CVE-2022-22965 Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware
Tags
country: Singapore
attack-pattern: Data Model Botnet - T1583.005 Botnet - T1584.005 Dns - T1071.004 Dns - T1590.002 Exploits - T1587.004 Exploits - T1588.005 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Web Shell - T1505.003 Vulnerabilities - T1588.006 Web Shell - T1100 Denial Of Service
Show in Graph
Common Information
Type Value
UUID 0465956a-cbdd-4032-8fc1-244ef9185033
Fingerprint 96281d15ed12d58b
Analysis status DONE
Considered CTI value 0
Text language
Published April 8, 2022, midnight
Added to db Oct. 15, 2024, 3:57 p.m.
Last updated Dec. 23, 2024, 12:08 p.m.
Headline CVE-2022-22965: Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware
Title CVE-2022-22965 Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware
Detected Hints/Tags/Attributes 62/2/13
Source URLs
Redirection Url
Details Source https://www.trendmicro.com/en_my/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_au/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_nz/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_in/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_sg/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
URL Provider
Details Provider Source level domain
Details trendmicro.com www.trendmicro.com
Attributes
Details Type #Events CTI Value
Details Domain 13 
wget.sh
Details File 11 
tomcatwar.jsp
Details File 1 
is.jsp
Details File 20 
shell.jsp
Details IPv4 4 
45.95.169.143
Details IPv4 2 
10.10.10.176
Details Url 2 
http://45.95.169.143/the420smokeplace.dns/kkvettgaaasecnn
Details Url 2 
http://45.95.169.143/the420smokeplace.dns/kkvettgaaasecnnaaaa.x86
Details CVE 99 
cve-2022-22965
Details CVE 54 
cve-2022-22963
Details Domain 147 
java.io
Details Domain 16 
in.read
Details Domain 5 
class.module.classloader.resources.context.parent.pipeline.first.directory