SharpPanda Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (140)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	106
zh	26
it	4
jp	4

Country

us	82
cn	26
sg	26
jp	4
id	2

Actors

SharpPanda	11
Cobalt Strike	5
Mustang Panda	1
Stately Taurus	1
Meterpreter	1

Activities

Interest

Timeline

Type

Not Defined	36
Firewall Software	8
Database Software	8
Programming Language Software	6
Content Management System	6

Vendor

Not Defined	32
Oracle	10
Citrix	8
Palo Alto	6
Microsoft	4

Product

Oracle MySQL Server	6
Palo Alto PAN-OS	6
PHP	4
MantisBT	4
SeaCMS	4

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.02016	0.00	CVE-2007-1192
2	vu Mass Mailer Login Page redir.asp sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00238	0.04	CVE-2007-6138
3	PHP phpinfo cross site scripting	6.3	5.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.08985	0.05	CVE-2006-0996
4	vBulletin redirector.php	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00106	0.05	CVE-2018-6200
5	Cisco ASA Version information disclosure	5.3	4.6	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00288	0.04	CVE-2014-3398
6	Apache HTTP Server mod_ssl ap_hook_process_connection null pointer dereference	7.5	7.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01166	0.04	CVE-2017-3169
7	PHP phpinfo cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.01960	0.07	CVE-2007-1287
8	Serendipity exit.php privileges management	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.31
9	WoltLab Burning Book addentry.php sql injection	7.3	6.8	$0-$5k	$0-$5k	Functional	Unavailable	0.00804	0.00	CVE-2006-5509
10	Linux Foundation Xen EFLAGS Register SYSENTER input validation	6.2	5.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00062	0.02	CVE-2013-1917
11	AXIS 2110 Network Camera editcgi.cgi path traversal	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01492	0.00	CVE-2004-2426
12	Synology DiskStation Manager SliceUpload imageSelector.cgi access control	6.5	6.2	$0-$5k	$0-$5k	High	Official Fix	0.97296	0.04	CVE-2013-6955
13	Hestia Control Panel Domain Name Privilege Escalation	5.9	5.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00139	0.00	CVE-2021-27231
14	Bitrix Site Manager redirect.php link following	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00113	0.04	CVE-2008-2052
15	PHP Link Directory Administration Page index.html cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00374	0.14	CVE-2007-0529
16	Moodle server-side request forgery	6.5	6.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00060	0.04	CVE-2023-35133
17	Extreme Networks ExtremeWireless Aerohive HiveOS/IQ Engine NetConfig UI Administrative Interface code injection	8.8	8.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.85139	0.02	CVE-2020-16152
18	Advance B2B Script tradeshow-list-detail.php sql injection	8.5	8.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00242	0.00	CVE-2017-17602
19	Asus NAS-M25 Cookie os command injection	9.8	9.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.91647	0.04	CVE-2022-4221
20	Apache Log4j Socket Server deserialization	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.87384	0.02	CVE-2017-5645

Campaigns (1)

These are the campaigns that can be associated with the actor:

G20 Nations

IOC - Indicator of Compromise (14)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	13.236.189.80	ec2-13-236-189-80.ap-southeast-2.compute.amazonaws.com	SharpPanda	G20 Nations	06/02/2023	verified	Medium
2	45.76.190.210	45.76.190.210.vultrusercontent.com	SharpPanda		03/10/2023	verified	High
3	45.91.225.139		SharpPanda		02/10/2022	verified	High
4	XX.XXX.XXX.XX	xxxxxxx-xxxxxxxx.xxxxxxxx.xxx	Xxxxxxxxxx		02/10/2022	verified	High
5	XX.XXX.XXX.XX		Xxxxxxxxxx		03/10/2023	verified	High
6	XX.XXX.XXX.XX		Xxxxxxxxxx		03/10/2023	verified	High
7	XXX.XX.XXX.XX		Xxxxxxxxxx		03/10/2023	verified	High
8	XXX.XXX.XXX.XX		Xxxxxxxxxx		03/10/2023	verified	High
9	XXX.XXX.XXX.XXX		Xxxxxxxxxx		03/10/2023	verified	High
10	XXX.XXX.XXX.XX		Xxxxxxxxxx		03/10/2023	verified	High
11	XXX.XXX.XXX.XXX	xxxxx.xxxxxxx.xxx	Xxxxxxxxxx		02/10/2022	verified	High
12	XXX.XXX.XXX.XX	xxx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx		03/10/2023	verified	High
13	XXX.XXX.XXX.XX	xxx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx		03/10/2023	verified	High
14	XXX.XX.XXX.XX		Xxxxxxxxxx		03/10/2023	verified	High

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22, CWE-23	Path Traversal	predictive	High
2	T1040	CAPEC-102	CWE-294	Authentication Bypass by Capture-replay	predictive	High
3	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
4	TXXXX	CAPEC-137	CWE-XX, CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	High
5	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
6	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
7	TXXXX.XXX	CAPEC-	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	High
8	TXXXX	CAPEC-150	CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	predictive	High
9	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
10	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
11	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
12	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
13	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
14	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
15	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (60)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/cgi-bin/system_mgr.cgi	predictive	High
2	File	/data/config.ftp.php	predictive	High
3	File	/forum/away.php	predictive	High
4	File	/modules/profile/index.php	predictive	High
5	File	/out.php	predictive	Medium
6	File	/tmp	predictive	Low
7	File	/uncpath/	predictive	Medium
8	File	xxxxxxx.xxx	predictive	Medium
9	File	xxxxxxxx.xxx	predictive	Medium
10	File	xxxxx_xxxxx.xxx	predictive	High
11	File	xxxx-xxxxxxx.x	predictive	High
12	File	xxxxxxxxxxxx.xxx/xxxxxxxxxxx.xxx/xxxxxxxxxxx.xxx/xxxxxxxxxxx.xxx	predictive	High
13	File	xxx-xxx/xxxxxx.xxx	predictive	High
14	File	xxxxxxx.xxx	predictive	Medium
15	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
16	File	xxxxxxx.xxxxx.xxx	predictive	High
17	File	xxxxxxx.xxx	predictive	Medium
18	File	xxxx.xxx	predictive	Medium
19	File	xxx_xxxx.x	predictive	Medium
20	File	xxxx.xxx	predictive	Medium
21	File	xxxx_xxxxx.x	predictive	Medium
22	File	xxx/xxxxxx.xxx	predictive	High
23	File	xxxxx.xxxx	predictive	Medium
24	File	xxxxx.xxx	predictive	Medium
25	File	xxx-xxx.xxxx.xx	predictive	High
26	File	xxxxx.xxx	predictive	Medium
27	File	xxxxxxxx.xxx	predictive	Medium
28	File	xxxxxxxxxx.xxx	predictive	High
29	File	xxxxxxxxx-xxxx-xxxxxx.xxx	predictive	High
30	File	xxx.xxx	predictive	Low
31	File	xxxxxx/xxxxxxxxxxxxx.xxx	predictive	High
32	Library	xxxxxxxx.xxx	predictive	Medium
33	Library	xxxxxxxx/xxxxxxx/xxxxx/xxx.xxx	predictive	High
34	Library	xxxxxxxxxxx.xxx	predictive	High
35	Argument	--xxxxxx/--xxxxxxxx	predictive	High
36	Argument	xxxxxx	predictive	Low
37	Argument	xxxxxx/xxxx/xxxx/xxxxx/xxxxxx/x_xxxxxxx/x_xxxxxxxx/x_xxxxxxx/x_xxxxx	predictive	High
38	Argument	xxxxxx/xxxxxxxx/xxxxxxxxxxxxxx	predictive	High
39	Argument	xxxxxxxxxxx	predictive	Medium
40	Argument	xxx_xxxxx_xxxx	predictive	High
41	Argument	xxxxxxxx	predictive	Medium
42	Argument	xxxxxxx	predictive	Low
43	Argument	xxxxxx	predictive	Low
44	Argument	xxxx	predictive	Low
45	Argument	xxxx	predictive	Low
46	Argument	xxxxxxxx	predictive	Medium
47	Argument	xx	predictive	Low
48	Argument	xx	predictive	Low
49	Argument	xxxxxx	predictive	Low
50	Argument	xxxxxxxx	predictive	Medium
51	Argument	xxxx	predictive	Low
52	Argument	xxxxxxx	predictive	Low
53	Argument	xxxx_xx	predictive	Low
54	Argument	xxx	predictive	Low
55	Argument	xxx	predictive	Low
56	Argument	xxxxxxxx	predictive	Medium
57	Argument	xxxxxxxx/xxxxxxxx	predictive	High
58	Input Value	../	predictive	Low
59	Input Value	x' xx x=x--	predictive	Medium
60	Network Port	xxx xxxxxx xxxx	predictive	High

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!