threat-intelligence-report

Trends

  • The top attacker country was China with 3102 unique attackers (31.30%)
  • The top Exploit event was Application with 39% of occurrences.
  • The top Trojan C&C server detected was Trickbot with 36 instances detected.


Top Attacker by Country

CountryOccurrencesPercentage
China310231.30%
United States172517.41%
India6726.78%
Russian Federation5805.85%
Brazil4674.71%
Korea4494.53%
Vietnam4114.15%
France3633.66%
Indonesia2973.00%
United Kingdom2802.83%
Taiwan2372.39%
Canada1961.98%
Turkey1791.81%
Thailand1741.76%
Venezuela1601.61%
Ukraine1601.61%
Italy1571.58%
Germany1511.52%
Hong Kong1491.50%


Top Cyber Attackers by Country October 14-20 2019


Threat Geo-location


Cyber Security Threat Geolocations October 14-20 2019


Top Attacking Hosts

HostOccurrences
69.55.55.13976
112.85.42.18726
171.25.193.788
139.162.122.1106


Top Attacker Hosts October 14-20 2019


Top Network Attackers

Origin ASAnnouncementDescription
AS1406169.55.54.0/23ServerStack Inc.
AS4837112.80.0.0/13China Unicom Jiangsu Province Network
AS198093171.25.193.0/24Foreningen for digitala fri- och rattigheter
AS63949139.162.96.0/19Linode, LLC



Top Event NIDS and Exploits


Top Event NIDS October 14-20 2019


Top Event Exploits October 14-20 2019


Top Alarms

Type of AlarmOccurences
DatabaseAttack - Stored Procedure Access —Attack81
Bruteforce Authentication43
Network Anomaly2


Comparison from last week 

Type of AlarmOccurrences
Bruteforce Authentication808687
Intrusion Detection33223
Network Anomaly1721987


Top Cyber Security Alarms October 14-20 2019


Remote Access Trojan C&C Servers Found

NameNumber DiscoveredLocation
AgentTesla1161.117.182.74
AlphaStealer1178.208.83.42
Azorult2185.173.178.77, 185.224.138.189
Heodo13142.44.162.209, 149.202.153.251,
162.241.130.39, 181.188.149.134,
183.82.97.25, 192.241.175.184,
201.212.57.109, 203.130.0.67,
5.67.96.120, 75.127.14.170,
77.245.101.134, 92.222.125.16,
93.78.205.196
Keitaro169.16.254.181
Kpot15.188.60.52
LokiBot2161.117.182.74, 47.88.102.244
PredatorTheThief189.41.173.142
TrickBot36104.168.123.186, 107.155.137.4,
107.172.143.155, 139.60.163.36,
148.251.27.94, 178.170.189.52,
178.33.26.175, 181.113.20.186,
181.129.96.74, 185.141.27.223,
185.141.27.237, 185.215.148.133,
185.251.38.201, 185.252.144.190,
185.66.14.149, 186.46.88.62,
194.5.250.57, 194.5.250.60,
195.123.238.110, 195.123.238.83,
195.123.247.27, 198.12.71.210,
200.116.199.10, 200.21.51.38,
200.29.106.33, 23.94.24.196,
37.18.30.165, 37.228.117.182,
5.101.51.101, 51.77.202.8,
51.77.254.186, 64.44.51.126,
79.124.49.209, 79.124.49.210,
92.243.92.8, 92.38.171.26


Trojan C&C Servers October 14-20 2019


Common Malware


Malware TypeMD5Typical Filename

W32.WNC
ryLdrA:Trojan.
22k2.1201

8c80dd
97c375
25927c
1e549c
b59bcb
f3		Eternalblue-2.2.0.exe

W32.7ACF
71AFA8-95.
SBX.TG

4a5078
0ddb3d
b16eba
b57b0c
a42da0
fb		xme64-2141.exe
W32.Generic:
Gen.22fz.
1201		799b30
f47060
ca05d8
0ece53
866e01
cc		mf2016341595.exe
W32.Agent
WDCR:Gen.
21gn.1201		e2ea31
5d9a83
e75770
53f52c
974f6a
5a		c3e530cc005583b
47322b6649ddc0d
ab1b64bcf22b124a
492606763c52fb04
8f.bin
W32.46B2
41E3D3-95.
SBX.TG		db69ea
aea4d4
9703f1
61c81e
6fdd03
6f		xme32-2141-gcc.exe


CVEs For Which Public Exploits Have Been Detected

ID:        CVE-2019-1346
Title:    Microsoft Windows Denial of Service Vulnerability
Vendor:    Microsoft
Description: The Microsoft Windows kernel suffers from an out-of-bounds read vulnerability in CI!HashKComputeFirstPageHash while parsing a malformed PE file. An attacker who successfully exploited the vulnerability could cause a target system to stop responding.
Note: This CVE ID is unique from CVE-2019-1343, CVE-2019-1347.
CVSS v2 Base Score:    7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)


ID:        CVE-2019-1343
Title:    Microsoft Windows Denial of Service Vulnerability
Vendor:    Microsoft
Description: The Microsoft Windows kernel suffers from a null pointer dereference vulnerability in nt!MiOffsetToProtos while parsing a malformed PE file. A denial of service vulnerability exists when Windows improperly handles objects in memory.
Note: This CVE ID is unique from CVE-2019-1346, CVE-2019-1347.
CVSS v2 Base Score:    7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)


ID:        CVE-2019-17503, CVE-2019-17504
Title:    Kirona-DRS Information Disclosure Vulnerability
Vendor:    Kirona
Description: An information disclosure vulnerability exists in Kirona Dynamic Resource Scheduling (DRS). An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly that contains sensitive information about the database through the SQL queries within this batch file. This file exposes SQL database information such as database version, table name, column name, etc.
CVSS v2 Base Score:    5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)


ID:        CVE-2019-11932
Title:    Whatsapp Remote Code Execution Vulnerability
Vendor:    Whatsapp
Description: A double free vulnerability in the DDGifSlurp function in decoding.c in libpl_droidsonroids_gif, as used in WhatsApp for Android, allows remote attackers to execute arbitrary code or cause a denial of service.
CVSS v2 Base Score:    7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)


ID:        CVE-2019-11932
Title:    sudo Security Bypass Vulnerability
Vendor:    Multi-Vendor
Description: When sudo is configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, it is possible to run commands as root by specifying the user ID -1 or 4294967295. This can be used by a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access as long as the ALL keyword is listed first in the Runas specification.
CVSS v2 Base Score:    7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

Details
Date Published
October 22, 2019
Category
Threat Intelligence