PoshC2 Analysis

IOB - Indicator of Behavior (728)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en524
de100
ru50
zh34
pl8

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us496
ru84
cn60
gb20
th2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Microsoft Windows14
Linux Kernel8
PHP8
Apache Tomcat6
VMware vCenter Server6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaround0.020160.00CVE-2007-1192
2DZCP deV!L`z Clanportal config.php code injection7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.009430.42CVE-2010-0966
3TikiWiki tiki-register.php input validation7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.010759.76CVE-2006-6168
4Russcom Network Loginphp register.php cross site scripting4.34.1$0-$5k$0-$5kProof-of-ConceptUnavailable0.006770.02CVE-2006-2160
5FreeBSD FPU x87 Register information disclosure4.03.8$0-$5k$0-$5kNot DefinedOfficial Fix0.000000.00
6Jelsoft vBulletin register.php denial of service7.37.3$0-$5k$0-$5kNot DefinedNot Defined0.015620.00CVE-2006-4272
7CONTROLzx HMS register_domain.php cross site scripting3.53.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.00
8MGB OpenSource Guestbook email.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.013021.16CVE-2007-0354
9nginx request smuggling6.96.9$0-$5k$0-$5kNot DefinedNot Defined0.002411.74CVE-2020-12440
10Vmware Workspace ONE Access/Identity Manager Template injection9.89.4$5k-$25k$0-$5kHighOfficial Fix0.974600.00CVE-2022-22954
11Ultimate PHP Board register.php unknown vulnerability5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.003170.00CVE-2006-3206
12SloughFlash SF-Users register.php cross site scripting4.34.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.005870.04CVE-2006-2167
13Linux Kernel FXSAVE x87 Register cryptographic issues4.33.9$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.001010.04CVE-2006-1056
14jQuery html cross site scripting5.85.1$0-$5k$0-$5kNot DefinedOfficial Fix0.019000.12CVE-2020-11023
15Cisco AnyConnect Secure Mobility Client Profile Editor xml external entity reference4.94.9$0-$5k$0-$5kNot DefinedNot Defined0.000740.00CVE-2018-0100
16Bitrix Site Manager Vote Module Remote Code Execution7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.006680.08CVE-2022-27228
17Citrix Workspace App Automatic Updater Service access control7.57.5$5k-$25k$5k-$25kNot DefinedOfficial Fix0.000880.03CVE-2020-8207
18X7 Group X7 Chat register.php cross site scripting4.33.9$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.006150.00CVE-2006-2282
19Kailash Nadh boastMachine Admin Interface register.php cross site scripting4.33.8$0-$5k$0-$5kProof-of-ConceptUnavailable0.008070.00CVE-2006-3826
20GeoClassifieds Enterprise register.php cross site scripting3.53.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.00

Campaigns (1)

These are the campaigns that can be associated with the actor:

  • PoshC2

IOC - Indicator of Compromise (40)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
13.120.209.174ec2-3-120-209-174.eu-central-1.compute.amazonaws.comPoshC201/16/2024verifiedMedium
23.253.77.60ec2-3-253-77-60.eu-west-1.compute.amazonaws.comPoshC210/27/2023verifiedMedium
313.48.77.144ec2-13-48-77-144.eu-north-1.compute.amazonaws.comPoshC211/01/2023verifiedMedium
413.78.10.244PoshC202/13/2024verifiedHigh
518.134.14.164ec2-18-134-14-164.eu-west-2.compute.amazonaws.comPoshC210/11/2023verifiedMedium
635.80.38.180ec2-35-80-38-180.us-west-2.compute.amazonaws.comPoshC201/02/2024verifiedMedium
735.202.253.4545.253.202.35.bc.googleusercontent.comPoshC203/27/2022verifiedMedium
845.79.196.20345-79-196-203.ip.linodeusercontent.comPoshC210/19/2023verifiedHigh
9XX.XXX.XXX.XXXXxxxxx01/27/2024verifiedHigh
10XX.XXX.XXX.XXXXxxxxx06/22/2021verifiedHigh
11XX.XXX.XX.XXXxxxxx11/22/2023verifiedHigh
12XX.XX.XX.XXXxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxxXxxxxx01/04/2024verifiedHigh
13XX.XXX.XXX.XXXXxxxxx11/15/2023verifiedHigh
14XX.XX.XXX.XXxxxxxxxxxxxxxxxxx.xx.xxxxxxxxx.xxxXxxxxx12/10/2023verifiedHigh
15XX.XXX.XXX.XXxxxxxxxxx.xxxxxxxxxxxxx.xxxXxxxxx11/11/2023verifiedHigh
16XX.XXX.X.XXXxxxxxxxx.xxxxxx-xx-xxxxxx.xxXxxxxx10/16/2023verifiedHigh
17XX.XX.XXX.XXxxxxxxxx.xx-xx-xx-xxx.xxXxxxxx10/26/2023verifiedHigh
18XX.XXX.XX.XXXxxxxxxx.xxxxxx.xxxXxxxxx10/09/2023verifiedHigh
19XX.XXX.XXX.XXXXxxxxx10/17/2022verifiedHigh
20XXX.XX.XXX.XXXXxxxxx06/22/2021verifiedHigh
21XXX.XXX.XX.XXXxxxxxx.xxx.xx.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxxx11/22/2023verifiedHigh
22XXX.XXX.XXX.XXXxxxxx11/07/2023verifiedHigh
23XXX.XX.XXX.XXXxxx.xx.xxx.xxx.xxxxxxxxxxxxxxxx.xxxXxxxxx04/24/2024verifiedHigh
24XXX.XX.XXX.XXxxx.xx.xxx.xx.xxxxxxxxxxxxxxxx.xxxXxxxxx01/02/2024verifiedHigh
25XXX.XXX.XXX.XXXxxxx-xxx.xxx.xxx.xxx-xxxxxx.xxxxxx.xxxXxxxxx04/03/2024verifiedHigh
26XXX.XXX.XXX.XXXxxxx-xxx.xxx.xxx.xxx-xxxxxx.xxxxxx.xxxXxxxxx04/22/2024verifiedHigh
27XXX.XXX.XXX.XXXxxxxx12/10/2023verifiedHigh
28XXX.XXX.XX.XXXXxxxxx10/19/2023verifiedHigh
29XXX.XX.XX.XXXXxxxxx01/09/2024verifiedHigh
30XXX.XX.XXX.XXXxxxxx02/20/2024verifiedHigh
31XXX.XXX.XXX.XXXXxxxxx01/25/2024verifiedHigh
32XXX.XXX.XX.XXxxxxxxxxxx.xxxxxxxxxxxxx.xxxXxxxxx12/15/2023verifiedHigh
33XXX.XXX.XXX.XXXxxx.xxxxx.xxxXxxxxx04/24/2024verifiedHigh
34XXX.XX.XXX.XXxxx-xxx-xx-xxx-xx.xxxxxxx-x.xxxxxxxxx.xxxXxxxxx11/09/2023verifiedMedium
35XXX.XXX.XX.XXXxxxxx01/26/2024verifiedHigh
36XXX.XXX.XXX.XXXxxxxx10/17/2023verifiedHigh
37XXX.XXX.XX.XXXxxxxx06/22/2021verifiedHigh
38XXX.XXX.XXX.XXXXxxxxx10/09/2023verifiedHigh
39XXX.XXX.XX.XXXxxx-xxx-xx-xxx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxx10/20/2023verifiedHigh
40XXX.XXX.XXX.XXXxxxxXxxxxx05/31/2021verifiedHigh

TTP - Tactics, Techniques, Procedures (20)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (208)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/admin/config/uploadicon.phppredictiveHigh
2File/admin/del_feedback.phppredictiveHigh
3File/admin/login.phppredictiveHigh
4File/app/Http/Controllers/Admin/NEditorController.phppredictiveHigh
5File/cms/category/listpredictiveHigh
6File/inquiries/view_inquiry.phppredictiveHigh
7File/LoginpredictiveLow
8File/mgmt/tm/util/bashpredictiveHigh
9File/mifs/c/i/reg/reg.htmlpredictiveHigh
10File/product/savenewproduct.php?flag=1predictiveHigh
11File/searchpredictiveLow
12File/secure/ViewCollectorspredictiveHigh
13File/SessionpredictiveMedium
14File/start_apply.htmpredictiveHigh
15File/sysmanage/updatelib.phppredictiveHigh
16File/thruk/#cgi-bin/extinfo.cgi?type=2predictiveHigh
17File/usr/bin/pkexecpredictiveHigh
18File/var/log/nginxpredictiveHigh
19File/xAdmin/html/cm_doclist_view_uc.jsppredictiveHigh
20Fileadclick.phppredictiveMedium
21Fileadd_comment.phppredictiveHigh
22Fileadmin/content.phppredictiveHigh
23Filebooking.phppredictiveMedium
24Filebrowse-category.phppredictiveHigh
25FileBSW_cxttongr.htmpredictiveHigh
26Filecat.asppredictiveLow
27Filexxxxxxxx.xxxpredictiveMedium
28Filexxx-xxx/xxxxxxx.xxpredictiveHigh
29Filexxxxxxxx.xxxpredictiveMedium
30Filexxxxxxxxxx/xxxxxxx.xxxxpredictiveHigh
31Filexxxxxx.xxxpredictiveMedium
32Filexxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxpredictiveHigh
33Filex_xxxxxxpredictiveMedium
34Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
35Filexxxxxxx_xxxxx.xxxpredictiveHigh
36Filexxxxxxxx.xxxpredictiveMedium
37Filexxxxxxxxxxx.xxxpredictiveHigh
38Filexxxxxxxx.xxxpredictiveMedium
39Filexxxxx.xxxpredictiveMedium
40Filexxxxxxxxxxxx.xxxpredictiveHigh
41Filexxxx_xxxxxxxx.xxxpredictiveHigh
42Filexxxxxxxxxxxxxxxxx.xxxpredictiveHigh
43Filexxxx.xxxpredictiveMedium
44Filexxxxxxxxx/xxxxx/xxxxxxxxxxxx/xxxxxxxxx.xxxpredictiveHigh
45Filexxxxxxxxxxx.xpredictiveHigh
46Filexxx_xxxxxxxxxxx.xxxpredictiveHigh
47Filexxxx.xxxpredictiveMedium
48Filexxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
49Filexxxxxxxxx.xxxpredictiveHigh
50Filexxx/xxxxxx.xxxpredictiveHigh
51Filexxx/xxxxxxxxxxx/xxxxxxx.xxxpredictiveHigh
52Filexxxxx.xxxpredictiveMedium
53Filexxxxx.xxxpredictiveMedium
54Filexxxxx.xxx/xxxxxxx/xxxxxpredictiveHigh
55Filexxxxx.xxx?xx=xxxxxxxxxx&xxxxpredictiveHigh
56Filexxxxx.xxpredictiveMedium
57Filexxxxxxx.xpredictiveMedium
58Filexxxxxxx.xxxpredictiveMedium
59Filexxxxxxxxxxx-xxxxxxx-xxxx.xxxx.xxxpredictiveHigh
60Filexxxxxxxx/xxxxxxxx_xxxxxxx_xxxxxx/xxxxx.xxxpredictiveHigh
61Filexxxx.xxxpredictiveMedium
62Filexxxxxxxxx/xxxxxx.xxx.xxxpredictiveHigh
63Filexxxx.xxxpredictiveMedium
64Filexxx.xxxpredictiveLow
65Filexxxxx-xxxx-xxxx.xxxpredictiveHigh
66Filexxxxx.xxxpredictiveMedium
67Filexxxxxxx.xxxpredictiveMedium
68Filexxx_xxxxx_xxxx.xpredictiveHigh
69Filexxx_xxxx_xxx_xxxxxxxxxx.xpredictiveHigh
70Filexxx_xxxx.xxxpredictiveMedium
71Filexxxx_xxxxxxx.xxxpredictiveHigh
72Filexxxxxxx.xxxpredictiveMedium
73Filexxxxx_xxx.xxxpredictiveHigh
74Filexxxxx.xxxpredictiveMedium
75Filexxxxxxx_xxxxxxx_xxxx.xxxpredictiveHigh
76Filexxx_xxxxxx.xxxxpredictiveHigh
77Filexxxxx.xxxpredictiveMedium
78Filexxxxxxxx.xxxpredictiveMedium
79Filexxxxxxxxxx.xxxpredictiveHigh
80Filexxxxxxxx.xxxxpredictiveHigh
81Filexxxxxxxx.xxxpredictiveMedium
82Filexxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxxpredictiveHigh
83Filexxxxxxxx_xxxxxx.xxxpredictiveHigh
84Filexxxxxxx.xxxpredictiveMedium
85Filexxxxxxx/xxxxxxxxxx.xxxpredictiveHigh
86Filexxxxxxx/xxxxxxxxxxxxx.xxxxpredictiveHigh
87Filexxxxxxxxxxxxxxx.xxxpredictiveHigh
88Filexxxxxx.xxpredictiveMedium
89Filexxxxxx.xxpredictiveMedium
90Filexxxxxx_xxxxxxx.xxxpredictiveHigh
91Filexxxxxxxx/xxxx/xxxx.xxx?xxxxxx=xxxxxxxxxxxxxxxxpredictiveHigh
92Filexxxx.xxxpredictiveMedium
93Filexxxx.xxpredictiveLow
94Filexxxxxxxx_xxxx.xxxpredictiveHigh
95Filexxxx_xxxxxxx_xxxxxxxx.xxxpredictiveHigh
96Filexxxxxxx/xxxxxxxx.xxxpredictiveHigh
97Filexxxxx.xxxpredictiveMedium
98Filexxxxx.xxxpredictiveMedium
99Filexxxxxx.xxxpredictiveMedium
100Filexxxxxxxx.xxxxx.xxxpredictiveHigh
101Filexxxxxx-xxxxxx.xxxpredictiveHigh
102Filexxxx-xxxxxxxx.xxxpredictiveHigh
103Filexxxxx_xxxxxx.xxxpredictiveHigh
104Filexxxxx.xpredictiveLow
105Filexxx-xxx/predictiveMedium
106Filexxxxxxx/xxx/xxxxxxxpredictiveHigh
107Filexxxxxx.xxxpredictiveMedium
108Filexx-xxxxx/xxxxx-xxx.xxx?xxxxxxx-xxxxxxxxpredictiveHigh
109Filexx-xxxx.xxxpredictiveMedium
110Filexx-xxxxxxxxx.xxxpredictiveHigh
111Filexxxx.xxpredictiveLow
112File~/xxx/xxxx-xxxxxxxxx.xxxpredictiveHigh
113File~/xxx-xxx-xxxx.xxxpredictiveHigh
114Libraryxxxxxxxx.xxxpredictiveMedium
115Libraryxxxxxx.xxxxx.xxxxxxxpredictiveHigh
116Argument*xxxxpredictiveLow
117Argumentxx_xxxx_xxxxpredictiveMedium
118ArgumentxxxxxxxpredictiveLow
119ArgumentxxpredictiveLow
120ArgumentxxxxxxxxxpredictiveMedium
121ArgumentxxxxxxxxxxxxpredictiveMedium
122ArgumentxxxxxxpredictiveLow
123ArgumentxxxxxxpredictiveLow
124ArgumentxxxxxxxxpredictiveMedium
125ArgumentxxxxxxxxpredictiveMedium
126ArgumentxxxxxxxxpredictiveMedium
127ArgumentxxxpredictiveLow
128Argumentxxx_xxpredictiveLow
129ArgumentxxxpredictiveLow
130Argumentxxx/xxxxx_xxxx/xxxxxx_xxxx/xxxxxxx_x/xxxxxxxpredictiveHigh
131Argumentxxxxxx_xxpredictiveMedium
132ArgumentxxxxxxpredictiveLow
133Argumentxxxxxxx_xxxxxpredictiveHigh
134Argumentxxxxxxx/xxxx/xxxxx_xxxxx_xxpredictiveHigh
135Argumentx[xxxxx]predictiveMedium
136Argumentxxxxxxxx_xxxxxx/xxxxxxxx_xxxx/xxxxxxxx_xxxxxxxx/xxxxxxxx_xxxxpredictiveHigh
137ArgumentxxxxpredictiveLow
138ArgumentxxxpredictiveLow
139ArgumentxxxxxxxpredictiveLow
140ArgumentxxxxxxxxxxpredictiveMedium
141ArgumentxxxxxxxpredictiveLow
142Argumentxx_xxxx/xxxxx/xxxpredictiveHigh
143Argumentxxxxxxxxx->xxxxxxxxxpredictiveHigh
144ArgumentxxxxxxxxpredictiveMedium
145Argumentxxxxxxx=xxxxxxxxpredictiveHigh
146Argumentxx_xxxxxpredictiveMedium
147ArgumentxxxxpredictiveLow
148ArgumentxxxxxxxxpredictiveMedium
149ArgumentxxxxxxxxpredictiveMedium
150Argumentxxxx_xxxxxxpredictiveMedium
151Argumentxxxxxx_xxxxx_xxxpredictiveHigh
152ArgumentxxxxxxxxxxpredictiveMedium
153ArgumentxxxxpredictiveLow
154Argumentxxxx/xxxxxxx/xxxxxxxpredictiveHigh
155Argumentxxxx_xxpredictiveLow
156Argumentxxxx_xxxxxpredictiveMedium
157ArgumentxxxxpredictiveLow
158ArgumentxxpredictiveLow
159Argumentxx_xxxxxpredictiveMedium
160ArgumentxxxxxxpredictiveLow
161ArgumentxxxxxxxpredictiveLow
162ArgumentxxxxxpredictiveLow
163ArgumentxxxxxxxxpredictiveMedium
164ArgumentxxxxxpredictiveLow
165ArgumentxxxxxxxxxxxpredictiveMedium
166Argumentxxxx-xxx-xxxxxxxxxpredictiveHigh
167Argumentxxxxxxx/xxxxxxxxxpredictiveHigh
168Argumentxxxxx_xxpredictiveMedium
169ArgumentxxxxpredictiveLow
170Argumentxxxx_xxxxxpredictiveMedium
171Argumentxxxxxxx_xxxpredictiveMedium
172ArgumentxxxxxxxxpredictiveMedium
173Argumentxx_xxxxpredictiveLow
174ArgumentxxxxxxxxxxxxxxxxxxxpredictiveHigh
175ArgumentxxxxxxxxxpredictiveMedium
176Argumentxxxxxxxx_xxpredictiveMedium
177Argumentxxxxxxx_xxxxpredictiveMedium
178Argumentxxxxxxx xxxxxpredictiveHigh
179ArgumentxxxxxxxxxxxxxxxxpredictiveHigh
180ArgumentxxxxxxpredictiveLow
181ArgumentxxxxxxpredictiveLow
182ArgumentxxxxxxpredictiveLow
183Argumentxxxxxx_xxxpredictiveMedium
184ArgumentxxxpredictiveLow
185ArgumentxxxxxxpredictiveLow
186ArgumentxxxpredictiveLow
187ArgumentxxxxxxxxpredictiveMedium
188Argumentxxxxx/xxxpredictiveMedium
189ArgumentxxxxxxpredictiveLow
190ArgumentxxxxxxxpredictiveLow
191Argumentxx_xxpredictiveLow
192ArgumentxxxxxpredictiveLow
193Argumentxxxxxxxxxxx/xxxxxxxxxxxpredictiveHigh
194ArgumentxxxxxpredictiveLow
195ArgumentxxxxxxpredictiveLow
196ArgumentxxxpredictiveLow
197ArgumentxxxpredictiveLow
198ArgumentxxxxxxxxpredictiveMedium
199ArgumentxxpredictiveLow
200ArgumentxxxpredictiveLow
201ArgumentxxxxxxpredictiveLow
202Argument_xxxxxx[xxxxxxxx_xxxx]predictiveHigh
203Input Value/xxxxxx/..%xxpredictiveHigh
204Input Valuexxxxx"][xxxxxx]xxxxx('xxx')[/xxxxxx]predictiveHigh
205Pattern__xxxxxxxxx=predictiveMedium
206Pattern|xx|predictiveLow
207Network PortxxxxpredictiveLow
208Network Portxxx xxxxxx xxxxpredictiveHigh

References (32)

The following list contains external sources which discuss the actor and the associated activities:

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!