CVE-2022-22965 Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware
Tags
country: Singapore
attack-pattern: Data Model Botnet - T1583.005 Botnet - T1584.005 Dns - T1071.004 Dns - T1590.002 Exploits - T1587.004 Exploits - T1588.005 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Web Shell - T1505.003 Vulnerabilities - T1588.006 Web Shell - T1100 Denial Of Service
Show in Graph
Common Information
Type Value
UUID 2c8d1400-4598-45c4-ad77-d132039205f9
Fingerprint 96281d55e936d58b
Analysis status DONE
Considered CTI value 0
Text language
Published April 8, 2022, midnight
Added to db Oct. 15, 2024, 3:18 p.m.
Last updated Dec. 23, 2024, 12:08 p.m.
Headline CVE-2022-22965: Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware
Title CVE-2022-22965 Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware
Detected Hints/Tags/Attributes 63/2/12
Source URLs
Redirection Url
Details Source https://www.trendmicro.com/en_hk/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_ie/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_th/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_dk/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_ph/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_id/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_ae/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_nl/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_be/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_gb/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_no/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_fi/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Details Source https://www.trendmicro.com/en_se/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
URL Provider
Details Provider Source level domain
Details trendmicro.com www.trendmicro.com
Attributes
Details Type #Events CTI Value
Details CVE 99 
cve-2022-22965
Details CVE 54 
cve-2022-22963
Details Domain 147 
java.io
Details Domain 16 
in.read
Details Domain 5 
class.module.classloader.resources.context.parent.pipeline.first.directory
Details Domain 13 
wget.sh
Details File 11 
tomcatwar.jsp
Details File 20 
shell.jsp
Details IPv4 4 
45.95.169.143
Details IPv4 2 
10.10.10.176
Details Url 2 
http://45.95.169.143/the420smokeplace.dns/kkvettgaaasecnn
Details Url 2 
http://45.95.169.143/the420smokeplace.dns/kkvettgaaasecnnaaaa.x86