Cookie admin.cgi sql injection	8.5	7.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01457	0.02	CVE-2017-8835
4	Winn Winn GuestBook addPost cross site scripting	4.3	4.1	$0-$5k	$0-$5k	High	Official Fix	0.00336	0.00	CVE-2011-5026
5	MikroTik RouterOS Winbox/HTTP Interface privileges management	7.8	7.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00055	0.08	CVE-2023-30799
6	Meteor Slides Plugin cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00056	0.00	CVE-2022-4486
7	Node.js Pathname Validator access control	7.4	7.1	$0-$5k	$0-$5k	High	Official Fix	0.96684	0.03	CVE-2017-14849
8	Linux Kernel TLB mremap.c use after free	5.5	5.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00077	0.00	CVE-2022-41222
9	Linux Kernel rmap.c anon_vma use after free	5.9	5.8	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.04	CVE-2022-42703
10	Mozilla Firefox Block Reflow resource management	5.3	4.8	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.44701	0.00	CVE-2008-2798
11	SEMCMS Ant_Check.php sql injection	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00197	0.04	CVE-2022-2726
12	TCL LinkHub Mesh Wifi MS1G Network confctl_set_master_wlan access control	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00086	0.03	CVE-2022-27185
13	Discy Theme POST Request discy_update_options access control	6.4	6.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00058	0.00	CVE-2022-1323
14	SourceCodester Simple Student Information System manage_course.php sql injection	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00425	0.08	CVE-2022-2722
15	ONLYOFFICE Document Server WebSocket API sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00174	0.00	CVE-2020-11537
16	PHP PDO Driver Extension fetch out-of-bounds	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00379	0.00	CVE-2021-21704
17	Microsoft Windows stack-based overflow	7.3	6.6	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.88509	0.00	CVE-2005-0416
18	TYPO3 Login Handling redirect	6.2	5.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00080	0.02	CVE-2021-21338
19	TYPO3 Backend information disclosure	5.4	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00101	0.02	CVE-2010-3664
20	Magento sql injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.09912	0.03	CVE-2019-7139

IOC - Indicator of Compromise (15)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	5.101.4.196	hvilica.ru.4.101.5.in-addr.arpa	DeimosC2	10/09/2023	verified	High
2	5.101.5.196		DeimosC2	10/09/2023	verified	High
3	5.181.156.137	5-181-156-137.mivocloud.com	DeimosC2	12/19/2023	verified	High
4	X.XXX.XXX.XXX		Xxxxxxxx	10/26/2023	verified	High
5	XX.XXX.XXX.XXX	xxx-xx-xxx-xxx-xxx.xx-xxxxx-x.xxxxxxx.xxxxxxxxx.xxx	Xxxxxxxx	10/09/2023	verified	Medium
6	XX.XXX.XX.X	xxx-xx-xxx-xx-x.xxxxxxx-x.xxxxxxxxx.xxx	Xxxxxxxx	10/23/2023	verified	Medium
7	XX.XX.XXX.XX		Xxxxxxxx	04/24/2024	verified	High
8	XX.XX.XXX.XXX		Xxxxxxxx	03/04/2024	verified	High
9	XXX.XX.XX.XXX		Xxxxxxxx	04/24/2024	verified	High
10	XXX.XXX.XX.XX	xxxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxxxxxxx	04/24/2024	verified	High
11	XXX.XXX.XXX.XX		Xxxxxxxx	10/12/2023	verified	High
12	XXX.XXX.XX.XXX		Xxxxxxxx	12/27/2023	verified	High
13	XXX.XX.XX.XXX		Xxxxxxxx	04/24/2024	verified	High
14	XXX.XX.XXX.XXX		Xxxxxxxx	04/24/2024	verified	High
15	XXX.XXX.XX.XX		Xxxxxxxx	12/24/2023	verified	High

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
2	T1068	CAPEC-122	CWE-264, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	High
3	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
4	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
5	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
6	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
7	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (17)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	Ant_Check.php	predictive	High
2	File	cgi-bin/MANGA/admin.cgi	predictive	High
3	File	download.rsp	predictive	Medium
4	File	xx/xx-xx.x	predictive	Medium
5	File	xxxxxx_xxxxxx.xxx	predictive	High
6	File	xx/xxxxxx.x	predictive	Medium
7	File	xx/xxxx.x	predictive	Medium
8	File	xxxxx_xxxxxx_xxxxxxxx.xxx	predictive	High
9	File	xxxxxxxx.xxx	predictive	Medium
10	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	High
11	Argument	xxxxx	predictive	Low
12	Argument	xxx	predictive	Low
13	Argument	xxxxx	predictive	Low
14	Argument	xx_xxxx [xx][x]/xx_xxxx [xx][x]/xx_xxxx [xx][x]/xx_xxxx [xx][x]/xxxxx	predictive	High
15	Argument	xx	predictive	Low
16	Argument	xxxx	predictive	Low
17	Argument	xxxxxxxx_xxxxxxxx	predictive	High

References (14)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!