TitanStealer Analysis

IOB - Indicator of Behavior (535)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en458
de24
ru24
es10
it6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us204
ru170
cn44
lv28
de12

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Microsoft IIS8
Microsoft Edge8
Microsoft ChakraCore8
nginx8
Drupal6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1automad Dashboard cross site scripting3.53.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000540.18CVE-2022-1536
2Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaround0.020160.00CVE-2007-1192
3Open Networking Foundation ONOS API Documentation Dashboard cross site scripting4.84.8$0-$5k$0-$5kNot DefinedNot Defined0.000710.02CVE-2023-24279
4OpenSSH Authentication Username information disclosure5.34.8$5k-$25k$0-$5kHighOfficial Fix0.107370.29CVE-2016-6210
5Oracle MySQL Server InnoDB access control5.55.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000980.00CVE-2018-3185
6ISC BIND named resolver.c input validation8.68.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.733300.03CVE-2016-1286
7Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.005480.07CVE-2017-0055
8MGB OpenSource Guestbook email.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.013020.88CVE-2007-0354
9Oracle Communications Cloud Native Core Unified Data Repository Signaling protection mechanism9.99.7$25k-$100k$5k-$25kNot DefinedOfficial Fix0.002150.00CVE-2022-43403
10Googlemaps Plugin plugin_googlemap2_proxy.php resource consumption6.46.1$0-$5k$0-$5kNot DefinedOfficial Fix0.006040.03CVE-2013-7428
11nginx request smuggling6.96.9$0-$5k$0-$5kNot DefinedNot Defined0.002412.21CVE-2020-12440
12Microsoft IIS Frontpage Server Extensions shtml.dll Username information disclosure5.35.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.159580.00CVE-2000-0114
13OpenSSH ssh-agent double free5.85.6$25k-$100k$0-$5kNot DefinedOfficial Fix0.001840.04CVE-2021-28041
14TikiWiki tiki-register.php input validation7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.0107510.00CVE-2006-6168
15Coppermine Photo Gallery init.inc.php file inclusion7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.083070.05CVE-2004-1988
16PC Keyboard Server missing authentication9.89.8$0-$5k$0-$5kNot DefinedNot Defined0.003550.00CVE-2022-45479
17Apache HTTP Server HTTP Digest Authentication Challenge improper authentication8.58.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.016860.04CVE-2018-1312
18XiongMai IP Camera/DVR NetSurveillance Web Interface memory corruption8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.003720.08CVE-2017-16725
19ONLYOFFICE Document Server WebSocket API sql injection8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.001740.00CVE-2020-11537
20nginx ngx_http_mp4_module information disclosure5.95.8$0-$5k$0-$5kNot DefinedOfficial Fix0.001980.00CVE-2018-16845

IOC - Indicator of Compromise (35)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
137.220.87.23ipn-37-220-87-23.artem-catv.ruTitanStealer03/17/2023verifiedHigh
237.220.87.48ipn-37-220-87-48.artem-catv.ruTitanStealer03/30/2023verifiedHigh
337.220.87.60ipn-37-220-87-60.artem-catv.ruTitanStealer02/21/2023verifiedHigh
445.9.74.63TitanStealer02/21/2023verifiedHigh
545.15.156.137TitanStealer04/05/2023verifiedHigh
645.15.156.211TitanStealer02/21/2023verifiedHigh
745.15.156.242TitanStealer04/05/2023verifiedHigh
8XX.XX.XXX.XXXXxxxxxxxxxxx04/05/2023verifiedHigh
9XX.XX.XXX.XXXXxxxxxxxxxxx04/05/2023verifiedHigh
10XX.X.XXX.XXxxxxxx.xxxxxxxxx.xxXxxxxxxxxxxx10/28/2023verifiedHigh
11XX.XX.XXX.XXXxxxxxxxxxxx10/28/2023verifiedHigh
12XX.XX.XX.XXXxxxxxxxxxxx03/30/2023verifiedHigh
13XX.XX.XX.XXXxxxx.xxxx.xxxxxxxXxxxxxxxxxxx05/08/2023verifiedHigh
14XX.XXX.XXX.XXxxxxxxx-xxxx.xxxx.xxxxxxxXxxxxxxxxxxx04/05/2023verifiedHigh
15XX.XXX.XXX.XXXxxxxxxxxxxx-xxxxx.xxxx.xxxxxxxXxxxxxxxxxxx10/28/2023verifiedHigh
16XX.XX.XXX.XXxxxxxx-xxxx.xxxx.xxxxxxxXxxxxxxxxxxx04/05/2023verifiedHigh
17XX.XXX.XXX.XXXxxxxxxxxxxx04/05/2023verifiedHigh
18XX.XXX.XXX.XXXXxxxxxxxxxxx04/05/2023verifiedHigh
19XX.XXX.XXX.XXXXxxxxxxxxxxx04/05/2023verifiedHigh
20XX.XXX.XXX.XXXxx-xxxxxxx-xxx.xxxxxXxxxxxxxxxxx04/23/2023verifiedHigh
21XX.XX.XXX.XXXxxxx-xx-xx-xxx-xxx.xxxxxx-xx-xxxxxx.xxXxxxxxxxxxxx02/21/2023verifiedHigh
22XX.XX.XX.XXXXxxxxxxxxxxx04/05/2023verifiedHigh
23XX.XX.XX.XXXXxxxxxxxxxxx10/28/2023verifiedHigh
24XX.XXX.XXX.XXXxxxxxxxxxxx04/05/2023verifiedHigh
25XX.XXX.XXX.XXXxxxxxxxxxxx10/28/2023verifiedHigh
26XX.XXX.XXX.XXXXxxxxxxxxxxx03/17/2023verifiedHigh
27XX.XXX.XXX.XXXXxxxxxxxxxxx10/28/2023verifiedHigh
28XX.XXX.XXX.XXXXxxxxxxxxxxx10/28/2023verifiedHigh
29XXX.XXX.X.XXXxxxxxx.xxx.x.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxxxxxxxxx04/05/2023verifiedHigh
30XXX.XX.XX.XXXxxxxxx.xxx.xx.xx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxxxxxxxxx03/30/2023verifiedHigh
31XXX.XX.XX.XXxxxxxx.xx.xx.xx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxxxxxxxxx10/28/2023verifiedHigh
32XXX.XXX.XX.XXXXxxxxxxxxxxx02/21/2023verifiedHigh
33XXX.XXX.XX.XXxxxxxxxxxx-xxxxx.xxxx.xxxxxxxXxxxxxxxxxxx04/05/2023verifiedHigh
34XXX.XXX.XX.XXXxxxxxx-xxxx.xxxx.xxxxxxxXxxxxxxxxxxx04/05/2023verifiedHigh
35XXX.XXX.XXX.XXxxxxx-xxxxxx-xxxxxxx-xxxxxxx.xxxxxx-xx-xxxxx.xxxXxxxxxxxxxxx10/28/2023verifiedHigh

TTP - Tactics, Techniques, Procedures (19)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (193)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/+CSCOE+/logon.htmlpredictiveHigh
2File/.envpredictiveLow
3File/category.phppredictiveHigh
4File/category/list?limit=10&offset=0&order=descpredictiveHigh
5File/cgi-bin/cstecgi.cgi?action=loginpredictiveHigh
6File/cgi-bin/delete_CApredictiveHigh
7File/classes/Master.php?f=delete_brandpredictiveHigh
8File/Config/SaveUploadedHotspotLogoFilepredictiveHigh
9File/display/mappredictiveMedium
10File/downloadpredictiveMedium
11File/forum/away.phppredictiveHigh
12File/forum/PostPrivateMessagepredictiveHigh
13File/get_getnetworkconf.cgipredictiveHigh
14File/GponForm/device_Form?script/predictiveHigh
15File/includes/rrdtool.inc.phppredictiveHigh
16File/Main_AdmStatus_Content.asppredictiveHigh
17File/NAGErrorspredictiveMedium
18File/registrar/?page=registrationpredictiveHigh
19File/sgms/TreeControlpredictiveHigh
20File/src/admin/content_batchup_action.phppredictiveHigh
21File/st_reg.phppredictiveMedium
22File/tmppredictiveLow
23File/xxxxxxx/predictiveMedium
24File/xxxxxx/xxxxxx.xxxpredictiveHigh
25File/xxx/xxx/xxxxxxpredictiveHigh
26File/xxx/xxx/xxxxxpredictiveHigh
27File/xxx-xxx-xxxxx/xxxx/xxxpredictiveHigh
28File/xx/xxxxx.xxxpredictiveHigh
29Filexx.xxxpredictiveLow
30Filexxxxx/xxxxxxx.xxxpredictiveHigh
31Filexxxxx/xxxxxx_xxxx.xxxpredictiveHigh
32Filexxxxx/xxxx.xxxxxxx.xxxpredictiveHigh
33Filexxxxx/xxxx.xxxx.xxxpredictiveHigh
34Filexxxxx\xxxxxxxxxx\xxxxxxxxxx.xxxpredictiveHigh
35Filexxxxx\xxxxx\xxxx_xxxx.xxxpredictiveHigh
36Filexxxxxxxxxxx.xxpredictiveHigh
37Filexxxxxxx.xxpredictiveMedium
38Filexxx/xxxxxxxxxxx/xxxxxxx_xxxxxxxxxx.xxpredictiveHigh
39Filexxxxxxxxxxxxx.xxpredictiveHigh
40Filexxxxxxx.xxxpredictiveMedium
41Filexxx_xxxxx.xxxpredictiveHigh
42Filexxxxxxx/xxxxxxx/xxxxxxx.xxxx?xxxxpredictiveHigh
43Filexxx_xxxxxxxx.xxxpredictiveHigh
44Filexxxxxx_xxxx.xxxpredictiveHigh
45Filexxxxxxxxxxx.xxxpredictiveHigh
46Filexxxxxxxxxx_xxxxx.xxxpredictiveHigh
47Filexxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
48Filexxxxxx.xxxpredictiveMedium
49Filexxxxxxxx_xxxxxxx.xxxpredictiveHigh
50Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
51Filexx.x/xxxxxxxx.xpredictiveHigh
52Filexxxxxxxxx.xxxpredictiveHigh
53Filexxxxxxxxxxxxxxxx.xxxpredictiveHigh
54Filexxxxxxx/xxxxxxx/xxxx-xxxxxxx-xx.xpredictiveHigh
55Filexxxxxxx/xxxxx/xxxxxx/xxxxxx-xxxxxxx.xpredictiveHigh
56Filexxxxxxx.xxpredictiveMedium
57Filexxxx_xxxxxxx.xxxpredictiveHigh
58Filexxxxx.xxxpredictiveMedium
59Filexxxxxxxx/xxx-xxxx.xxxpredictiveHigh
60Filexxxxxxxx.xxxpredictiveMedium
61Filexxxxxxx.xxxxpredictiveMedium
62Filexxxxxxx.xxx_predictiveMedium
63Filexxxxxxxx/xxxx_xxxxpredictiveHigh
64Filexxxx_xxxx.xpredictiveMedium
65Filexxx/xxxxxx.xxxpredictiveHigh
66Filexxxxxxx\xxxxxxx\xxxxxxx_xxxxx.xxxpredictiveHigh
67Filexxxxxxx\xxxxxxx\xxxxxxx_xxxxxx.xxxpredictiveHigh
68Filexxxxx.xxxxpredictiveMedium
69Filexxxxx.xxxpredictiveMedium
70Filexxxxxxxx.xxxpredictiveMedium
71Filexxxx.xxx.xxxpredictiveMedium
72Filexx.xxxpredictiveLow
73Filexxxxxxxxx/xxxxxx.xxx.xxxpredictiveHigh
74Filexxxxxxxx.xxxpredictiveMedium
75Filexxxxxxxx.xxpredictiveMedium
76Filexxxxxx.xxxpredictiveMedium
77Filexxxxxx_xxxxxx.xxxpredictiveHigh
78Filexxx-xxxxxxxx.xxpredictiveHigh
79Filexxxxxxxx.xxxpredictiveMedium
80Filexxx-xxxxxxxxx-xxxxxxxxxx-xxxxxx/xxxxx.xxxpredictiveHigh
81Filexxxxxxx.xxxpredictiveMedium
82Filexxx_xxxxxxxxx.xpredictiveHigh
83Filexxxxxxx/xxxxxxxxxxxxxxxx/xxxxxxxxx/xxxxxxxx.xxxxpredictiveHigh
84Filexxxxxx_xxxxxxxxxx_xxxxx.xxxpredictiveHigh
85Filexxxxxxxx.xxpredictiveMedium
86Filexxxxx.xpredictiveLow
87Filexxxxx.xxxpredictiveMedium
88Filexxxxxxx.xxpredictiveMedium
89Filexxxxxxxx.xxxpredictiveMedium
90Filexxxxxxxx.xxxpredictiveMedium
91Filexxx_xxxx_xxxxxxxxx.xxpredictiveHigh
92Filexxxxxx_xxxxxxx.xxxpredictiveHigh
93Filexxxxxxxx/xxxx/xxxx.xxx?xxxxxx=xxxxxxxxxxxxxxxxpredictiveHigh
94Filexxxxxxxxxxxxxxxxxxxxxxxxxx.xx/xxxxxxxxxx.xx/xxxxxxxxxxx.xxpredictiveHigh
95Filexxxx/xxxxxxxxxx.xxxpredictiveHigh
96Filexxxxxxxxxxx.xpredictiveHigh
97Filexxx/xx_xxx.xpredictiveMedium
98Filexxxxxxxx.xxxxx.xxxpredictiveHigh
99Filexxxx-xxxxxxxx.xxxpredictiveHigh
100Filexx.xxxpredictiveLow
101Filexxxxxxxxxx.xxxpredictiveHigh
102Filexxxxxxx.xxxpredictiveMedium
103Filexxxxxxx.xxxpredictiveMedium
104Filexxxx_xxxx.xxxpredictiveHigh
105Filexxx_xxxxx.xxx?xxxx=xxxxxxxxpredictiveHigh
106Filexxx-xxxxx.xxxpredictiveHigh
107Filexxxxxxx.xxxpredictiveMedium
108Filexx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxxpredictiveHigh
109Filexx-xxxxx.xxxpredictiveMedium
110Filexxxx.xxpredictiveLow
111File~/.xxxxxxxpredictiveMedium
112Library/_xxx_xxx/xxxxx.xxxpredictiveHigh
113LibraryxxxxxxxxxpredictiveMedium
114Argument--xxxxxx/--xxxxxxxxpredictiveHigh
115Argumentxxxxxxxxxx xxx xxxxxxxpredictiveHigh
116ArgumentxxxxxxxpredictiveLow
117ArgumentxxxxxpredictiveLow
118ArgumentxxxxxxxxpredictiveMedium
119ArgumentxxxxxxxpredictiveLow
120ArgumentxxxxxpredictiveLow
121Argumentxxxx xxxxx/xxxx xxxxxxpredictiveHigh
122Argumentxxxxx xxxxpredictiveMedium
123Argumentxxxxx_xxxx/xx_xxxxx_xxxxx_xx/xx_xxxxx_xxxxx_xxxxx_xxxx_xxxx/xxxxx_xxxxxxxxx_xxxx/xxxxxx_xxxxxx_xxxxxpredictiveHigh
124ArgumentxxxxxxxxpredictiveMedium
125Argumentxxxxxxxx/xxxxxxpredictiveHigh
126ArgumentxxxpredictiveLow
127ArgumentxxxxxxxxpredictiveMedium
128Argumentxxx_x_xxxpredictiveMedium
129ArgumentxxpredictiveLow
130Argumentxxxx_xxxxxx=xxxxpredictiveHigh
131ArgumentxxxxxpredictiveLow
132ArgumentxxxxxpredictiveLow
133ArgumentxxxxxxxxpredictiveMedium
134ArgumentxxxxxpredictiveLow
135ArgumentxxxxpredictiveLow
136ArgumentxxxxxxxxpredictiveMedium
137ArgumentxxxxxxxxpredictiveMedium
138ArgumentxxxxpredictiveLow
139ArgumentxxpredictiveLow
140ArgumentxxxxxpredictiveLow
141ArgumentxxxxpredictiveLow
142ArgumentxxxxpredictiveLow
143Argumentxxxx_xxxxxxxpredictiveMedium
144ArgumentxxpredictiveLow
145ArgumentxxxxxxxxxxpredictiveMedium
146Argumentxxxxxxxx_xxxpredictiveMedium
147ArgumentxxxxpredictiveLow
148ArgumentxxxxxpredictiveLow
149ArgumentxxxxxxxxpredictiveMedium
150ArgumentxxxpredictiveLow
151Argumentxxxx/xxxxxxxx/xxxxxxxx/xxxxxxxxpredictiveHigh
152Argumentxxxxxxx/xxxxpredictiveMedium
153ArgumentxxpredictiveLow
154ArgumentxxxxxpredictiveLow
155Argumentxxxxxxx_xxxxx_xxxxxxx_xxxxx[x]predictiveHigh
156ArgumentxxxxpredictiveLow
157ArgumentxxxxxxxxpredictiveMedium
158ArgumentxxxxxxxxpredictiveMedium
159ArgumentxxxxxxxxpredictiveMedium
160ArgumentxxxxpredictiveLow
161Argumentxxxxxx_xxxxxxxpredictiveHigh
162ArgumentxxxxpredictiveLow
163ArgumentxxxxxxxpredictiveLow
164ArgumentxxxxxxxxxxxpredictiveMedium
165Argumentxxxxxx_xxxxpredictiveMedium
166ArgumentxxxxxxxxxxxxxxpredictiveHigh
167ArgumentxxxxxxxxxxpredictiveMedium
168Argumentxxxx_xxxxpredictiveMedium
169ArgumentxxxxxxxxxpredictiveMedium
170ArgumentxxxxxxxxxpredictiveMedium
171ArgumentxxxxpredictiveLow
172Argumentxxxxxxx/xxxxxxxpredictiveHigh
173ArgumentxxxpredictiveLow
174Argumentx_xxpredictiveLow
175ArgumentxxxxpredictiveLow
176ArgumentxxxxxxxpredictiveLow
177ArgumentxxxxxpredictiveLow
178ArgumentxxxxpredictiveLow
179ArgumentxxxpredictiveLow
180Argumentxxxxxxxx/xxxxxxxxpredictiveHigh
181ArgumentxxxxpredictiveLow
182Argumentx-xxxxxxxxx-xxxpredictiveHigh
183Argumentxx-xxxxxx_xxxxpredictiveHigh
184Input Value%xxxxxx+-x+x+xx.x.xx.xxx%xx%xxpredictiveHigh
185Input Value-x+xxxxx+xxxxxx+x,x,xxxxxxx()predictiveHigh
186Input Value../predictiveLow
187Input Value<xxxxxxxx>\xpredictiveMedium
188Input Value<xxxxxx>xxxxx(x)</xxxxxx>predictiveHigh
189Input Valuexxxx</xxxxx><xxxxxx>xxxxx("xxxx")</xxxxxx><xxxxx>predictiveHigh
190Pattern|xx|xx|xx|predictiveMedium
191Network Portxxx/xxxxpredictiveMedium
192Network Portxxx/xxxx (xx-xxx)predictiveHigh
193Network Portxxx/xxx (xxx)predictiveHigh

References (9)

The following list contains external sources which discuss the actor and the associated activities:

Do you want to use VulDB in your project?

Use the official API to access entries easily!