JanelaRAT Analysis

IOB - Indicator of Behavior (1000)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en914
de28
zh14
ru12
es12

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us978
cn10
ir4
de2
br2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Microsoft Windows6
Zentrack4
PHP4
Pearlinger Products4
Webmin4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1LogicBoard CMS away.php redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable0.000002.41
2DZCP deV!L`z Clanportal config.php code injection7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.009430.73CVE-2010-0966
3FLDS redir.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.002030.21CVE-2008-5928
4Tiki Admin Password tiki-login.php improper authentication8.07.7$0-$5k$0-$5kNot DefinedOfficial Fix0.009362.12CVE-2020-15906
5My Link Trader out.php sql injection6.35.7$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.03
6Bitrix Site Manager redirect.php link following5.34.7$0-$5k$0-$5kUnprovenUnavailable0.001130.03CVE-2008-2052
7PHP phpinfo cross site scripting4.33.9$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.019600.03CVE-2007-1287
8SAS Web Report Studio javascript: URL logonAndRender.do cross site scripting3.53.4$0-$5k$0-$5kNot DefinedNot Defined0.000890.00CVE-2022-25256
9Vunet VU Web Visitor Analyst redir.asp sql injection7.37.1$0-$5k$0-$5kHighWorkaround0.001190.06CVE-2010-2338
10Serendipity exit.php privileges management6.36.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.21
11OpenX adclick.php redirect5.34.7$0-$5k$0-$5kUnprovenUnavailable0.004400.24CVE-2014-2230
12Lars Ellingsen Guestserver guestbook.cgi cross site scripting4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.001690.18CVE-2005-4222
13vBulletin redirector.php6.66.6$0-$5k$0-$5kNot DefinedNot Defined0.001060.04CVE-2018-6200
14Microsoft Windows Roaming Security Rights Management Services Remote Code Execution8.17.4$100k and more$5k-$25kUnprovenOfficial Fix0.003060.06CVE-2022-21974
15GetSimpleCMS index.php redirect6.66.6$0-$5k$0-$5kNot DefinedNot Defined0.001230.00CVE-2019-9915
16Atlassian Jira Service Management Server/Data Center InsightDefaultCustomFieldConfig.jspa cross site scripting3.53.4$0-$5k$0-$5kNot DefinedOfficial Fix0.000540.00CVE-2021-43943
17PHPWind goto.php redirect6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.003480.03CVE-2015-4134
18Openads adclick.php Remote Code Execution7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.018710.21CVE-2007-2046
19Atlassian JIRA Server/Data Center Thread Contention/CPU Monitoring Service ViewInstrumentation.jspa cross-site request forgery4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000740.00CVE-2021-43953
20Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation8.17.4$100k and more$5k-$25kUnprovenOfficial Fix0.000430.02CVE-2022-24507

IOC - Indicator of Compromise (12)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (18)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (297)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/admin/general.cgipredictiveHigh
2File/Admin/login.phppredictiveHigh
3File/admin/reminders/manage_reminder.phppredictiveHigh
4File/CCMAdmin/serverlist.asppredictiveHigh
5File/cgi/get_param.cgipredictiveHigh
6File/csms/admin/inquiries/view_details.phppredictiveHigh
7File/cstecgi.cgipredictiveMedium
8File/files.md5predictiveMedium
9File/forum/away.phppredictiveHigh
10File/hrm/employeeview.phppredictiveHigh
11File/include/chart_generator.phppredictiveHigh
12File/index.php?menu=asterisk_clipredictiveHigh
13File/librarian/bookdetails.phppredictiveHigh
14File/loginpredictiveLow
15File/messageboard/view.phppredictiveHigh
16File/oauth/idp/.well-known/openid-configurationpredictiveHigh
17File/one_church/userregister.phppredictiveHigh
18File/out.phppredictiveMedium
19File/owa/auth/logon.aspxpredictiveHigh
20File/public/plugins/predictiveHigh
21File/SAP_Information_System/controllers/add_admin.phppredictiveHigh
22File/SASWebReportStudio/logonAndRender.dopredictiveHigh
23File/secure/admin/InsightDefaultCustomFieldConfig.jspapredictiveHigh
24File/secure/admin/ViewInstrumentation.jspapredictiveHigh
25File/SVFE2/pages/feegroups/country_group.jsfpredictiveHigh
26File/SystemMng.ashxpredictiveHigh
27File/textpattern/index.phppredictiveHigh
28File/upfile.cgipredictiveMedium
29File/v2/quantum/save-data-upload-big-filepredictiveHigh
30File/wordpress/wp-admin/admin.phppredictiveHigh
31File4.edu.phppredictiveMedium
32FileAccountManagerService.javapredictiveHigh
33Fileaccount_footer.phppredictiveHigh
34Fileadclick.phppredictiveMedium
35Fileaddlink.phppredictiveMedium
36Filexxx_xxxx_xxx.xxxpredictiveHigh
37Filexxx_xxxx_xxxx.xxxpredictiveHigh
38Filexxxxx.xxxxxxxxxx.xxxpredictiveHigh
39Filexxxxx.xxxxxxxxx.xxxpredictiveHigh
40Filexxxxx/xxxxxxxxxxx.xxxpredictiveHigh
41Filexxxxx/xxxx_xxxxxxxx.xxxpredictiveHigh
42Filexxxxx/xxxxx.xxxpredictiveHigh
43Filexxxxx/xxxxxxxxxxxxx.xxxpredictiveHigh
44Filexxxxxxxxxxxxxxxx.xxxpredictiveHigh
45Filexxxxxxxxxxx.xxxpredictiveHigh
46Filexxxxxxxxxxx.xxxpredictiveHigh
47Filexxxx_xxxx_xxxxxxxx.xxxpredictiveHigh
48Filexx_xxxxxxxxxx.xxxpredictiveHigh
49Filexxx/xxxxxx/xxxx_xxxxxx.xxxpredictiveHigh
50Filexxxxxxxxxxxxxx.xxxpredictiveHigh
51Filexxxxxxxx.xxxxxxx.xxxpredictiveHigh
52Filexx_xxxxx_xxxxx.xxxpredictiveHigh
53Filexx_xxxx.xxxpredictiveMedium
54Filexxx_xxxxxxxxx.xxxpredictiveHigh
55Filex:\xxxxpredictiveLow
56Filexxxxxx/xxxxx/xxxxx.xxxpredictiveHigh
57Filexxxx_xxxxxxx.xxxpredictiveHigh
58Filexxxxxxxx.xxxpredictiveMedium
59Filexxxxxxxx.xxxpredictiveMedium
60Filexxx-xxx/xxxxxxxxxxxx.xxxpredictiveHigh
61Filexxx-xxx/xxx/xxxxxxxx_xxx.xxxpredictiveHigh
62Filexxxxxxxxxxx.xxxpredictiveHigh
63Filexxxxx.xxxxx.xxxpredictiveHigh
64Filexxxxx/xxxxx_xxxxxx.xxxpredictiveHigh
65Filexxxxxxxxxx_xxxxx.xxxpredictiveHigh
66Filexxxxx_xx_xxxxxxxxx.xxxpredictiveHigh
67Filexxxxx_xxxx.xxxpredictiveHigh
68Filexxxxx.xxxpredictiveMedium
69Filexxx.xxx?xxx=xxxxx_xxxxpredictiveHigh
70Filexxxx/xxxxxxxx.xxpredictiveHigh
71Filexxxxxxxx_xxxxxxxxxxxxxxxxx.xxxpredictiveHigh
72Filexxxxxxx.xxxpredictiveMedium
73Filexxxxxxxxxx.xxxpredictiveHigh
74Filexxxxxxxxxxxxxxxxxxx.xxpredictiveHigh
75Filexxxxxxxxx.xxxpredictiveHigh
76Filexxxxxxx.xxxpredictiveMedium
77Filexxxxxx.xxxpredictiveMedium
78Filexxxxxx.xxxpredictiveMedium
79Filexxxxxxxx.xxxpredictiveMedium
80Filexxxxxxxxxx-xxxxxxxxxxxxx.xxxpredictiveHigh
81Filexxxxxxx/xxxxx/xxxxx.xpredictiveHigh
82Filexxxxx.xxxpredictiveMedium
83Filexxxxx.xxxpredictiveMedium
84Filexxxx.xxxpredictiveMedium
85Filexxxxxxxx.xxxpredictiveMedium
86Filexxxxxxxx.xxxpredictiveMedium
87Filexxxxxxxxx.xxxpredictiveHigh
88Filexxxxxx.xxxxpredictiveMedium
89Filexxxx.xxxpredictiveMedium
90Filexxxx.xxxpredictiveMedium
91Filexxxxxxxxx.xxxpredictiveHigh
92Filexxxxxxxxx.xxpredictiveMedium
93Filexxxxxxxxxx.xxxpredictiveHigh
94Filexxxxx_xxxxxx.xxxpredictiveHigh
95Filexxxxxxxxx.xxxpredictiveHigh
96Filexxx/xxxxxxxx.xxxpredictiveHigh
97Filexxx/xxxxxx.xxxpredictiveHigh
98Filexxx/xxxxxxxxxxx/xxxxxxx.xxxpredictiveHigh
99Filexxx/xxxxxxx/xxxxxxxxxxxx.xxxpredictiveHigh
100Filexxxxxxx.xxxpredictiveMedium
101Filexxxxxxx/xxxx.xxxpredictiveHigh
102Filexxxxxxxx/xxxx.xxxpredictiveHigh
103Filexxxxx.xxxpredictiveMedium
104Filexxxx.xxxxpredictiveMedium
105Filexxxxxxxxxxxxx.xxxpredictiveHigh
106Filexxxxxxxx/xxxxxxxx_xxxxxxx_xxxxxx/xxxxx.xxxpredictiveHigh
107Filexxxx_xxxx.xxxpredictiveHigh
108Filexxx_xxxxxxxxx.xxxpredictiveHigh
109Filexxx.xxxxpredictiveMedium
110Filexxxxxx/xxxxxx/xxxxxx-xx.xpredictiveHigh
111Filexxxxxx.xxxpredictiveMedium
112Filexxxxx.xxxxpredictiveMedium
113Filexxxxx.xxxpredictiveMedium
114Filexxxxx.xxxxpredictiveMedium
115Filexxxxx_xxxxxxx.xxxpredictiveHigh
116Filexxx_xxxxxxxx.xxxpredictiveHigh
117Filexxx/xxxx_xxx.xxxpredictiveHigh
118Filexxxxxxx.xxxpredictiveMedium
119Filexxxxxxx/xxx.xxxpredictiveHigh
120Filexxx/xxxxxxxxx/xx_xxx_xxxxxx.xpredictiveHigh
121Filexxx.xxxpredictiveLow
122Filexxxxxx_xx.xxxpredictiveHigh
123Filexxx/xxxxx.xxxxpredictiveHigh
124Filex-xxxx.xxxpredictiveMedium
125Filexxxx.xxxxxxxxx.xxxpredictiveHigh
126Filexxxxxxxxx.xxx.xxxpredictiveHigh
127Filexxxxxx.xxxpredictiveMedium
128Filexxxx.xxxpredictiveMedium
129Filexxxx.xxxpredictiveMedium
130Filexxxxxxxxx/xxxxxxxxxxxxxx.xxxxpredictiveHigh
131Filexxx.xxxxx.xxxpredictiveHigh
132Filexxxxx.xxxpredictiveMedium
133Filexxxxx.xxxpredictiveMedium
134Filexxxxxxxx.xxxpredictiveMedium
135Filexxxxxxxxxx.xxxpredictiveHigh
136Filexxxxxxxx.xxxpredictiveMedium
137Filexxxxxxxx.xxxpredictiveMedium
138Filexxxxxxxx_xxxx.xxxpredictiveHigh
139Filexxxxxxxxxxxx_xxxxxxxx.xxx.xxxpredictiveHigh
140Filexxxxxx.xxxpredictiveMedium
141Filexxxxxxxx.xpredictiveMedium
142Filexx_xxxx.xpredictiveMedium
143Filexxxx_xxxx_xxxxxx.xxxpredictiveHigh
144Filexxxxxx.xxxpredictiveMedium
145Filexxxxxx.xxxpredictiveMedium
146Filexxxx/xxxxxxx/xxxxxxxxxxxxx_xxx.xxxpredictiveHigh
147Filexxxxxx.xxxxpredictiveMedium
148Filexxxxxxxx-xxxxxx_xxxxx.xxxpredictiveHigh
149Filexxxx.xxxpredictiveMedium
150Filexxxx_xxxxxxx_xxxxxxxx.xxxpredictiveHigh
151Filexxxxxxxx.xxx/xxxxxx.xxx/xxxxxxxx.xxxpredictiveHigh
152Filexxxxxxxxxxx.xxxpredictiveHigh
153Filexxx/xxx/xxxxxxx/xxxx.xxxpredictiveHigh
154Filexxxxx_xxxxx.xxxpredictiveHigh
155Filexxxx-xxxxx.xxxpredictiveHigh
156Filexxxx-xxxxxxxx.xxxpredictiveHigh
157Filexxxxx.xxpredictiveMedium
158Filexxxxx.xxxpredictiveMedium
159Filexxxxxx.xxxpredictiveMedium
160Filexxxx.xxxpredictiveMedium
161Filexxxxx-xxxxxxxx-xxxxx-xxxxxxxxxxx-xxx-xxxxx.xxxpredictiveHigh
162Filexxxxx.xxxxpredictiveMedium
163Filexxxx.xxxpredictiveMedium
164Filexxxxxxxxx.xxxxpredictiveHigh
165Filexxxxxxx/xxxxxxxxx/xxxxxxxxxxxx.xxxpredictiveHigh
166Filexxxxxxx.xxxpredictiveMedium
167Filexx-xxxxx/xxxxx.xxxpredictiveHigh
168Filexx.xxxpredictiveLow
169Filexxxxxxxxxxxx.xxxpredictiveHigh
170File~/xxxxx-xxxxx.xxxpredictiveHigh
171File~/xxxxxxxx-xxxxxxxx.xxxpredictiveHigh
172Libraryxxxxxx[xxxxxx_xxxxpredictiveHigh
173Libraryxxxxxx.xxxxxxxxx.xxxxxxx.xxxxx_xxxxx.xxxpredictiveHigh
174Libraryxxxx/xxxxxxx/xxxx/xxxxxxxxx/xxxxx.xxxpredictiveHigh
175Library~/xxx/xxxxx-xxxxxxxx-xxxxxxxxxx.xxxpredictiveHigh
176Argument$_xxxxxxpredictiveMedium
177Argumentxxx_xxxxpredictiveMedium
178Argumentxx_xxpredictiveLow
179ArgumentxxxxxxpredictiveLow
180ArgumentxxpredictiveLow
181Argumentxxx_xxpredictiveLow
182ArgumentxxpredictiveLow
183ArgumentxxpredictiveLow
184ArgumentxxxxxxxxpredictiveMedium
185ArgumentxxxxxxxxpredictiveMedium
186ArgumentxxxxxpredictiveLow
187ArgumentxxxxpredictiveLow
188Argumentxxxx_xxx_xxxxpredictiveHigh
189ArgumentxxxpredictiveLow
190ArgumentxxxxxxxxpredictiveMedium
191ArgumentxxxxxxxxxxpredictiveMedium
192Argumentxxxxxxxx_xxxxpredictiveHigh
193Argumentxxx_xxpredictiveLow
194Argumentxx_xxxxxxpredictiveMedium
195ArgumentxxxxpredictiveLow
196Argumentxxxx_xxpredictiveLow
197ArgumentxxxxxxxpredictiveLow
198ArgumentxxxxxxxxxxpredictiveMedium
199Argumentxxxxxx[xxxxxx_xxxx]predictiveHigh
200Argumentxxxx_xxpredictiveLow
201ArgumentxxxxxxxxxxxxpredictiveMedium
202ArgumentxxxpredictiveLow
203ArgumentxxxxxxxxpredictiveMedium
204ArgumentxxxxxpredictiveLow
205ArgumentxxxxpredictiveLow
206Argumentxxxxx_xxxx_xxxxpredictiveHigh
207Argumentxxxxxxx=xxxxxxxxpredictiveHigh
208ArgumentxxxxpredictiveLow
209ArgumentxxxxxxxpredictiveLow
210Argumentxxxxxxx_xxxxxxxpredictiveHigh
211Argumentxxxxxxxxxxxxxx[xxxxxxxxxxxxxxxxxx]predictiveHigh
212ArgumentxxxxxxxxpredictiveMedium
213ArgumentxxxxpredictiveLow
214ArgumentxxpredictiveLow
215Argumentxx/xx_xxxxxx_xxxx/xx_xxxx_xxxxxxpredictiveHigh
216ArgumentxxxxxxxxxpredictiveMedium
217Argumentxx_xxxxxpredictiveMedium
218ArgumentxxxxxpredictiveLow
219Argumentxxxxx_xxxxpredictiveMedium
220ArgumentxxxxxxpredictiveLow
221Argumentxxxx_xxpredictiveLow
222ArgumentxxxxpredictiveLow
223Argumentxxxxxxxx_xxxpredictiveMedium
224Argumentxxx_xxxpredictiveLow
225ArgumentxxxxxxxpredictiveLow
226ArgumentxxxpredictiveLow
227ArgumentxxxxpredictiveLow
228ArgumentxxxxxxxpredictiveLow
229Argumentxxx_xxxx_xxxxpredictiveHigh
230ArgumentxxxxxxxxxxpredictiveMedium
231ArgumentxxxpredictiveLow
232Argumentxx_xxxxpredictiveLow
233Argumentxxx/xxxxxxxxxpredictiveHigh
234Argumentxxxxxxxxx_xxxxxxxx_xxxxpredictiveHigh
235ArgumentxxxxxpredictiveLow
236Argumentxxxxxxx_xxxxpredictiveMedium
237ArgumentxxxxpredictiveLow
238Argumentxxxx/xxxxxxxx/xxx/xxx/xxxxxxxx/xxxxxxxpredictiveHigh
239Argumentxxxxxxx_xxpredictiveMedium
240Argumentxxxxxx xxxxxxpredictiveHigh
241ArgumentxxxxxxxxxxxxpredictiveMedium
242ArgumentxxxxpredictiveLow
243Argumentxxx_xxx[]predictiveMedium
244ArgumentxxxxxxxxpredictiveMedium
245Argumentxxxx_xx_xx_xxxpredictiveHigh
246ArgumentxxxxxxxpredictiveLow
247ArgumentxxxxxxxxxxxxxpredictiveHigh
248ArgumentxxxxxxxxxpredictiveMedium
249Argumentxxxxx_xxxx_xxxxpredictiveHigh
250ArgumentxxxxxpredictiveLow
251ArgumentxxxxpredictiveLow
252Argumentxx_xxxxpredictiveLow
253Argumentxx_xxxxpredictiveLow
254ArgumentxxxxxxpredictiveLow
255ArgumentxxxxxpredictiveLow
256ArgumentxxxxxxxxpredictiveMedium
257ArgumentxxxxxxxxxxpredictiveMedium
258ArgumentxxxxxpredictiveLow
259Argumentxxxxxxx_xxpredictiveMedium
260ArgumentxxxxxxxxxxpredictiveMedium
261Argumentxxxxxx_xxxxxxx_xxxxxxxxx_xxxx/xxxxxx_xxxxxxx_xxxxxxx_xxxxpredictiveHigh
262ArgumentxxxpredictiveLow
263ArgumentxxxxxxpredictiveLow
264ArgumentxxxpredictiveLow
265Argumentxxxxxx_xxxpredictiveMedium
266Argumentxxxx_xxxxpredictiveMedium
267ArgumentxxxxxxxpredictiveLow
268Argumentxxxxxx_xxpredictiveMedium
269Argumentxxxxxxx_xxpredictiveMedium
270ArgumentxxxxxxpredictiveLow
271Argumentxx_xxxxx_xxxx_xxxxpredictiveHigh
272ArgumentxxpredictiveLow
273ArgumentxxxxxxxxxpredictiveMedium
274ArgumentxxxxxxxpredictiveLow
275ArgumentxxxxxxxxxxpredictiveMedium
276Argumentx_xxpredictiveLow
277ArgumentxxxxxpredictiveLow
278Argumentxxxxxxxxxx_xxpredictiveHigh
279ArgumentxxxxxxxxxxxpredictiveMedium
280ArgumentxxxxpredictiveLow
281Argumentxxxx_xxpredictiveLow
282ArgumentxxxpredictiveLow
283ArgumentxxxpredictiveLow
284Argumentxxxx.xxxxxpredictiveMedium
285Argumentxxxxxxxx:x_xxxx/xxxxxxxx:x_xxxx/xxxxxxxx:x_xxxxpredictiveHigh
286ArgumentxxxxxxpredictiveLow
287ArgumentxxxxxxxxpredictiveMedium
288Argumentxxxx_xxpredictiveLow
289Argumentxx_xxxxpredictiveLow
290Input Value' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)-- xxxxpredictiveHigh
291Input Value..predictiveLow
292Input ValuexxpredictiveLow
293Input Valuex%xxxxxxx%xxxxxxxx%xxx,xxxxxx_xx%xxxxxx,xx_xxxxxxx,xxxxxxxx%xx,x,x,x,x,x,x,x,xx,xx,xx,xx,xx,xx,xx,xx,xx%xxxxxx%xxxxxxxxxx%xxxxxxx%xxxx%xxxpredictiveHigh
294Input Value<xxx%xxxxx='xxxx://xxx.xxxx.xx/xxxx.xxx'%xxxxxxx='xxxxxx:%xxxxx%xxxxxxx%xxxxxxx;'>predictiveHigh
295Input Value\xxx../../../../xxx/xxxxxxpredictiveHigh
296Patternxxxxxxx-xxxx|xx| xxxx/xxxxpredictiveHigh
297Patternxxxx /xpredictiveLow

References (6)

The following list contains external sources which discuss the actor and the associated activities:

Do you need the next level of professionalism?

Upgrade your account now!