SombRAT Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (15)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

es	12
fr	2
en	2

Country

cl	12
fr	2
cn	2

Actors

SombRAT	3

Activities

Interest

Timeline

Type

Operating System	4
Network Management Software	2
WordPress Plugin	2
Web Server	2
Packet Analyzer Software	2

Vendor

Not Defined	6
Microsoft	4
HP	2
WSO2	2

Product

Microsoft Windows	4
HP System Management Homepage	2
Yoast SEO Plugin	2
lighttpd	2
Wireshark	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Oracle PeopleSoft Enterprise PeopleTools Integration Broker access control	6.5	5.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00799	0.05	CVE-2017-3548
2	Microsoft Windows win32k.sys xxxMenuWindowProc denial of service	5.5	5.0	$5k-$25k	$0-$5k	Proof-of-Concept	Unavailable	0.00000	0.03
3	WSO2 API Manager File Upload unrestricted upload	9.8	9.8	$0-$5k	$0-$5k	High	Not Defined	0.97311	0.04	CVE-2022-29464
4	Wireshark DNP Dissector denial of service	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00242	0.00	CVE-2021-22235
5	Siemens SICAM PAS/SICAM PQS uncontrolled search path	8.3	8.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00047	0.01	CVE-2022-43722
6	Microsoft Windows TCP/IP Remote Code Execution	9.8	8.9	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.23993	0.00	CVE-2022-34718
7	Microsoft Windows Common Log File System Driver Privilege Escalation	8.1	7.7	$25k-$100k	$5k-$25k	High	Official Fix	0.00125	0.00	CVE-2022-37969
8	Yoast SEO Plugin REST Endpoint posts information disclosure	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00123	0.04	CVE-2021-25118
9	TrackR Bravo App Cloud API Authentication Password credentials management	6.0	5.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00132	0.00	CVE-2016-6538
10	HP Integrated Lights-Out IPMI Protocol credentials management	8.2	8.0	$5k-$25k	$0-$5k	High	Workaround	0.27196	0.00	CVE-2013-4786
11	lighttpd Log File http_auth.c injection	7.5	7.1	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01123	0.00	CVE-2015-3200
12	HP System Management Homepage denial of service	5.0	4.8	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00289	0.00	CVE-2010-1034
13	HPE System Management Homepage privileges management	9.8	9.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01960	0.06	CVE-2016-1995
14	HPE System Management Homepage privileges management	7.7	7.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00066	0.00	CVE-2016-1996

IOC - Indicator of Compromise (23)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	19.134.94.227		SombRAT	03/03/2022	verified	High
2	22.58.50.80		SombRAT	03/03/2022	verified	High
3	30.24.7.206		SombRAT	03/03/2022	verified	High
4	51.89.50.152	ip152.ip-51-89-50.eu	SombRAT	03/03/2022	verified	High
5	57.219.0.1		SombRAT	03/03/2022	verified	High
6	XX.XXX.XX.XX		Xxxxxxx	03/03/2022	verified	High
7	XX.XX.XX.XX	x-xx-xx-xx-xx.xxxx.xx.xxxxxxx.xxx	Xxxxxxx	03/03/2022	verified	High
8	XX.XX.XXX.XX	xx.xxx.xx.xx.xxx.xxx.xxx	Xxxxxxx	03/03/2022	verified	High
9	XX.XXX.XXX.XX	xx-xxx-xxx-xx.xxxxxxx.xxx.xxxxxx.xxx	Xxxxxxx	03/03/2022	verified	High
10	XX.XXX.XX.XX		Xxxxxxx	03/03/2022	verified	High
11	XXX.XXX.XXX.XXX	xxxx-xxx-xxx-xxx.xxxxxxxxx.xx	Xxxxxxx	03/03/2022	verified	High
12	XXX.XX.XXX.XXX		Xxxxxxx	03/03/2022	verified	High
13	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx.xxx.xxxx.xx.xx	Xxxxxxx	03/03/2022	verified	High
14	XXX.XX.XX.XXX	xxxxxxx.xxxxxx.xxx	Xxxxxxx	03/03/2022	verified	High
15	XXX.XX.XXX.XXX		Xxxxxxx	03/03/2022	verified	High
16	XXX.XXX.XXX.XXX		Xxxxxxx	03/03/2022	verified	High
17	XXX.XXX.XX.XXX	xxx.xx.xxx.xxx.xxxxx.xxx.xxx.xxxxxx.xxx.xx	Xxxxxxx	03/03/2022	verified	High
18	XXX.XX.XX.XX		Xxxxxxx	03/03/2022	verified	High
19	XXX.XX.XXX.XXX		Xxxxxxx	03/03/2022	verified	High
20	XXX.XX.XX.XX		Xxxxxxx	03/03/2022	verified	High
21	XXX.XXX.XXX.XX		Xxxxxxx	03/03/2022	verified	High
22	XXX.XXX.XXX.XX		Xxxxxxx	03/03/2022	verified	High
23	XXX.XXX.XX.XX		Xxxxxxx	03/03/2022	verified	High

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
2	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX	CAPEC-38	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
6	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
7	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (3)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	http_auth.c	predictive	Medium
2	File	xx/xx/xxxxx	predictive	Medium
3	Library	xxxxxx.xxx	predictive	Medium

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!