Sality Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (40)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	32
de	4
it	2
ru	2

Country

us	14
ru	10
pt	6
de	4

Actors

Sality	2
SmokeLoader	1
StealthWorker	1
Cobalt Strike	1
RisePro	1

Activities

Interest

Timeline

Type

Content Management System	6
Not Defined	6
Operating System	4
Router Operating System	4
SSH Server Software	2

Vendor

Not Defined	12
Paramiko	2
Microsoft	2
Maianscriptworld	2
Google	2

Product

WordPress	4
Paramiko SSH Server	2
Microsoft Windows	2
phpRaid	2
Maianscriptworld Maian Recipe	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	WordPress wp-trackback.php mb_convert_encoding cryptographic issues	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03358	0.04	CVE-2009-3622
2	Dragon Path Bharti Airtel Routers Hardware BDT-121 Admin Page cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00053	0.00	CVE-2022-28507
3	YaPiG view.php cross site scripting	4.3	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01335	0.00	CVE-2005-1886
4	WordPress wp-register.php cross site scripting	4.3	4.2	$5k-$25k	$0-$5k	High	Unavailable	0.00322	0.00	CVE-2007-5105
5	MetInfo URL Redirector login.php redirect	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00107	0.00	CVE-2017-11718
6	phpRaid register.php privileges management	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
7	vu Mass Mailer Login Page redir.asp sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00238	0.14	CVE-2007-6138
8	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.79	CVE-2010-0966
9	Symantec Endpoint Protection Manager SAP XML Parser xml external entity reference	7.3	6.6	$5k-$25k	$0-$5k	High	Official Fix	0.83177	0.00	CVE-2013-5014
10	Mozilla Firefox/Thunderbird/Firefox ESR NPAPI Plugin cross-site request forgery	6.5	6.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00419	0.00	CVE-2019-11712
11	Linux Kernel oom_kill.c __oom_reap_task_mm use after free	4.7	4.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00062	0.03	CVE-2017-18202
12	Node.js HTTP Header resource consumption	6.4	6.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01647	0.00	CVE-2018-12121
13	TestLink Plugin summary.jelly cross site scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00054	0.00	CVE-2018-1000113
14	Microsoft Windows Windows Media Player information disclosure	2.5	2.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00184	0.03	CVE-2017-11768
15	W3C Jigsaw Host Header cross site scripting	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01034	0.00	CVE-2002-1053
16	Microsoft Windows Subsystem for Linux access control	6.4	5.8	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00213	0.00	CVE-2018-0743
17	Microsoft Windows DirectX information disclosure	5.1	4.9	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00043	0.00	CVE-2019-0837
18	WordPress wpdb->prepare sql injection	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00389	0.03	CVE-2017-16510
19	Microsoft Lync/Skype for Business Security Feature 7pk security	7.0	6.7	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00284	0.03	CVE-2018-8238
20	Iptanus File Upload Plugin Shortcode cross site scripting	6.0	5.4	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00185	0.00	CVE-2018-9172

IOC - Indicator of Compromise (31)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	5.101.0.44		Sality	04/12/2022	verified	High
2	20.53.203.50		Sality	08/01/2022	verified	High
3	20.72.235.82		Sality	08/01/2022	verified	High
4	20.81.111.85		Sality	08/01/2022	verified	High
5	20.84.181.62		Sality	08/01/2022	verified	High
6	20.103.85.33		Sality	08/01/2022	verified	High
7	20.109.209.108		Sality	08/01/2022	verified	High
8	XX.XXX.XX.XXX	xxx-xxx-xx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxxxxx	08/01/2022	verified	High
9	XX.XXX.XX.XXX	xxx-xxx-xx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxxxxx	08/01/2022	verified	High
10	XX.XXX.XXX.XX		Xxxxxx	04/08/2022	verified	High
11	XX.XX.XXX.XXX	xxxxxxxxxxx.xxxxxxx-xxxx.xxx.xxx	Xxxxxx	04/12/2022	verified	High
12	XX.XX.X.XX	xxxxxxx.x.xxxxxxxxx.xxx	Xxxxxx	04/12/2022	verified	High
13	XX.XXX.XXX.XX		Xxxxxx	04/08/2022	verified	High
14	XX.XX.XXX.XXX	xxxxxxxxx.xxxxxxxxxxx.xxx	Xxxxxx	04/08/2022	verified	High
15	XX.XXX.XXX.XXX		Xxxxxx	04/12/2022	verified	High
16	XX.XXX.XX.XXX	xx-xxx-xx-xxx-xxxxxx.xxxxxxx.xxx	Xxxxxx	10/29/2023	verified	High
17	XX.XXX.XXX.XX	xx-xxxxx.xx.xxxxxxxxxxxxx.xx	Xxxxxx	04/12/2022	verified	High
18	XX.XX.XXX.XXX	xx-xx-xxx-xxx.xxxxx.xxx.xx	Xxxxxx	04/12/2022	verified	High
19	XXX.XX.XX.XX	xxxxxxxxxxx.x.xxxxxxxxx.xxx	Xxxxxx	04/12/2022	verified	High
20	XXX.XXX.XXX.XXX	xx-xxx-xxx.xxxxx.xxx	Xxxxxx	04/12/2022	verified	High
21	XXX.XXX.XX.XXX	xx-xxx-xxx-xx-xxx.xx.xxxxxxxxxxxx.xxx	Xxxxxx	04/12/2022	verified	High
22	XXX.X.XXX.XXX		Xxxxxx	04/12/2022	verified	High
23	XXX.XXX.XX.XX	x.xx.xxxx.xxx.xxxxxx.xx-xxxxxxx.xxx	Xxxxxx	04/12/2022	verified	High
24	XXX.XX.XXX.X	xx-xxxxx.xxx.xx.xx	Xxxxxx	04/12/2022	verified	High
25	XXX.XX.XX.XXX		Xxxxxx	04/08/2022	verified	High
26	XXX.XX.XXX.XXX		Xxxxxx	04/08/2022	verified	High
27	XXX.XX.XXX.XXX		Xxxxxx	04/08/2022	verified	High
28	XXX.XXX.XX.XXX	xxxx-x.xxxxxxxxxxxx	Xxxxxx	04/08/2022	verified	High
29	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxx.xxxx-xxxx.xxx	Xxxxxx	04/08/2022	verified	High
30	XXX.XX.XX.XX	xxxx.xxxxxxx.xx	Xxxxxx	04/08/2022	verified	High
31	XXX.XX.XX.XXX	xxx.xxxxxxx.xx	Xxxxxx	04/12/2022	verified	High

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
2	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
5	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
7	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
8	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (35)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/getcfg.php	predictive	Medium
2	File	/settings/avatar	predictive	High
3	File	bin/icinga	predictive	Medium
4	File	inc/config.php	predictive	High
5	File	index.php	predictive	Medium
6	File	xxxxxx/xxxxx.xxx	predictive	High
7	File	xxxxxx.xx	predictive	Medium
8	File	xx/xxx_xxxx.x	predictive	High
9	File	xxx.xxx	predictive	Low
10	File	xxxxx.xxx	predictive	Medium
11	File	xxxxxxxx.xxx	predictive	Medium
12	File	xxxxxxxxxxxxxxxxxxx/xxxxxxx.xxxxx	predictive	High
13	File	xxxxxxxxx.xx	predictive	Medium
14	File	xxxx/xxxxxxxxxxxx.x	predictive	High
15	File	xxxx.xxx	predictive	Medium
16	File	xx-xxxxxxxx.xxx	predictive	High
17	File	xx-xxxxxxxxx.xxx	predictive	High
18	Argument	xxxxxxxx	predictive	Medium
19	Argument	xxxxxxxxx	predictive	Medium
20	Argument	xxxxxxx	predictive	Low
21	Argument	xxxxxxxxxxx	predictive	Medium
22	Argument	xxxxx	predictive	Low
23	Argument	xx	predictive	Low
24	Argument	xxxxxx	predictive	Low
25	Argument	xxxxxxxx	predictive	Medium
26	Argument	xxxx	predictive	Low
27	Argument	xxxxxxx_xxx	predictive	Medium
28	Argument	xxxxxxxx	predictive	Medium
29	Argument	xxxxxxxxxxxxx	predictive	High
30	Argument	xxxx_xxxxx	predictive	Medium
31	Argument	_xxxxxxx	predictive	Medium
32	Input Value	xxxx -x xxxxxxxx=xxxxxx.xxxxxxx xxxx://xxx.xxx.x.x/xxxxxx.xxx	predictive	High
33	Pattern	\|xx\|xx\|xx\|	predictive	Medium
34	Network Port	xxx/xxxx (xxxx) / xxx/xxxx (xxxxx)	predictive	High
35	Network Port	xxx xxxxxx xxxx	predictive	High

References (6)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!