Ghost RAT Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (1000)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	962
zh	38

Country

cn	994
us	6

Actors

Mirai	5
Alien	1

Activities

Interest

Timeline

Type

Not Defined	232
Operating System	30
Content Management System	26
Web Browser	26
Smartphone Operating System	20

Vendor

Not Defined	196
Oracle	44
Apple	34
Google	30
Microsoft	20

Product

Google Chrome	16
Microsoft Windows	14
Google Android	14
Apple macOS	10
Qualcomm Snapdragon Auto	8

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	librsvg URL Decoder path traversal	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00158	0.04	CVE-2023-38633
2	Pluck CMS Installation install.php cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00051	0.04	CVE-2023-5013
3	Windriver VxWorks input validation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01132	0.04	CVE-2013-0716
4	Windriver VxWorks cryptographic issues	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00209	0.05	CVE-2010-2967
5	Windriver VxWorks Hardcoded Credentials credentials management	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00419	0.04	CVE-2010-2966
6	Cisco RV340 Web-based Management Interface memory corruption	5.5	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00699	0.04	CVE-2020-3451
7	jeecgboot JimuReport Template injection	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00457	0.25	CVE-2023-4450
8	Adminer adminer.php server-side request forgery	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02092	0.05	CVE-2021-21311
9	Tenda AC500 WriteFacMac formWriteFacMac command injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.38	CVE-2024-3908
10	cym1102 nginxWebUI addOver findCountByQuery path traversal	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.25	CVE-2024-3737
11	Supermicro X11SSM-F/X11SAE-F/X11SSE-F cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00043	0.05	CVE-2023-40287
12	Xitami HTTP Server HTTP Request If-Modified-Since memory corruption	7.3	7.3	$25k-$100k	$0-$5k	High	Unavailable	0.95587	0.05	CVE-2007-5067
13	Wagtail String Comparison timing discrepancy	4.0	3.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.00	CVE-2020-11037
14	Netgear D3600/D6000/D6100/R6100 memory corruption	7.5	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00079	0.00	CVE-2018-21217
15	Netgear WNR2050 Reflected cross site scripting	4.4	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.00	CVE-2018-21209
16	pixl-class create os command injection	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00347	0.00	CVE-2020-7640
17	Mozilla Firefox Private Browsing Password session fixiation	2.8	2.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.00	CVE-2020-6824

IOC - Indicator of Compromise (164)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	1.13.249.49		Ghost RAT	10/23/2023	verified	High
2	1.92.90.232	ecs-1-92-90-232.compute.hwclouds-dns.com	Ghost RAT	02/27/2024	verified	High
3	2.58.64.219		Ghost RAT	10/12/2022	verified	High
4	3.13.191.225	ec2-3-13-191-225.us-east-2.compute.amazonaws.com	Ghost RAT	04/17/2022	verified	Medium
5	3.14.182.203	ec2-3-14-182-203.us-east-2.compute.amazonaws.com	Ghost RAT	04/17/2022	verified	Medium
6	3.17.7.232	ec2-3-17-7-232.us-east-2.compute.amazonaws.com	Ghost RAT	04/17/2022	verified	Medium
7	3.22.30.40	ec2-3-22-30-40.us-east-2.compute.amazonaws.com	Ghost RAT	04/25/2022	verified	Medium
8	3.124.142.205	ec2-3-124-142-205.eu-central-1.compute.amazonaws.com	Ghost RAT	03/05/2024	verified	Medium
9	3.125.223.134	ec2-3-125-223-134.eu-central-1.compute.amazonaws.com	Ghost RAT	03/05/2024	verified	Medium
10	3.134.39.220	ec2-3-134-39-220.us-east-2.compute.amazonaws.com	Ghost RAT	04/17/2022	verified	Medium
11	3.134.125.175	ec2-3-134-125-175.us-east-2.compute.amazonaws.com	Ghost RAT	04/25/2022	verified	Medium
12	3.141.177.1	ec2-3-141-177-1.us-east-2.compute.amazonaws.com	Ghost RAT	08/05/2023	verified	Medium
13	3.142.81.166	ec2-3-142-81-166.us-east-2.compute.amazonaws.com	Ghost RAT	03/22/2022	verified	Medium
14	8.130.11.62		Ghost RAT	02/26/2024	verified	High
15	13.58.157.220	ec2-13-58-157-220.us-east-2.compute.amazonaws.com	Ghost RAT	03/22/2022	verified	Medium
16	18.158.249.75	ec2-18-158-249-75.eu-central-1.compute.amazonaws.com	Ghost RAT	03/05/2024	verified	Medium
17	18.189.106.45	ec2-18-189-106-45.us-east-2.compute.amazonaws.com	Ghost RAT	08/05/2023	verified	Medium
18	18.192.31.165	ec2-18-192-31-165.eu-central-1.compute.amazonaws.com	Ghost RAT	03/05/2024	verified	Medium
19	23.106.215.217		Ghost RAT	12/16/2022	verified	High
20	23.225.73.110		Ghost RAT	10/08/2021	verified	High
21	23.251.41.162		Ghost RAT	08/05/2023	verified	High
22	27.25.156.47		Ghost RAT	04/13/2024	verified	High
23	38.47.204.154		Ghost RAT	04/25/2023	verified	High
24	38.181.20.78		Ghost RAT	10/28/2023	verified	High
25	38.181.58.21	uhn19.pm.com	Ghost RAT	08/10/2023	verified	High
26	39.109.113.141		Ghost RAT	03/04/2023	verified	High
27	42.237.24.42	hn.kd.ny.adsl	Ghost RAT	02/25/2024	verified	High
28	42.237.25.52	hn.kd.ny.adsl	Ghost RAT	03/01/2024	verified	High
29	43.129.192.59		Ghost RAT	10/01/2021	verified	High
30	43.136.78.18		Ghost RAT	01/22/2024	verified	High
31	43.139.48.143		Ghost RAT	04/05/2024	verified	High
32	43.142.38.153		Ghost RAT	03/02/2023	verified	High
33	43.248.129.152		Ghost RAT	03/12/2024	verified	High
34	XX.XXX.XXX.XXX		Xxxxx Xxx	11/22/2023	verified	High
35	XX.XXX.XXX.XXX		Xxxxx Xxx	09/28/2022	verified	High
36	XX.XXX.XXX.XXX	xx-xxx-xxx-xxx.xxxxxx.xxxxxxx.xxx	Xxxxx Xxx	08/14/2021	verified	High
37	XX.XXX.XXX.XXX		Xxxxx Xxx	12/16/2022	verified	High
38	XX.XX.XX.XX		Xxxxx Xxx	11/25/2023	verified	High
39	XX.XX.XXX.XXX		Xxxxx Xxx	08/03/2022	verified	High
40	XX.XXX.XX.XXX		Xxxxx Xxx	09/18/2023	verified	High
41	XX.XXX.XXX.XX		Xxxxx Xxx	02/15/2023	verified	High
42	XX.XXX.XX.XXX		Xxxxx Xxx	08/23/2022	verified	High
43	XX.XXX.XXX.XX		Xxxxx Xxx	08/11/2022	verified	High
44	XX.XXX.XXX.XXX		Xxxxx Xxx	01/26/2023	verified	High
45	XX.XXX.XXX.XXX	xxxxxxxxxxxxxx.xxxx.xxxx.xxxx.xx.xx	Xxxxx Xxx	09/28/2022	verified	High
46	XX.XXX.XX.XXX		Xxxxx Xxx	02/27/2023	verified	High
47	XX.XXX.XX.XXX		Xxxxx Xxx	04/17/2023	verified	High
48	XX.XXX.XXX.XXX		Xxxxx Xxx	04/24/2024	verified	High
49	XX.XXX.XXX.XXX		Xxxxx Xxx	08/27/2023	verified	High
50	XX.XXX.XX.XXX		Xxxxx Xxx	11/06/2023	verified	High
51	XX.XXX.XXX.XXX		Xxxxx Xxx	10/23/2023	verified	High
52	XX.XXX.XXX.XX		Xxxxx Xxx	03/02/2023	verified	High
53	XX.XXX.XX.X		Xxxxx Xxx	03/25/2024	verified	High
54	XX.XXX.XXX.XXX		Xxxxx Xxx	08/25/2023	verified	High
55	XX.XXX.XXX.XX	xxxxx-xxxxx.xxxxxxxxxxxx.xxx	Xxxxx Xxx	10/13/2023	verified	High
56	XX.XXX.XXX.XXX	xx.xxx.xxx.xxx.xxxxxx.xxxx.xxx	Xxxxx Xxx	08/23/2023	verified	High
57	XXX.XX.XXX.XXX		Xxxxx Xxx	03/15/2023	verified	High
58	XXX.XX.XXX.XXX		Xxxxx Xxx	01/16/2024	verified	High
59	XXX.XXX.XXX.XXX		Xxxxx Xxx	03/02/2022	verified	High
60	XXX.XX.XXX.XXX		Xxxxx Xxx	04/02/2023	verified	High
61	XXX.XX.XXX.XXX		Xxxxx Xxx	12/05/2022	verified	High
62	XXX.XX.XX.XX		Xxxxx Xxx	03/15/2022	verified	High
63	XXX.XX.X.XXX		Xxxxx Xxx	09/17/2022	verified	High
64	XXX.XX.XXX.XXX		Xxxxx Xxx	01/22/2024	verified	High
65	XXX.XX.XXX.XXX		Xxxxx Xxx	12/09/2021	verified	High
66	XXX.XX.XXX.XX		Xxxxx Xxx	08/22/2021	verified	High
67	XXX.XX.XXX.XXX		Xxxxx Xxx	11/07/2023	verified	High
68	XXX.XX.XXX.XX		Xxxxx Xxx	12/25/2022	verified	High
69	XXX.XX.XX.XXX		Xxxxx Xxx	07/09/2023	verified	High
70	XXX.XXX.XX.X		Xxxxx Xxx	08/08/2021	verified	High
71	XXX.XXX.XX.XX		Xxxxx Xxx	08/13/2021	verified	High
72	XXX.XXX.XX.XXX		Xxxxx Xxx	08/23/2023	verified	High
73	XXX.XXX.XX.XX		Xxxxx Xxx	09/20/2021	verified	High
74	XXX.XXX.XXX.XXX		Xxxxx Xxx	10/13/2023	verified	High
75	XXX.XXX.XX.XXX		Xxxxx Xxx	04/24/2024	verified	High
76	XXX.XXX.XX.XXX		Xxxxx Xxx	12/02/2022	verified	High
77	XXX.XXX.XX.XX		Xxxxx Xxx	01/23/2024	verified	High
78	XXX.XXX.XXX.XX		Xxxxx Xxx	04/17/2022	verified	High
79	XXX.XXX.XXX.XX		Xxxxx Xxx	03/05/2023	verified	High
80	XXX.XX.XXX.XXX	xxxxxxxxxx.xxxxxxx-xxxx.xxx	Xxxxx Xxx	12/23/2023	verified	High
81	XXX.XXX.XX.XX		Xxxxx Xxx	10/03/2021	verified	High
82	XXX.XX.XXX.XXX		Xxxxx Xxx	10/26/2023	verified	High
83	XXX.XX.XXX.XX		Xxxxx Xxx	10/13/2023	verified	High
84	XXX.XX.XX.XX		Xxxxx Xxx	10/23/2023	verified	High
85	XXX.XXX.XXX.XX		Xxxxx Xxx	12/12/2023	verified	High
86	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxxx Xxx	11/29/2022	verified	High
87	XXX.XX.XXX.XX		Xxxxx Xxx	03/12/2024	verified	High
88	XXX.XX.XXX.XX		Xxxxx Xxx	01/01/2022	verified	High
89	XXX.XXX.XXX.XX		Xxxxx Xxx	05/22/2022	verified	High
90	XXX.XX.XXX.XX		Xxxxx Xxx	02/13/2024	verified	High
91	XXX.XXX.XX.XX		Xxxxx Xxx	04/24/2024	verified	High
92	XXX.XX.XX.X		Xxxxx Xxx	02/19/2023	verified	High
93	XXX.XXX.XXX.XXX		Xxxxx Xxx	07/23/2022	verified	High
94	XXX.XXX.XXX.XXX		Xxxxx Xxx	06/16/2022	verified	High
95	XXX.XX.XXX.X		Xxxxx Xxx	06/27/2023	verified	High
96	XXX.XXX.XXX.XX		Xxxxx Xxx	06/08/2023	verified	High
97	XXX.XXX.XXX.XX		Xxxxx Xxx	03/12/2024	verified	High
98	XXX.XXX.XXX.XXX		Xxxxx Xxx	07/05/2023	verified	High
99	XXX.XXX.XXX.XXX		Xxxxx Xxx	08/26/2023	verified	High
100	XXX.XX.XXX.XXX		Xxxxx Xxx	07/23/2022	verified	High
101	XXX.XX.XX.XX	xxx-xxx-xx-xx-xx.xxxxxxx.xxxxxxxx-xxx.xxx	Xxxxx Xxx	10/13/2023	verified	High
102	XXX.XXX.XX.XXX		Xxxxx Xxx	01/08/2024	verified	High
103	XXX.XXX.XXX.XXX		Xxxxx Xxx	04/26/2022	verified	High
104	XXX.XXX.XXX.XX	xxxx-xxx-xxx-xx.xxxxxx.xxx	Xxxxx Xxx	02/23/2022	verified	High
105	XXX.X.XXX.XXX		Xxxxx Xxx	10/10/2022	verified	High
106	XXX.X.XXX.XXX		Xxxxx Xxx	10/13/2023	verified	High
107	XXX.XX.XXX.XXX	xxxxx.xx.xxx.xx-xxxx.xxxx	Xxxxx Xxx	11/15/2023	verified	High
108	XXX.XX.XX.XXX		Xxxxx Xxx	11/05/2023	verified	High
109	XXX.XX.XXX.XX		Xxxxx Xxx	08/20/2022	verified	High
110	XXX.XX.XXX.XXX		Xxxxx Xxx	10/13/2023	verified	High
111	XXX.XX.XXX.XXX		Xxxxx Xxx	05/21/2023	verified	High
112	XXX.XXX.XX.XX		Xxxxx Xxx	03/04/2022	verified	High
113	XXX.XXX.XXX.XX		Xxxxx Xxx	10/13/2023	verified	High
114	XXX.XXX.XXX.XX		Xxxxx Xxx	10/13/2023	verified	High
115	XXX.XXX.XX.XX		Xxxxx Xxx	10/13/2023	verified	High
116	XXX.XXX.XX.XX		Xxxxx Xxx	03/12/2024	verified	High
117	XXX.XX.XX.X	x.xx.xx.xxx.xxxxx.xx.xx.xxxxxxx.xxxxxxx.xxx.xx	Xxxxx Xxx	08/06/2021	verified	High
118	XXX.XXX.XX.XX	xxx-xxx-xx-xx.xxxxx-xx.xxxxx.xxx	Xxxxx Xxx	10/13/2023	verified	High
119	XXX.XXX.XXX.XXX		Xxxxx Xxx	10/12/2022	verified	High
120	XXX.XXX.XX.XX		Xxxxx Xxx	01/17/2024	verified	High
121	XXX.XXX.XXX.XXX		Xxxxx Xxx	07/05/2022	verified	High
122	XXX.XXX.XXX.XX		Xxxxx Xxx	11/29/2023	verified	High
123	XXX.XXX.XXX.XX		Xxxxx Xxx	11/28/2023	verified	High
124	XXX.XXX.XXX.XXX		Xxxxx Xxx	09/05/2021	verified	High
125	XXX.XX.XX.XXX		Xxxxx Xxx	12/09/2023	verified	High
126	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxx Xxx	04/23/2022	verified	High
127	XXX.XX.XX.XXX		Xxxxx Xxx	12/10/2023	verified	High
128	XXX.XXX.XX.XX		Xxxxx Xxx	03/17/2023	verified	High
129	XXX.XX.XXX.XX		Xxxxx Xxx	12/04/2023	verified	High
130	XXX.XX.XXX.XXX		Xxxxx Xxx	05/10/2022	verified	High
131	XXX.XX.XX.XX		Xxxxx Xxx	02/21/2023	verified	High
132	XXX.XX.XXX.XXX		Xxxxx Xxx	12/16/2023	verified	High
133	XXX.XXX.XXX.XXX		Xxxxx Xxx	01/28/2022	verified	High
134	XXX.XXX.XX.XX		Xxxxx Xxx	04/02/2023	verified	High
135	XXX.XXX.XX.XXX		Xxxxx Xxx	03/22/2023	verified	High
136	XXX.XXX.XX.XXX		Xxxxx Xxx	11/15/2023	verified	High
137	XXX.XXX.XXX.X		Xxxxx Xxx	06/15/2023	verified	High
138	XXX.XXX.XX.XXX		Xxxxx Xxx	02/25/2024	verified	High
139	XXX.XXX.XX.XX		Xxxxx Xxx	12/09/2023	verified	High
140	XXX.XX.XX.XXX		Xxxxx Xxx	04/17/2022	verified	High
141	XXX.XX.XX.XX		Xxxxx Xxx	04/27/2022	verified	High
142	XXX.XX.XXX.XXX		Xxxxx Xxx	02/05/2024	verified	High
143	XXX.XXX.XX.XX		Xxxxx Xxx	02/09/2023	verified	High
144	XXX.XXX.XX.XXX		Xxxxx Xxx	12/27/2023	verified	High
145	XXX.XX.XXX.XXX		Xxxxx Xxx	04/24/2024	verified	High
146	XXX.XX.XXX.XXX		Xxxxx Xxx	10/13/2023	verified	High
147	XXX.XXX.XXX.XXX		Xxxxx Xxx	05/21/2023	verified	High
148	XXX.XXX.X.XX		Xxxxx Xxx	03/24/2023	verified	High
149	XXX.XXX.XXX.XXX		Xxxxx Xxx	10/21/2023	verified	High
150	XXX.XXX.XXX.XXX		Xxxxx Xxx	10/21/2023	verified	High
151	XXX.XX.XXX.XXX		Xxxxx Xxx	02/29/2024	verified	High
152	XXX.XX.XXX.XXX		Xxxxx Xxx	03/06/2024	verified	High
153	XXX.XX.XXX.XXX		Xxxxx Xxx	10/13/2023	verified	High
154	XXX.XX.X.XXX		Xxxxx Xxx	10/27/2023	verified	High
155	XXX.XXX.XXX.XXX		Xxxxx Xxx	05/10/2022	verified	High
156	XXX.XXX.XXX.XXX		Xxxxx Xxx	02/06/2022	verified	High
157	XXX.XXX.XXX.XX		Xxxxx Xxx	11/28/2023	verified	High
158	XXX.XX.XXX.XX		Xxxxx Xxx	07/17/2022	verified	High
159	XXX.XXX.XXX.XXX		Xxxxx Xxx	10/13/2023	verified	High
160	XXX.XXX.XX.XXX		Xxxxx Xxx	03/02/2023	verified	High
161	XXX.XX.XX.XXX		Xxxxx Xxx	03/23/2024	verified	High
162	XXX.XXX.XX.X		Xxxxx Xxx	05/14/2022	verified	High
163	XXX.XXX.XX.XXX		Xxxxx Xxx	02/01/2024	verified	High
164	XXX.XXX.XXX.XX	xx.xxx.xxx.xxx.xxxxx.xx.xx.xxxxxxx.xxxxxxx.xxx.xx	Xxxxx Xxx	10/13/2023	verified	High

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CAPEC-137	CWE-88, CWE-94	Argument Injection	predictive	High
4	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	High
5	T1068	CAPEC-122	CWE-264, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	High
6	TXXXX	CAPEC-150	CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	predictive	High
7	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
8	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
9	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
10	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
11	TXXXX	CAPEC-1	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
12	TXXXX	CAPEC-184	CWE-XXX	Xxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx Xxxxx	predictive	High
13	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
14	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
15	TXXXX	CAPEC-102	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
16	TXXXX	CAPEC-38	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
17	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
18	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
19	TXXXX	CAPEC-112	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
20	TXXXX.XXX	CAPEC-	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	High
21	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (179)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	.htaccess	predictive	Medium
2	File	/admin.php?p=/Area/index#tab=t2	predictive	High
3	File	/adminPage/www/addOver	predictive	High
4	File	/bin/sh	predictive	Low
5	File	/gateway/services/EdgeServiceImpl	predictive	High
6	File	/goform/net\_Web\_get_value	predictive	High
7	File	/goform/WriteFacMac	predictive	High
8	File	/HNAP1	predictive	Low
9	File	/Maintenance/configfile.cfg	predictive	High
10	File	/module/comment/save	predictive	High
11	File	/rest	predictive	Low
12	File	/root	predictive	Low
13	File	/scripts/unlock_tasks.php	predictive	High
14	File	/topic	predictive	Low
15	File	/upload/localhost	predictive	High
16	File	/wp-admin/admin-ajax.php	predictive	High
17	File	account/login.php	predictive	High
18	File	ActiveMQConnection.java	predictive	High
19	File	ActivityManagerService.java	predictive	High
20	File	admin/app/mediamanager	predictive	High
21	File	xxxxx/xxx/xxxxxxxx/xxxxxxxxxxxx.xxxx?xxx_xxxx=xxx	predictive	High
22	File	xxxxx/xxxxxx.xxx	predictive	High
23	File	xxxxx/xxxxxxxx/xxxxxxxxxxxx?xx=xx	predictive	High
24	File	xxxxx/_xxxxxxx.xxx	predictive	High
25	File	xxxxxxx.xxx	predictive	Medium
26	File	xxxxxxxxxxxxx_xxxxxxxxxxxxxxx.xxxx	predictive	High
27	File	xxx.xxx/xxx/xxxxxx	predictive	High
28	File	xxx/xxxxxx/xxxxxxxxxx.xxx	predictive	High
29	File	xxx/xxxxxx/xxxxxxxx/xxxxx/xxxxxxxx_xxxxxxx.xxxxx.xxx	predictive	High
30	File	xxxxx/xxx_xxxx.x	predictive	High
31	File	xxxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	High
32	File	xxxxxx/xxxxxx/	predictive	High
33	File	xxxxxxxxx-xxxxxxx/xxx/xxxx/xxxx/xx/xxxxxxx/xxxxxxxxx/xxxxxxx/xxxxxxx/xxxxxx.xxxx	predictive	High
34	File	xxx_xx_xxx.xx	predictive	High
35	File	xxxxxxxxxx.x	predictive	Medium
36	File	xxxxx.xx	predictive	Medium
37	File	xxx-xxx/xxxx/xxxxx/xxxxxxx/xxxxxxxx/xxxxxxxx	predictive	High
38	File	xxx.xxxxxxxx.xxxxxxx.xxx.xxx.xxxxxxxxxxxxx	predictive	High
39	File	xxxxxxxxxx/xxx.xx	predictive	High
40	File	xxxxxx.xxx	predictive	Medium
41	File	xxxx/xxxxxxxxxxx.xxx	predictive	High
42	File	xxxxx/xxxx/xxxxxxxxxxx/xxxxx/xxxxx.xxx	predictive	High
43	File	xxxxxx_x_x.xxx	predictive	High
44	File	xxxxxxxxx_xxx_xxxxxx_xxx/	predictive	High
45	File	xxxxxxx/xxx/xxxxxxxx/xxxxxxxxx/xxx/xxxxxx/xxxx.x	predictive	High
46	File	xxxxxxx/xx/xxxxxxxx.x	predictive	High
47	File	xxx_xxx.x	predictive	Medium
48	File	xxxxxxx/xxxxxxxx.xxx	predictive	High
49	File	xxx-xxxxx.x	predictive	Medium
50	File	xxx/xxxxxx/xxx/?xxxxxx=xxxx&xx=xxx	predictive	High
51	File	xxxxxxxx_xxx.x	predictive	High
52	File	xxxxxx.xxx	predictive	Medium
53	File	xxxxxxxxxxxxxxxxx.xxxx	predictive	High
54	File	xxxxxxxx.xx	predictive	Medium
55	File	xxxxxxxxxxxxxxxxxxxxxxxx.xxx	predictive	High
56	File	xx/xxxx/xxxxx.x	predictive	High
57	File	xxxxxxxxxx.x	predictive	Medium
58	File	xxxxxx/xxxx/xxxxxx.xxx	predictive	High
59	File	xxxxxxxxxxxxx.xxx	predictive	High
60	File	xxxxx.xxx	predictive	Medium
61	File	xxxx/xxxx.x	predictive	Medium
62	File	xxxxxxxx/xxxx.xxx	predictive	High
63	File	xxxxxxxx/xxxxx-xxx-xxxxxx.xxx	predictive	High
64	File	xxxxx.xxx	predictive	Medium
65	File	xxxxx.xxx?x=/xxxxx/xxxxxx/xxxxxx/xxxxxxxx/xxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxx	predictive	High
66	File	xxxxx_xxxxxx.xxx	predictive	High
67	File	xxxxxxx.xxx	predictive	Medium
68	File	xxxxxxxxxxxxxxx.xxxxx.xxxxxx	predictive	High
69	File	xxxxxxxx/xxxxx_xxxxxx.xxx	predictive	High
70	File	xxxxxxxxxxx.xx	predictive	High
71	File	xxxxxxx-xxxxxxx.xxx	predictive	High
72	File	xxxxxxxx.x	predictive	Medium
73	File	xxx.x	predictive	Low
74	File	xxxxxxxxxx/xxxxxx.x	predictive	High
75	File	xxxxxxx/xxxxx.x	predictive	High
76	File	xxxxxx.x	predictive	Medium
77	File	xxxxxx_xxxx_xx_xx_xxx.x	predictive	High
78	File	xxxxxxx/xxxxx_xxxx.xxx	predictive	High
79	File	xxxx.x	predictive	Low
80	File	xxxxxxxx.xxx	predictive	Medium
81	File	xxxxxx.x	predictive	Medium
82	File	xxxxxxxx.xxx	predictive	Medium
83	File	xxxxx.x	predictive	Low
84	File	xxx/xxxxxxxxxx/xxxxxx.x	predictive	High
85	File	xxx/xxxx/xx_xxxx.x	predictive	High
86	File	xxxxxx.x	predictive	Medium
87	File	xxxx_xxxx.xxx	predictive	High
88	File	xxxxx/xxxx-xxxxx.xxx	predictive	High
89	File	xxxxxxxx.xxx	predictive	Medium
90	File	xxxx.xxx	predictive	Medium
91	File	xxxxxxxxxxxxxx.xxx	predictive	High
92	File	xxxxxxxx_xxx.xxx	predictive	High
93	File	xx-xxxxx/xxxxx.xxx?xxx=xxxx&xxx=xxxxxx	predictive	High
94	File	xxxxxxx.xxx	predictive	Medium
95	File	xxxxxx/xxx.xxx	predictive	High
96	File	xxxxx.xxx	predictive	Medium
97	File	x/xxxxx/xxxxxxx/xxxx/xxx	predictive	High
98	File	xxxxxx-xxx-xxxx.x	predictive	High
99	File	xxxxxxxxxxxxxxxxxxx.xxxx	predictive	High
100	File	xxxxxxxxxx.x	predictive	Medium
101	File	xxxxxx/xxxx_xxxxxxx?xxx	predictive	High
102	File	xxxxxxxxxxxx/xxxxx.xx	predictive	High
103	File	xxxxx/xxxx_xxxx.x	predictive	High
104	File	xxx.xxx	predictive	Low
105	File	xxxx/xxxx.xxx	predictive	High
106	File	xxxxx/x/xxxx	predictive	Medium
107	File	xxxx_xxxxxx.xxx	predictive	High
108	File	xxx_xxxxxx.x	predictive	Medium
109	File	xxxxxxxxxx	predictive	Medium
110	File	xxxxxxxxxxxxx.xxx	predictive	High
111	File	xxxxxxxxxxx.xxx	predictive	High
112	File	xx-xxxxx/xxxxx-xxxx.xxx?xxxxxx=xxxx_xxxxxxx_xxxx_xxxxxxx	predictive	High
113	File	xxxxxxxx.x	predictive	Medium
114	Library	xxxxxxxxx.xxx	predictive	High
115	Library	xxx/xxxx/xxxxxxxxxx.xx	predictive	High
116	Library	xxxxxxx_xxxxx_xxxxxx	predictive	High
117	Library	xxxxx.xxx	predictive	Medium
118	Library	xxxxxx/xxxx/xxxxxx/xxxxx.x	predictive	High
119	Library	xxxxx.xxx	predictive	Medium
120	Library	xxxxx.xxx	predictive	Medium
121	Argument	-x	predictive	Low
122	Argument	xxxxxxxxxxx	predictive	Medium
123	Argument	xxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx/xxxxx/xxxxx/xxxxx_xxxxxxx	predictive	High
124	Argument	xxxxx	predictive	Low
125	Argument	xxxxxxx/xxxxxxxx	predictive	High
126	Argument	xxxxxxxx	predictive	Medium
127	Argument	xxxxxxx/xxxx	predictive	Medium
128	Argument	xxxxxxxx	predictive	Medium
129	Argument	xxxxx	predictive	Low
130	Argument	xxxxxxxxxxxxxxxx	predictive	High
131	Argument	xxx	predictive	Low
132	Argument	xxxxxx	predictive	Low
133	Argument	xxxxx_xxxx	predictive	Medium
134	Argument	xxxxxx[xxxxxxxxxxxxxx]	predictive	High
135	Argument	xxxxxxxxx/xxxxxxxxxx/xxxxx/xxxxxxx/xxxxxxx/xxxxxxxx	predictive	High
136	Argument	xxxx	predictive	Low
137	Argument	xxxxxx	predictive	Low
138	Argument	xxx	predictive	Low
139	Argument	xxxxx	predictive	Low
140	Argument	xxxxxxx	predictive	Low
141	Argument	xxx	predictive	Low
142	Argument	x_xx	predictive	Low
143	Argument	xxxx	predictive	Low
144	Argument	xxxx_xx	predictive	Low
145	Argument	xxxxxxxx	predictive	Medium
146	Argument	xxx	predictive	Low
147	Argument	xxxxxxxxxx/xxxxxxxxxxxx	predictive	High
148	Argument	xxxxx	predictive	Low
149	Argument	xxx_xxxxx	predictive	Medium
150	Argument	xxxxxxxx	predictive	Medium
151	Argument	xxxxxxxx	predictive	Medium
152	Argument	xxxxxxxx	predictive	Medium
153	Argument	xxxxxxxx	predictive	Medium
154	Argument	xxxx_xx	predictive	Low
155	Argument	xxxxxxxxxxxxxxxx	predictive	High
156	Argument	xxxxxxxxxxxxxx	predictive	High
157	Argument	xxxxxx	predictive	Low
158	Argument	xxxxxxxxxxxxxxxxxxx	predictive	High
159	Argument	xxxxxxxxxxxxxxx	predictive	High
160	Argument	xxxxxxxx/xxxxxxxxxxxxx	predictive	High
161	Argument	xxx	predictive	Low
162	Argument	xxxx	predictive	Low
163	Argument	xxxxxx-xxx	predictive	Medium
164	Argument	xxxxxx xxxxx/xxxxxx xxxx	predictive	High
165	Argument	xxxxxxxxx	predictive	Medium
166	Argument	xxxxxxxxxx	predictive	Medium
167	Input Value	../	predictive	Low
168	Input Value	x xxx xxxxx(x)	predictive	High
169	Input Value	<?xxx	predictive	Low
170	Input Value	<xxxxxx>xxxxx('xxx')</xxxxxx>	predictive	High
171	Input Value	xxxx@xx	predictive	Low
172	Input Value	xxxxxxxx	predictive	Medium
173	Input Value	xxxxxxxxxx&#x;:xxxxx	predictive	High
174	Input Value	xxxx=xxx-xxxxxxxx-xxxxxxx	predictive	High
175	Network Port	xxxx	predictive	Low
176	Network Port	xxx/xx (xxx)	predictive	Medium
177	Network Port	xxx/xxx	predictive	Low
178	Network Port	xxx/xxxx	predictive	Medium
179	Network Port	xxx/xxxxx	predictive	Medium

References (41)

The following list contains external sources which discuss the actor and the associated activities:

Samples (3)

The following list contains associated samples:

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!