Manjusaka Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (60)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	36
zh	22
it	2

Country

cn	42
us	10
ru	6

Actors

Manjusaka	5
Mirai	2
Cobalt Strike	1
Responder	1
GuLoader	1

Activities

Interest

Timeline

Type

Not Defined	22
Web Server	8
Cloud Software	4
File Transfer Software	2
Virtualization Software	2

Vendor

Not Defined	16
Dahua	6
VMware	4
Red Hat	4
Totolink	2

Product

VMware Spring Framework	2
Totolink X2000R	2
SourceCodester Simple Subscription Website	2
vsftpd	2
Dahua IPC-HX3XXX	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	vsftpd deny_file unknown vulnerability	3.7	3.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00312	0.15	CVE-2015-1419
2	Oracle Storage Cloud Software Appliance Management Console Remote Code Execution	10.0	9.5	$100k and more	$5k-$25k	Not Defined	Official Fix	0.00576	0.00	CVE-2021-2256
3	VMware Spring Framework neutralization for logs	4.5	4.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00079	0.00	CVE-2021-22096
4	nginx ngx_http_mp4_module information disclosure	5.9	5.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00198	0.05	CVE-2018-16845
5	Python libraries privileges management	6.5	6.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
6	GilaCMS GET Parameter cm.php sql injection	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00223	0.00	CVE-2020-20692
7	SourceCodester Simple Subscription Website manage_plan.php sql injection	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.04	CVE-2024-3015
8	Chengdu VEC40G Network Detection os command injection	5.5	5.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00086	0.05	CVE-2023-2522
9	code-projects Bus Dispatch and Information System view_admin.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00070	0.00	CVE-2023-2773
10	frioux ptome sql injection	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00148	0.15	CVE-2010-10009
11	Totolink X2000R HTTP POST Request boa formTmultiAP buffer overflow	8.1	7.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00079	0.04	CVE-2023-7222
12	SAP GUI Connector for Microsoft Edge unknown vulnerability	6.4	6.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00087	0.04	CVE-2024-22125
13	Cool Plugins Events Shortcodes for the Events Calendar Plugin sql injection	7.0	7.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00050	0.05	CVE-2023-52142
14	Acumos Design Studio cross site scripting	4.4	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00052	0.04	CVE-2018-25097
15	Google Android ion.c ion_ioctl use after free	5.3	5.1	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00042	0.00	CVE-2022-20118
16	Qualcomm Snapdragon Compute XPU Re-Configuration access control	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00044	0.04	CVE-2021-30276
17	Epic Games Psyonix Rocket League UPK Object stack-based overflow	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00300	0.00	CVE-2021-32238
18	Microsoft Windows IIS memory corruption	7.9	7.6	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00182	0.03	CVE-2019-1365
19	MailEnable Enterprise Premium path traversal	7.2	7.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00061	0.02	CVE-2019-12925
20	Microsoft ISA Server H.323/H.225.0/Q.931 memory corruption	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.31188	0.04	CVE-2003-0819

IOC - Indicator of Compromise (6)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	39.104.90.45		Manjusaka	08/02/2022	verified	High
2	45.137.117.219		Manjusaka	03/19/2024	verified	High
3	XX.XXX.XXX.XXX	xxxx-xx-xxx-xxx-xxx.xxxxxx.xxxx.xxxxxxx.xxx	Xxxxxxxxx	03/19/2024	verified	High
4	XX.XXX.XXX.XX	xxxxxx.xxxxxxx.xxxx	Xxxxxxxxx	03/19/2024	verified	High
5	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxx.xxx	Xxxxxxxxx	03/19/2024	verified	High
6	XXX.XX.XXX.XXX		Xxxxxxxxx	03/19/2024	verified	High

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	TXXXX	CAPEC-242	CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	High
4	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX	CAPEC-108	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
9	TXXXX	CAPEC-50	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
10	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (22)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/bin/boa	predictive	Medium
2	File	/send_order.cgi?parameter=access_detect	predictive	High
3	File	/src/core/controllers/cm.php	predictive	High
4	File	/xxx/xxx/xxxxxx	predictive	High
5	File	/xxxxxx	predictive	Low
6	File	xxxxx.xxx	predictive	Medium
7	File	xxx.x	predictive	Low
8	File	xxxxxx_xxxx.xxx	predictive	High
9	File	xxxx_xxxxx.xxx	predictive	High
10	File	xx-xxxxx.xxx	predictive	Medium
11	Library	/xxx/xxx/xxx/xxxx/xxxxxxxxxx/xxxxxxxxx.xxx	predictive	High
12	Library	xxxxxxxxx	predictive	Medium
13	Argument	xxxxxxx	predictive	Low
14	Argument	xxxxx	predictive	Low
15	Argument	xx	predictive	Low
16	Argument	xx	predictive	Low
17	Argument	xxxxx	predictive	Low
18	Argument	xxxxxx-xxx	predictive	Medium
19	Argument	xxxxx	predictive	Low
20	Input Value	x \| xxxxxxx -xx	predictive	High
21	Input Value	===	predictive	Low
22	Network Port	xxx/xxx	predictive	Low

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!