PupyRAT Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (39)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	24
zh	16

Country

cn	26
us	10
gb	2
kr	2

Actors

PupyRAT	2
Magic Hound	1
APT-C-01	1
Mirai_ptea	1
Cobalt Strike	1

Activities

Interest

Timeline

Type

Not Defined	10
Application Server Software	6
Web Server	4
Operating System	4
Log Management Software	2

Vendor

Not Defined	12
Google	4
Cisco	4
Microsoft	4
Openfind	2

Product

Microsoft Windows	4
LiquidFiles	2
Splunk	2
Openfind Mail2000	2
Zope AccessControl	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Genivia gSOAP XML Document soap_get integer overflow	6.8	6.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.22576	0.05	CVE-2017-9765
2	Google Android PAC File scanner.cc NewCapacity out-of-bounds write	7.5	7.2	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00053	0.00	CVE-2021-0393
3	Zope Module path traversal	5.0	4.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00846	0.00	CVE-2021-32633
4	RabbitMQ rabbitmq_federation_management Plugin cross site scripting	2.0	1.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00096	0.00	CVE-2021-32719
5	Fortinet FortiWeb HTTP Request stack-based overflow	9.8	9.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00160	0.00	CVE-2021-42756
6	jsonwebtoken risky encryption	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00062	0.02	CVE-2022-23539
7	Oracle Application Server sql injection	9.8	8.8	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.05914	0.00	CVE-2006-3710
8	RoundCube E-Mail Message cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00319	0.04	CVE-2021-46144
9	Microsoft Windows TCP/IP Remote Code Execution	9.8	8.9	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.27975	0.00	CVE-2022-34718
10	Xampp Installation default permission	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00125	0.00	CVE-2022-29376
11	Jersey File.createTempFile temp file	4.4	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.02	CVE-2021-28168
12	Minio Console Operator Console missing authentication	8.6	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05383	0.02	CVE-2021-41266
13	Google Chrome Installer Privilege Escalation	5.5	5.3	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00133	0.02	CVE-2022-0799
14	nginx request smuggling	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	2.87	CVE-2020-12440
15	LiquidFiles cross site scripting	4.8	4.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00112	0.00	CVE-2020-29072
16	Raspberry Pi OS hard-coded password	8.8	8.6	$0-$5k	$0-$5k	Not Defined	Workaround	0.04287	0.04	CVE-2021-38759
17	Google Android xt_qtaguid.c get_sock_stat out-of-bounds	4.4	4.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2021-0695
18	Google Android f_accessory.c acc_read memory corruption	7.0	6.9	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00042	0.00	CVE-2021-0936
19	Apache HTTP Server Request apr_brigade_flatten input validation	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.07178	0.00	CVE-2015-3183
20	WordPress wp-register.php cross site scripting	4.3	4.2	$5k-$25k	$0-$5k	High	Unavailable	0.00533	0.04	CVE-2007-5106

Campaigns (1)

These are the campaigns that can be associated with the actor:

PupyRAT

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	45.32.8.143	45.32.8.143.vultrusercontent.com	PupyRAT		04/18/2024	verified	High
2	XX.XX.XX.XXX	xx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx		04/18/2024	verified	High
3	XX.XX.XXX.XX	xx.xx.xxx.xx.xxxxx.xxx	Xxxxx Xxxxx	Xxxxxxx	12/17/2020	verified	Medium
4	XX.XXX.XX.XX		Xxxxx Xxxxx	Xxxxxxx	12/17/2020	verified	High
5	XXX.XX.XX.XXX		Xxxxx Xxxxx	Xxxxxxx	12/17/2020	verified	High

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-22	Path Traversal	predictive	High
2	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
3	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX.XXX	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	High
5	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
6	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
7	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (15)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	burl.c	predictive	Low
2	File	f_accessory.c	predictive	High
3	File	lib/curl_sasl.c	predictive	High
4	File	xxxxxxxxxxx.xx	predictive	High
5	File	xxxxxxxx/xxxx?xxxxxx=xx	predictive	High
6	File	xxx/xxxxxxx/xxxxxxx/xxxxxxx.xxxx	predictive	High
7	File	xxxxxxx.xx	predictive	Medium
8	File	xxx-xxx	predictive	Low
9	File	xx-xxxxxxxx.xxx	predictive	High
10	File	xx_xxxxxxx.x	predictive	Medium
11	Argument	xxx	predictive	Low
12	Argument	xxxxxxxx	predictive	Medium
13	Argument	xxxx_xxxxx	predictive	Medium
14	Input Value	/%xx	predictive	Low
15	Network Port	xxx/xxxx	predictive	Medium

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!