DarkIRC botnet is targeting the critical Oracle WebLogic CVE-2020-14882
Tags
country: China Iran United States Of America
attack-pattern: Botnet - T1583.005 Botnet - T1584.005 Keylogging - T1056.001 Keylogging - T1417.001 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Powershell - T1086
Show in Graph
Common Information
Type Value
UUID a694d6ca-2629-4410-b69b-e206069e1d18
Fingerprint 37a9b09dadd3f16d
Analysis status DONE
Considered CTI value 0
Text language
Published Dec. 1, 2020, 6:41 p.m.
Added to db Jan. 18, 2023, 10:25 p.m.
Last updated Nov. 11, 2024, 8:23 a.m.
Headline DarkIRC botnet is targeting the critical Oracle WebLogic CVE-2020-14882
Title DarkIRC botnet is targeting the critical Oracle WebLogic CVE-2020-14882
Detected Hints/Tags/Attributes 37/2/8
Source URLs
Redirection Url
Details Source https://securityaffairs.co/wordpress/111743/hacking/darkirc-oracle-weblogic-cve-2020-14882.html
URL Provider
Details Provider Source level domain
Details securityaffairs.co securityaffairs.co
Attributes
Details Type #Events CTI Value
Details CVE 68 
cve-2020-14882
Details Domain 1 
cnc.c25e6559668942.xyz
Details File 2 
%appdata%\chrome\chrome.exe
Details IPv4 40 
10.3.6.0
Details IPv4 39 
12.1.3.0
Details IPv4 60 
12.2.1.3
Details IPv4 70 
12.2.1.4
Details IPv4 58 
14.1.1.0