Packrat Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (85)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	56
pt	22
es	8

Country

br	50
es	10
us	4
cl	4

Actors

Packrat	4
Banjori	1

Activities

Interest

Timeline

Type

Not Defined	14
Smartphone Operating System	8
Web Browser	6
Operating System	6
Office Suite Software	6

Vendor

Not Defined	10
Google	8
Microsoft	8
Linux	4
Fortinet	2

Product

Google Android	8
Linux Kernel	4
Microsoft Office	4
Fortinet FortiMail	2
avahi	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Dropbear SSH input validation	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02911	0.06	CVE-2016-7406
2	OpenSSL Non-prime Moduli BN_mod_sqrt infinite loop	6.4	6.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01342	0.00	CVE-2022-0778
3	VMware ESXi Host Client Stored cross site scripting	5.2	4.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00076	0.00	CVE-2017-4940
4	HP Integrated Lights-Out IPMI Protocol credentials management	8.2	8.0	$5k-$25k	$0-$5k	High	Workaround	0.27196	0.04	CVE-2013-4786
5	Apache HTTP Server mod_reqtimeout resource management	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01696	0.04	CVE-2007-6750
6	Linux Kernel Socket Buffer virtio_bt.c memory leak	5.7	5.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00045	0.02	CVE-2022-26878
7	Microsoft Windows LSA information disclosure	6.4	6.0	$25k-$100k	$5k-$25k	High	Official Fix	0.81552	0.05	CVE-2021-36942
8	Dropbear SSH dbclient/server Memory information disclosure	4.4	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00042	0.04	CVE-2016-7409
9	Dropbear SSH dropbearconvert input validation	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00956	0.02	CVE-2016-7407
10	phpMyAdmin grab_globals.lib.php path traversal	4.8	4.4	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02334	0.11	CVE-2005-3299
11	Ietf MD5 cryptographic issues	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01224	0.00	CVE-2004-2761
12	Sun Solaris Authentication improper authentication	9.8	9.6	$5k-$25k	$0-$5k	High	Workaround	0.01297	0.00	CVE-1999-0502
13	TP-LINK TL-WR840N buffer overflow	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00092	0.00	CVE-2022-26642
14	HP Intelligent Management Center tftpserver.exe input validation	10.0	9.5	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.06153	0.00	CVE-2011-1853
15	Microsoft Windows SMB Processor EducatedScholar resource management	7.3	7.0	$5k-$25k	$0-$5k	High	Official Fix	0.97266	0.00	CVE-2009-3103
16	avahi socket.c resource management	5.3	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.07514	0.04	CVE-2011-1002
17	OpenSSL EC information disclosure	3.1	3.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00386	0.05	CVE-2021-4160
18	Linux Kernel KVM authorization	7.6	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00056	0.03	CVE-2021-3653
19	Fortinet FortiMail path traversal	6.4	6.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00093	0.00	CVE-2021-24013
20	Fortinet FortiMail Identity-Based Encryption Service missing encryption	4.0	3.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00060	0.00	CVE-2021-26099

IOC - Indicator of Compromise (9)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	46.246.89.246	joana.homework.space	Packrat	12/24/2020	verified	High
2	50.62.133.49	ip-50-62-133-49.ip.secureserver.net	Packrat	12/24/2020	verified	High
3	XXX.XXX.X.XX	xxxxxxxx.xxxxxx.xxx.xx	Xxxxxxx	12/24/2020	verified	High
4	XXX.XXX.XX.XX	xxxxxxxx.xxxxxx.xxx.xx	Xxxxxxx	12/24/2020	verified	High
5	XXX.XXX.XXX.XXX	xxxxxxxx.xxxxxx.xxx.xx	Xxxxxxx	12/24/2020	verified	High
6	XXX.XX.XXX.XXX	xxx-xx-xxx-xxx.xxx.xxxxxxxx.xx	Xxxxxxx	12/24/2020	verified	High
7	XXX.XXX.XXX.XXX	xxxxxxxx-xxxxxx-xxx-xxx-xxx.xxxxxxxxxxxxx.xxx	Xxxxxxx	12/24/2020	verified	High
8	XXX.XXX.XXX.XX	xx-xxx-xxx-xxx-xx.xx.xxxxxxxxxxxx.xxx	Xxxxxxx	12/24/2020	verified	High
9	XXX.XX.XXX.XXX	xx-xxx-xx-xxx-xxx.xx.xxxxxxxxxxxx.xxx	Xxxxxxx	12/24/2020	verified	High

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-19	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
7	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
8	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
9	TXXXX	CAPEC-157	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (20)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	api/sms_check.php	predictive	High
2	File	avahi-core/socket.c	predictive	High
3	File	chmextract.c	predictive	Medium
4	File	xxxxxxx/xxxxxxxxx/xxxxxx_xx.x	predictive	High
5	File	xxxx_xxxxxxx.xxx.xxx	predictive	High
6	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	High
7	File	xxxxx.xxx	predictive	Medium
8	File	xxxxxx_xxx.x	predictive	Medium
9	File	xxxxx-xxx.x	predictive	Medium
10	File	xxxxxxxxxx.xxx	predictive	High
11	Library	xxxxxxxx.xxx	predictive	Medium
12	Argument	-x	predictive	Low
13	Argument	xxxx	predictive	Low
14	Argument	xxx_xxx	predictive	Low
15	Argument	xxxxx	predictive	Low
16	Argument	xxxxxxxx	predictive	Medium
17	Argument	xxxxxxxx	predictive	Medium
18	Argument	xxxx	predictive	Low
19	Argument	xxxxxxxx/xxxx	predictive	High
20	Argument	x_xx_xxxxxxxxxxxxxxxx	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!