JAFF Analysis

IOB - Indicator of Behavior (464)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en386
ru42
de12
es8
zh6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

ru176
us172
lv40
be12
cn8

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Linux Kernel12
PHP10
Microsoft Windows8
Apache HTTP Server6
Microsoft Word6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1Void Contact Form 7 Widget for Elementor Page Builder Plugin void_cf7_opt_in_user_data_track cross-site request forgery4.34.2$0-$5k$0-$5kNot DefinedNot Defined0.000630.00CVE-2022-47166
2PHP Link Directory Administration Page index.html cross site scripting4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.003740.29CVE-2007-0529
3Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaround0.020160.00CVE-2007-1192
4MGB OpenSource Guestbook email.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.013020.96CVE-2007-0354
5LogicBoard CMS away.php redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable0.000002.62
6Esoftpro Online Guestbook Pro ogp_show.php sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.001080.18CVE-2009-4935
7phpMyAdmin phpinfo.php information disclosure5.35.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.001420.00CVE-2016-9848
8LushiWarPlaner register.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.007840.06CVE-2007-0864
9Flat PHP Board path traversal3.33.3$0-$5k$0-$5kNot DefinedNot Defined0.000000.05
10Simple PHP Guestbook guestbook.php cross site scripting3.53.5$0-$5k$0-$5kNot DefinedNot Defined0.000000.08
11212cafe 212cafeboard view.php sql injection7.37.1$0-$5k$0-$5kHighUnavailable0.000640.04CVE-2008-4713
12Tenda AC15/AC1900 setUsbUnload injection8.58.5$0-$5k$0-$5kHighNot Defined0.961830.04CVE-2020-10987
13FreeBSD Ping pr_pack stack-based overflow7.37.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.000430.00CVE-2022-23093
14Googlemaps Plugin plugin_googlemap2_proxy.php resource consumption6.46.1$0-$5k$0-$5kNot DefinedOfficial Fix0.006040.03CVE-2013-7428
15nginx SPDY memory corruption7.36.4$0-$5k$0-$5kUnprovenOfficial Fix0.037110.06CVE-2014-0133
16Apache Spark UI command injection7.17.0$5k-$25k$0-$5kHighOfficial Fix0.972080.08CVE-2022-33891
17HP Router/Switch SNMP information disclosure3.73.4$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.002850.05CVE-2012-3268
18Microsoft Outlook Email Message access control5.95.8$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.006090.02CVE-2017-0204
19PHP unserialize use after free7.36.4$25k-$100k$0-$5kUnprovenOfficial Fix0.000000.05
20Lars Ellingsen Guestserver guestbook.cgi cross site scripting4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.001690.07CVE-2005-4222

IOC - Indicator of Compromise (37)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
16.43.51.17Jaff02/01/2019verifiedHigh
227.254.44.204JAFF01/01/2018verifiedHigh
331.202.130.2031-202-130-20-kh.maxnet.uaJAFF01/01/2018verifiedHigh
437.59.41.180ns3002298.ip-37-59-41.euJAFF01/01/2018verifiedHigh
546.17.46.214JAFF01/01/2018verifiedHigh
646.173.219.234JAFF01/01/2018verifiedHigh
747.91.107.213JAFF01/01/2018verifiedHigh
877.73.67.163JAFF01/01/2018verifiedHigh
9XX.XXX.XX.XXXxx-xxx-xx-xxx.xxx-xxx.xxxxxxx.xxxxxxxx.xxXxxx01/01/2018verifiedHigh
10XX.XXX.XXX.XXXXxxx01/01/2018verifiedHigh
11XX.XXX.XXX.XXxxx-xxxxxxxxxxx.xxxxxxxx.xxx.xxXxxx01/01/2018verifiedHigh
12XX.XXX.XX.XXxxxxxxxxxxx.xxxxxx.xxxXxxx01/01/2018verifiedHigh
13XX.XXX.XX.XXXXxxx01/01/2018verifiedHigh
14XX.XXX.XXX.XXXxxx01/01/2018verifiedHigh
15XX.XXX.XXX.XXXXxxx01/01/2018verifiedHigh
16XX.XX.XXX.XXxxxxxxx.xxXxxx01/01/2018verifiedHigh
17XX.XXX.XX.XXxxxx.xxxxx.xxXxxx01/01/2018verifiedHigh
18XX.XXX.XXX.XXXxxx01/01/2018verifiedHigh
19XX.XXX.XX.XXxxxxxxx.xxxxxxxxxxx.xxxxxx.xxXxxx01/01/2018verifiedHigh
20XX.XXX.XX.XXxxxxxxxxx.xxxxxxxxxx.xxxXxxx01/01/2018verifiedHigh
21XX.XXX.XXX.XXxxxxxx-xx.xxxxxxx.xxxXxxx01/01/2018verifiedHigh
22XX.XXX.XXX.XXXXxxx01/01/2018verifiedHigh
23XXX.XXX.XX.XXXXxxx01/01/2018verifiedHigh
24XXX.XXX.XX.XXxxxx-xxx-xxx-xx-xx.xxxxxx-xx-xxxxxx.xxXxxx01/01/2018verifiedHigh
25XXX.XXX.XX.XXxxxxxxxx.xxxxxx-xx-xxxxxx.xxXxxx01/01/2018verifiedHigh
26XXX.X.XX.XXXxx.xxxxxxx.xxxXxxx01/01/2018verifiedHigh
27XXX.XX.XXX.XXXxxx.xxx-xxxxxx.xxXxxx01/01/2018verifiedHigh
28XXX.XXX.XXX.XXXXxxx01/01/2018verifiedHigh
29XXX.XXX.XXX.XXXXxxx01/01/2018verifiedHigh
30XXX.XXX.XX.XXXxxxx.xxxxxxxxxxxx.xxxXxxx01/01/2018verifiedHigh
31XXX.XXX.XXX.XXxxxxxxxx.xxxxxxxx.xxXxxx01/01/2018verifiedHigh
32XXX.XXX.XXX.XXXxxxx.xxxxxxxxxx.xxXxxx01/01/2018verifiedHigh
33XXX.XXX.XXX.XXxxxx.xxxxxxxxxxxxx.xxxxxXxxx01/01/2018verifiedHigh
34XXX.XXX.XXX.XXXxxx-xxxxxxxxx-xxxxx.xxxxx-xxxxxxxx.xxxXxxx01/01/2018verifiedHigh
35XXX.XXX.XXX.XXXXxxx01/01/2018verifiedHigh
36XXX.XX.XX.XXXxxx01/01/2018verifiedHigh
37XXX.XX.XXX.XXXxxx01/01/2018verifiedHigh

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (208)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File.htaccesspredictiveMedium
2File/admin/maintenance/view_designation.phppredictiveHigh
3File/category/list?limit=10&offset=0&order=descpredictiveHigh
4File/cgi-bin/login_action.cgipredictiveHigh
5File/cgi-bin/supervisor/PwdGrp.cgipredictiveHigh
6File/cgi-bin/touchlist_sync.cgipredictiveHigh
7File/classes/Master.php?f=delete_brandpredictiveHigh
8File/diag_ping_admin.asppredictiveHigh
9File/forum/away.phppredictiveHigh
10File/forum/PostPrivateMessagepredictiveHigh
11File/goform/formSysCmdpredictiveHigh
12File/HNAP1predictiveLow
13File/owa/auth/logon.aspxpredictiveHigh
14File/pages/systemcall.php?command={COMMAND}predictiveHigh
15File/phppath/phppredictiveMedium
16File/setSystemAdminpredictiveHigh
17File/shellpredictiveLow
18File/spip.phppredictiveMedium
19File/SSOPOST/metaAlias/%realm%/idpv2predictiveHigh
20File/uncpath/predictiveMedium
21File/user/loader.php?api=1predictiveHigh
22File/usr/bin/pkexecpredictiveHigh
23File/webpages/datapredictiveHigh
24File/wp-admin/options.phppredictiveHigh
25File/xxx-xxx-xxxxx/xxxx/xxxpredictiveHigh
26File/__xx/predictiveLow
27Filexxxxxxx.xxxpredictiveMedium
28Filexxxxx/xxxx_xxxxx_xxxx.xxxpredictiveHigh
29Filexxxxx/xxxxxxxx.xxxpredictiveHigh
30Filexxxxx/xxxxx.xxxpredictiveHigh
31Filexxxxxxx.xxx?xxx=xxxxxpredictiveHigh
32Filexxxxx\xxxxx\xxxxxxx\xxxxxxxx.xxxpredictiveHigh
33Filexxxx/xxx/xxxx/xxxxxxxxxxxxxxxpredictiveHigh
34Filexxxx/xxx/xxxx/xxxxxxxxxxxpredictiveHigh
35Filexxx/xxxxxxxxxxx/xxxxxxx_xxxxxxxxxx.xxpredictiveHigh
36Filexxxx-xxxx.xpredictiveMedium
37Filexxxx.xxxpredictiveMedium
38Filexxxxxxxx.xxxpredictiveMedium
39Filexxxxxxxxxxx_xxxxxx.xxxpredictiveHigh
40Filexxxx.xpredictiveLow
41Filexxxx.xxxpredictiveMedium
42Filexxxxxxxxxxx.xxxpredictiveHigh
43Filexxxxxx-xxxxxxxx.xxxpredictiveHigh
44Filexxx-xxx/predictiveMedium
45Filexxx-xxx/xxxx_xxxx.xxxpredictiveHigh
46Filexxx_xxxx.xpredictiveMedium
47Filexx_xxxx.xxxpredictiveMedium
48Filexxxxxxxxx.xxxpredictiveHigh
49Filexxxxxxxxxxx/xxxxxx.xxxpredictiveHigh
50Filexxxxxx/xx/xx_xxxx.xpredictiveHigh
51Filexxxxxx.xxxpredictiveMedium
52Filexxxxxx.xpredictiveMedium
53Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
54Filexxxxxxxx.xxxpredictiveMedium
55Filexxxxxxxx_xxxx_xxxxxxxxxx.xxxxpredictiveHigh
56Filexxxxxxx/xxxxx/xxxxxx/xxxxxx-xxxxxxx.xpredictiveHigh
57Filexxxxx_xxxxxxxxxx.xpredictiveHigh
58Filexxxxx.xxxpredictiveMedium
59Filexxxxx-xxxxxx.xxxpredictiveHigh
60Filexxxx_xxxxxxxx.xxxpredictiveHigh
61Filexxxxxxxx.xxxpredictiveMedium
62Filexxx_xxxxxxxxxxx.xxxpredictiveHigh
63Filexxxxxx/xxxxxxxxxxxxpredictiveHigh
64Filexxxx.xxxpredictiveMedium
65Filexxxxxxxxx.xxxpredictiveHigh
66Filexxxxxxxxx.xxxpredictiveHigh
67Filexxxxxxxxxx/xxxxxxxxxx/xxxxxxxx/xxxxxxxxxxxxxxxxxxx.xxxpredictiveHigh
68Filexxx/xxxxxx.xxxpredictiveHigh
69Filexxx/xxxxxxxxxxx/xxxxxxx.xxxpredictiveHigh
70Filexxxxxxxx/xxxxxxxxx.xxxpredictiveHigh
71Filexxxxx.xxxxpredictiveMedium
72Filexxxxx.xxxpredictiveMedium
73Filexxxxx.xxx/xxxx/xxxxx/xxxx/xxxx.xxxpredictiveHigh
74Filexxxxxxxxx/xxxxxxxxxpredictiveHigh
75Filexxxxxxx/xxxxxxxxxxxxx.xxxxpredictiveHigh
76Filexxxx.xxxpredictiveMedium
77Filexx.xxxpredictiveLow
78Filexxxxxxxxxxxx/xxxxxxxxx.xpredictiveHigh
79Filexxxxxxxx.xxxpredictiveMedium
80Filexxx_xxxx.xxxpredictiveMedium
81Filexxx_xxxxx_xxxx.xpredictiveHigh
82Filexxx/xxxxxxxxx/xx_xxxxxxxxx_xxx.xpredictiveHigh
83Filexxxx.xxxpredictiveMedium
84Filexxx_xxxx.xxxpredictiveMedium
85Filexxx.xpredictiveLow
86Filexxxxxxxxxxxxxxx.xxxpredictiveHigh
87Filexxx-xxxxxxxxx-xxxxxxxxxx-xxxxxx/xxxxx.xxxpredictiveHigh
88Filexxx.xxxpredictiveLow
89Filexxxxxxx.xxxpredictiveMedium
90Filexxxxxx_xxxxxxxxxx_xxxxx.xxxpredictiveHigh
91Filexxxxxx.xpredictiveMedium
92Filexxxxxxx.xxxpredictiveMedium
93Filexxxxxxx.xxx?xx=xxx_xxxxxxxxpredictiveHigh
94Filexxxx.xxxpredictiveMedium
95Filexxxxx.xxxpredictiveMedium
96Filexxxxxxxx.xxxpredictiveMedium
97Filexxxxxxxx.xxxpredictiveMedium
98Filexxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxxpredictiveHigh
99Filexxxxxxxx_xxxx.xxxpredictiveHigh
100Filexxx.xxxpredictiveLow
101Filexxxxxxxxxx_xxxxx.xxxxxxpredictiveHigh
102Filexxx_xxxx_xxxxxxxxx.xxpredictiveHigh
103Filexxx.xpredictiveLow
104Filexxxxxx.xxpredictiveMedium
105Filexxxxxxxxxxxxx.xxxpredictiveHigh
106Filexxxxxxxxxx.xxxpredictiveHigh
107Filexxxxxxxx/xxxx/xxxx.xxx?xxxxxx=xxxxxxxxxxxxxxxxpredictiveHigh
108Filexxx_xxxxxx_xxx.xxxpredictiveHigh
109Filexxxx/xxxxxxxxxx.xxxpredictiveHigh
110Filexxxxxxx.xxxpredictiveMedium
111Filexxxx-xxxxxxxx.xxxpredictiveHigh
112Filexxxxxxxx-xxxxxxxx-xxxxxxxx.xxxpredictiveHigh
113Filexxxxxx.xxxpredictiveMedium
114Filexxxx/xxx/xxxx-xxxxx.xxxpredictiveHigh
115Filexxxx.xxxpredictiveMedium
116Filexxxxxx.xxxpredictiveMedium
117Filexxxxxxx.xxxpredictiveMedium
118Filexxx/xxxxx/xxxxx.xxxpredictiveHigh
119Filexxxxxxxx.xxxpredictiveMedium
120Filexxxxxxx.xxxpredictiveMedium
121Library/xxxxxxx/xxxxx/xxx.xxxpredictiveHigh
122Library/xxx/xxx/xxx/xxxx/xxxxxxxxxx/xxxxx/xxxxxx.xxxpredictiveHigh
123Library/xxx/xxx/xxx/xxxx/xxxxxxxxxx/xxxxx/xxxxxxxxxx.xxxpredictiveHigh
124ArgumentxxxxxxpredictiveLow
125ArgumentxxxxxxxpredictiveLow
126ArgumentxxxxxxxxxpredictiveMedium
127ArgumentxxxxxxxpredictiveLow
128ArgumentxxxxxxxxpredictiveMedium
129Argumentxxxxx xxxxpredictiveMedium
130ArgumentxxxpredictiveLow
131ArgumentxxxxxxxxpredictiveMedium
132Argumentxxxxxx/xxxxpredictiveMedium
133ArgumentxxxxxxxpredictiveLow
134ArgumentxxxxxxxxxpredictiveMedium
135ArgumentxxxxxxxxxxxxxpredictiveHigh
136ArgumentxxxxxxxxxxxxxxxxpredictiveHigh
137ArgumentxxxxpredictiveLow
138ArgumentxxxxxxxxxxxpredictiveMedium
139ArgumentxxxxxxxxxxpredictiveMedium
140ArgumentxxxxxxxpredictiveLow
141ArgumentxxxxxpredictiveLow
142ArgumentxxxxpredictiveLow
143ArgumentxxxxxxxxpredictiveMedium
144ArgumentxxxxxpredictiveLow
145ArgumentxxxxpredictiveLow
146ArgumentxxxxpredictiveLow
147ArgumentxxpredictiveLow
148ArgumentxxxxxpredictiveLow
149ArgumentxxpredictiveLow
150ArgumentxxxxpredictiveLow
151ArgumentxxxxxxxxpredictiveMedium
152ArgumentxxxxxxxxpredictiveMedium
153ArgumentxxxxpredictiveLow
154Argumentxxxx/xxxxxxpredictiveMedium
155ArgumentxxxxxxxxpredictiveMedium
156ArgumentxxxxxxxxpredictiveMedium
157Argumentxxxx_xxxxpredictiveMedium
158Argumentxxxxx_xxxx_xxxxpredictiveHigh
159ArgumentxxxxxxxxpredictiveMedium
160Argumentxxxxxxxx_xxxxxpredictiveHigh
161ArgumentxxxpredictiveLow
162ArgumentxxxxxxxxpredictiveMedium
163Argumentxxxxxx_xxxxpredictiveMedium
164ArgumentxxxxxxxxxxxxxxpredictiveHigh
165ArgumentxxxxxxxxpredictiveMedium
166ArgumentxxxxxxxxxpredictiveMedium
167Argumentxxxx_xxxxpredictiveMedium
168ArgumentxxxxxxxxxxxpredictiveMedium
169ArgumentxxxxxxxpredictiveLow
170Argumentxxxxxxx_xxxxx/xxxxxxx_xxxxxxx/xxxxxxx_xxxxxxxxxx/xxxxxxx_xxxxpredictiveHigh
171ArgumentxxxxxxxxxpredictiveMedium
172ArgumentxxpredictiveLow
173ArgumentxxxxpredictiveLow
174ArgumentxxxxxxxpredictiveLow
175Argumentxxxxxxx/xxxxxxxpredictiveHigh
176ArgumentxxxxxxpredictiveLow
177Argumentxxx_xxxxx/xxxx_xxxxx/xxxx_xxxxxpredictiveHigh
178Argumentxxxx_xxxxxxxxpredictiveHigh
179ArgumentxxxxpredictiveLow
180ArgumentxxxpredictiveLow
181Argumentxxxxxxxxxx_xxxx_xxxxxxxpredictiveHigh
182ArgumentxxxxxpredictiveLow
183ArgumentxxxxxxxxxxxxxxxpredictiveHigh
184Argumentxxxxxxxxxxx/xxxxxx/xxxxxxxxxx/xxxxxxxxpredictiveHigh
185Argumentx_xxxxxxpredictiveMedium
186ArgumentxxxxpredictiveLow
187Argumentxxxxx_xxxxxpredictiveMedium
188ArgumentxxxpredictiveLow
189ArgumentxxxpredictiveLow
190ArgumentxxxxpredictiveLow
191ArgumentxxxxxxxxpredictiveMedium
192ArgumentxxxxxpredictiveLow
193ArgumentxxxxxpredictiveLow
194Argumentxxxxx_xxx_xxx_xxpredictiveHigh
195ArgumentxxxxpredictiveLow
196ArgumentxxxxxpredictiveLow
197ArgumentxxxxxxpredictiveLow
198Argumentxxxx->xxxxxxxpredictiveHigh
199Argumentx-xxxxxxxxx-xxxxxxpredictiveHigh
200Argument_xxxxxxxpredictiveMedium
201Input Value%xxxxxx+-x+x+xx.x.xx.xxx%xx%xxpredictiveHigh
202Input Value../predictiveLow
203Input Value/%xxpredictiveLow
204Pattern|xx|xx|xx|predictiveMedium
205Network Portxxx/xxxxpredictiveMedium
206Network Portxxx/xxxxxpredictiveMedium
207Network Portxxx/xxx (xxx)predictiveHigh
208Network Portxxx/xxx (xxxx)predictiveHigh

References (3)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!