Magento-analytics Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (67)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	54
zh	8
pl	2
es	2
de	2

Country

us	44
cn	22
gb	2

Actors

magento-analytics	8
Cobalt Strike	2
Emotet	2
DarkGate	1
Scattered Spider	1

Activities

Interest

Timeline

Type

Not Defined	18
Web Server	8
Virtualization Software	4
Programming Language Software	4
Network Management Software	2

Vendor

Not Defined	16
HP	4
Paessler	2
SUSE	2
ForLogic	2

Product

PHP	4
HP Print	2
HP Digital Sending	2
Paessler PRTG Network Monitor	2
SUSE Rancher	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.02016	0.00	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.57	CVE-2010-0966
3	Wireless IP Camera WIFICAM ini File access control	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00293	0.00	CVE-2017-8225
4	HP Color LaserJet Pro M280-M281 Multifunction Printer Embedded Web Server Reflected cross site scripting	5.2	5.2	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00058	0.03	CVE-2019-6323
5	HP DeskJet 3630 cross-site request forgery	6.2	6.2	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00053	0.00	CVE-2019-6319
6	HP Print/Digital Sending Link-Local Multicast Name Resolution buffer overflow	6.3	6.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00369	0.04	CVE-2021-3942
7	HP inkjet/LaserJet Pro/PageWide Pro Privilege Escalation	8.0	8.0	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00435	0.09	CVE-2022-28721
8	Oracle HTTP Server SSL Module out-of-bounds write	9.8	9.6	$100k and more	$5k-$25k	Not Defined	Official Fix	0.12015	0.00	CVE-2022-23943
9	Zoho ManageEngine Desktop Central ZIP Archive improper authentication	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00299	0.00	CVE-2021-44757
10	Zoho ManageEngine ServiceDesk Plus MSP web.xml path traversal	6.5	6.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01596	0.00	CVE-2022-32551
11	SUSE Rancher improper authorization	7.5	7.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00096	0.04	CVE-2022-31247
12	Rabbitmq Docker Image hard-coded password	9.8	9.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00661	0.03	CVE-2020-35196
13	JetBrains IntelliJ IDEA Privilege Escalation	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00221	0.04	CVE-2021-45977
14	Oracle Communications Policy Management CMP code injection	9.8	9.6	$25k-$100k	$5k-$25k	High	Official Fix	0.97483	0.04	CVE-2022-22965
15	Microsoft Windows Hyper-V Privilege Escalation	8.0	7.3	$100k and more	$5k-$25k	Unproven	Official Fix	0.00134	0.04	CVE-2022-24537
16	Watchguard Firebox/XTM Remote Code Execution	6.3	6.0	$0-$5k	$0-$5k	High	Official Fix	0.84170	0.06	CVE-2022-26318
17	node-ipc backdoor	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00582	0.04	CVE-2022-23812
18	Cisco ASA SSL VPN exceptional condition	6.2	6.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00109	0.02	CVE-2019-12677
19	Openfind Mail2000 Access Control privileges management	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00087	0.05	CVE-2020-12776
20	Oracle Graph Server and Client Packaging/install issues Remote Code Execution	8.3	8.1	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.01316	0.00	CVE-2021-2351

IOC - Indicator of Compromise (11)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	1.125.125.5		Magento-analytics	05/09/2019	verified	High
2	45.76.75.35	45.76.75.35.vultrusercontent.com	magento-analytics	08/10/2022	verified	High
3	89.32.251.136	maildc1526907690.mihandns.com	magento-analytics	02/11/2022	verified	High
4	XX.XXX.XXX.XXX		Xxxxxxx-xxxxxxxxx	02/11/2022	verified	High
5	XX.XXX.XXX.XX	xx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	High
6	XX.XXX.XXX.XX	xx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	High
7	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	High
8	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	High
9	XXX.XXX.X.XX	xxx.xxx.x.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	High
10	XXX.XXX.X.XXX	xxx.xxx.x.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	High
11	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	High

TTP - Tactics, Techniques, Procedures (12)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	High
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX.XXX	CAPEC-	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	High
6	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
7	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
8	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
9	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
10	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
11	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	High
12	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (23)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	//	predictive	Low
2	File	/interceptor/OutgoingChainInterceptor.java	predictive	High
3	File	/uncpath/	predictive	Medium
4	File	/xx-xxxxx/xxxxx-xxxx.xxx	predictive	High
5	File	xxxxxxxxx.x	predictive	Medium
6	File	xxxxxxx_xxx.xxx	predictive	High
7	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
8	File	xxxx.xxx	predictive	Medium
9	File	xxx/xxxxxx.xxx	predictive	High
10	File	xxxxx.xxx	predictive	Medium
11	File	xxxxx.xxxx	predictive	Medium
12	File	xxxxxxxxxx.xxx	predictive	High
13	File	xxxxxxxx.xxx	predictive	Medium
14	File	xxxxxx.xxx	predictive	Medium
15	File	xxxxxx/xxx.xxx	predictive	High
16	Argument	xxxx	predictive	Low
17	Argument	xxxxxxxx	predictive	Medium
18	Argument	xxxxxxxxx-xxxxxxx/xxxxxxxxx/xxxxxxxxxx	predictive	High
19	Argument	xxxxxx_xx	predictive	Medium
20	Argument	xxxxxxxx	predictive	Medium
21	Argument	xx	predictive	Low
22	Argument	xxxxxxxx	predictive	Medium
23	Argument	xxx	predictive	Low

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!