Butterfly 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (413)

言語

en	356
de	28
es	14
fr	8
jp	4

国・地域

nl	232
us	112
de	22
gb	8
se	8

アクター

Butterfly	4
Charming Kitten	1
Mylobot	1
Dorkbot	1
APT28	1

関心

タイプ

Not Defined	118
Content Management System	40
Web Server	28
Operating System	20
WordPress Plugin	12

ベンダー

Not Defined	156
Microsoft	40
Apache	22
QNAP	8
Cisco	6

製品

WordPress	18
Apache HTTP Server	16
Microsoft Windows	14
Microsoft IIS	10
OpenSSL	8

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	nginx 特権昇格	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	1.78	CVE-2020-12440
2	Microsoft IIS クロスサイトスクリプティング	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.07	CVE-2017-0055
3	MGB OpenSource Guestbook email.php SQLインジェクション	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.01302	1.06	CVE-2007-0354
4	Vunet VU Web Visitor Analyst redir.asp SQLインジェクション	7.3	7.1	$0-$5k	$0-$5k	High	Workaround	0.00119	0.03	CVE-2010-2338
5	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	6.14
6	Microsoft IIS IP/Domain Restriction 特権昇格	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00817	0.06	CVE-2014-4078
7	Apache HTTP Server mod_rewrite Redirect	6.7	6.7	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00258	0.13	CVE-2020-1927
8	MidiCart PHP Shopping Cart item_show.php SQLインジェクション	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
9	ProFTPD mod_sftp/mod_sftp_pam kbdint.c resp_count サービス拒否	7.5	7.1	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.01980	0.05	CVE-2013-4359
10	MikroTik RouterOS SMB メモリ破損	8.5	8.4	$0-$5k	$0-$5k	High	Official Fix	0.88065	0.05	CVE-2018-7445
11	DZCP deV!L`z Clanportal config.php 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.12	CVE-2010-0966
12	nginx HTTP/2 サービス拒否	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02542	0.04	CVE-2018-16844
13	Hospital Management System search.php SQLインジェクション	7.6	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00140	0.00	CVE-2022-48120
14	CKFinder File Name 特権昇格	7.4	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00155	0.04	CVE-2019-15862
15	sitepress-multilingual-cms Plugin class-wp-installer.php 未知の脆弱性	6.5	6.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00579	0.04	CVE-2020-10568
16	WordPress SQLインジェクション	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00467	0.00	CVE-2022-21664
17	Apache Tomcat JSP File 特権昇格	7.7	7.5	$5k-$25k	$0-$5k	High	Official Fix	0.97501	0.07	CVE-2017-12617
18	Apache Tomcat CORS Filter Cache Poisoning 弱い認証	5.8	5.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00276	0.04	CVE-2017-7674
19	Omron PLC CS/PLC CJ/PLC NJ Brute Force 情報の漏洩	6.7	6.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00213	0.04	CVE-2019-18261
20	Pegasus Imaging ImagXpress ActiveX Control pegasusimaging.activex.thumnailxpress1.dll compactfile ディレクトリトラバーサル	4.8	4.6	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.83035	0.00	CVE-2007-5320

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	Identified	タイプ	信頼度
1	46.165.237.75		Butterfly	2020年12月24日	verified	高
2	XX.XXX.XXX.XXX	xxxxxx.xxxxxxxxxx.xxx	Xxxxxxxxx	2020年12月24日	verified	高
3	XXX.XXX.XXX.X		Xxxxxxxxx	2020年12月24日	verified	高
4	XXX.XX.X.XXX	xxx-xx-x-xxx.xxxxxx-xx-xxxxxxxxxxx.xxx	Xxxxxxxxx	2020年12月24日	verified	高

TTP - Tactics, Techniques, Procedures (20)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	クラス	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	高
2	T1040	CAPEC-102	CWE-319	Authentication Bypass by Capture-replay	predictive	高
3	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	高
4	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	高
5	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	高
6	TXXXX	CAPEC-104	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
7	TXXXX.XXX	CAPEC-16	CWE-XXX, CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	高
8	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
9	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
10	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	高
11	TXXXX	CAPEC-	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	高
12	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	高
13	TXXXX	CAPEC-50	CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
14	TXXXX.XXX	CAPEC-120	CWE-XXX	Xxxxxxx Xxxxxxxxxx Xxx Xxxxxxxx Xxxxxxx Xx Xx-xxxx Xxxxxx Xxxxxxxx	predictive	高
15	TXXXX	CAPEC-38	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	高
16	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
17	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	高
18	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
19	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	高
20	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高

IOA - Indicator of Attack (183)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	/admin/broadcast.php	predictive	高
2	File	/admin/sysmon.php	predictive	高
3	File	/cgi-bin/webviewer_login_page	predictive	高
4	File	/ecrire	predictive	低
5	File	/forum/away.php	predictive	高
6	File	/getcfg.php	predictive	中
7	File	/MicroStrategyWS/happyaxis.jsp	predictive	高
8	File	/owa/auth/logon.aspx	predictive	高
9	File	/proc/ioports	predictive	高
10	File	/search.php	predictive	中
11	File	/services/details.asp	predictive	高
12	File	/tmp	predictive	低
13	File	/uncpath/	predictive	中
14	File	/Upload.ashx	predictive	中
15	File	/usr/sbin/suexec	predictive	高
16	File	/var/tmp/sess_*	predictive	高
17	File	14all.cgi/14all-1.1.cgi/traffic.cgi/mrtg.cgi	predictive	高
18	File	activateuser.aspx	predictive	高
19	File	adclick.php	predictive	中
20	File	admin/killsource	predictive	高
21	File	admin/orion.extfeedbackform_efbf_forms.php	predictive	高
22	File	xxxx-xxxx.x	predictive	中
23	File	xxx/xxx/xxxxxxx.x	predictive	高
24	File	xxxxx.xxx	predictive	中
25	File	xxxx.xxx	predictive	中
26	File	xxxxxxxxxx.xxx	predictive	高
27	File	xxxxxx.xxx	predictive	中
28	File	xxxxxx/xxxx/x_xxx.x	predictive	高
29	File	xxxx/xxxxxxx/xxxxxxxx	predictive	高
30	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	高
31	File	xxxxxxx.xxx	predictive	中
32	File	xxxxxxxxx.xxx	predictive	高
33	File	xxxxxxxx.xxx	predictive	中
34	File	xxx/xxx/xxxxx	predictive	高
35	File	xxxxx.xxx	predictive	中
36	File	xxxx.xxx	predictive	中
37	File	xxx/xxxx/xxx/xxxxx_xxxx.x	predictive	高
38	File	xxxxxxx.xxx	predictive	中
39	File	xxx_xxxx.x	predictive	中
40	File	xxxxxxxxx/xxxxx/xxxxxxxxxxxx/xxxxxxxxx.xxx	predictive	高
41	File	xx/xxxxx/xxxxxx.x	predictive	高
42	File	xxx/xxxxxxxx.xxx	predictive	高
43	File	xxx/xxxxxx.xxx	predictive	高
44	File	xxxxxxx/xxxxx/xxx_xxxx.x	predictive	高
45	File	xxxxxxxx/xxxxx-xx-xxxxxxxxx.xxx	predictive	高
46	File	xxxxx.xxx	predictive	中
47	File	xxxxxxxxx/xxxxx/xxx_xxx/xxxx.xxx	predictive	高
48	File	xxxxx.xxxxxxx.xxx	predictive	高
49	File	xxxx_xxxx.xxx	predictive	高
50	File	xxxxxxxx/xxxxxxxxx	predictive	高
51	File	xxx?xxxx.xxx	predictive	中
52	File	xxxxxx.x	predictive	中
53	File	xxxxxx-xxx.xx	predictive	高
54	File	xxxxx.xxx	predictive	中
55	File	xxxxx.xxx	predictive	中
56	File	xxxxxxxx.xxx	predictive	中
57	File	xxx_xxx_xxxxxx.x	predictive	高
58	File	xxx_xxxxx_xxxx.x	predictive	高
59	File	xxxxxx	predictive	低
60	File	xxxxxxxx_xxxxxx.xxx	predictive	高
61	File	xxx/xxxxxxxxx/xx_xxxxxx_xxx.x	predictive	高
62	File	xxxxxxxx.xxx	predictive	中
63	File	xxx.xxx	predictive	低
64	File	xxxxxxx.xxx	predictive	中
65	File	xxxxx.xxx	predictive	中
66	File	xxxxxxxxxx.xxx	predictive	高
67	File	xxx_xxxxxx/xxxxxx/xxxxxxxxxxxx	predictive	高
68	File	xxxxxxx.xxx	predictive	中
69	File	xxxxx.xxx	predictive	中
70	File	xxxxxxxxxx.xxx	predictive	高
71	File	xxxx.xxx	predictive	中
72	File	xxx.x	predictive	低
73	File	xxxxxxxx/xxxxxxxx/xxxxx.xxx	predictive	高
74	File	xxxxxxxx.xxx	predictive	中
75	File	xxxx-xxxxxx.x	predictive	高
76	File	xxxx.xxx	predictive	中
77	File	xxxx_xxxxxxx_xxxxxxxx.xxx	predictive	高
78	File	xxxxxxxxxxxxxxxxxxxx.xxx	predictive	高
79	File	xxxxx-xxxx.xxx	predictive	高
80	File	xxxxxxxxxxxxxxx.xxx	predictive	高
81	File	xxxxxxxxx.xxx	predictive	高
82	File	xx.xxx	predictive	低
83	File	xxxxxx.xxx	predictive	中
84	File	xxxxxxxx.xxx	predictive	中
85	File	xxxx/xxxxxxxxx.x	predictive	高
86	File	xxx/xxx/xxx-xxx/xxxx.xxx	predictive	高
87	File	xxxxxxxxxxxxxxxxx.xxx	predictive	高
88	File	xxxx-xxx-xxxxx-xxxxx.xxx	predictive	高
89	File	xxxx.xxx	predictive	中
90	File	xxxxxxxxx-xxx	predictive	高
91	File	xxxxxx/xxxxxxxxxxxxx.xxx	predictive	高
92	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	高
93	File	xx-xxxxx/xxxxxxx-xxxxxxx.xxx?xxxx=xxxxxxxxxx-x	predictive	高
94	File	xx-xxxxxxx/xxxxxxx	predictive	高
95	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	高
96	File	xxxxxxxxx.xxx	predictive	高
97	File	xxxxxx.xxx	predictive	中
98	File	xxxx/xxxx_xxx_xxxxxx.x	predictive	高
99	File	_xxxxxx.xxx	predictive	中
100	Library	xxxxxxxx.xxx	predictive	中
101	Library	xxxxxxxxxxxx/xxxx/xxxxxxxxxx.xxx	predictive	高
102	Library	xxx/xxxxxxx-xxxxxxxxx-x.x.x.xxx	predictive	高
103	Library	xxxxxxx/xxx/xxxxxxxxxxxx.xxx	predictive	高
104	Library	xxxxxxxxxxxxxx.xxxxxxx.xxxxxxxxxxxxxxx.xxx	predictive	高
105	Library	xxxxxxx.xxx	predictive	中
106	Argument	-x	predictive	低
107	Argument	xxx_xxxx	predictive	中
108	Argument	xxxxxxxxxxx	predictive	中
109	Argument	xxxxxxxxxxxxxx	predictive	高
110	Argument	xxxxxxxx	predictive	中
111	Argument	xxxxxx	predictive	低
112	Argument	xxx	predictive	低
113	Argument	xxx_xx	predictive	低
114	Argument	xxxxxxx	predictive	低
115	Argument	xxx	predictive	低
116	Argument	xxx	predictive	低
117	Argument	xxxx_xx	predictive	低
118	Argument	xxxxxxx/xxxxxx	predictive	高
119	Argument	xxxxxxx_xxxx->xxx($xxxxxxxx)	predictive	高
120	Argument	xxxxx	predictive	低
121	Argument	xxxxxxxxxx	predictive	中
122	Argument	xxxxxx	predictive	低
123	Argument	xxxx	predictive	低
124	Argument	xxxxx_xxx	predictive	中
125	Argument	xxxxxx	predictive	低
126	Argument	xxxxxxxxx->xxxxxxxxx	predictive	高
127	Argument	xxxx	predictive	低
128	Argument	xxxxxxxxx	predictive	中
129	Argument	xxxx	predictive	低
130	Argument	xx	predictive	低
131	Argument	xxxxxxx	predictive	低
132	Argument	xxxxxx	predictive	低
133	Argument	xxxx_xx	predictive	低
134	Argument	xxxx_xxxxxx_xxxxx/xxxx_xxxxxx_xxxx_xxxxxx	predictive	高
135	Argument	xxxx_xxxx/xxxxx	predictive	高
136	Argument	xxxxx	predictive	低
137	Argument	xxx	predictive	低
138	Argument	xx[xxxx]	predictive	中
139	Argument	xxxx	predictive	低
140	Argument	xx	predictive	低
141	Argument	xxxxx/xx	predictive	中
142	Argument	xxxxx/xxxxxx	predictive	中
143	Argument	xxxxxxx	predictive	低
144	Argument	xxxx	predictive	低
145	Argument	xxxxxxxx	predictive	中
146	Argument	xxxxxxxx	predictive	中
147	Argument	xxxxxx	predictive	低
148	Argument	xxxx	predictive	低
149	Argument	xxxx	predictive	低
150	Argument	xxxxxx	predictive	低
151	Argument	xxxxxx	predictive	低
152	Argument	xxxxxxxx	predictive	中
153	Argument	xxxxxxx_xx	predictive	中
154	Argument	xxxxxx	predictive	低
155	Argument	xxx	predictive	低
156	Argument	xx	predictive	低
157	Argument	xxxxxxxxx	predictive	中
158	Argument	xxxxxxxxx	predictive	中
159	Argument	xxxx	predictive	低
160	Argument	xxxx_xx	predictive	低
161	Argument	xxx	predictive	低
162	Argument	xxxxxxxx	predictive	中
163	Argument	xxxxxxxx/xxxxxxxx	predictive	高
164	Argument	x-xxxxxxxxx-xxx	predictive	高
165	Argument	x-xxxxxxxxx-xxxx	predictive	高
166	Input Value	%xxx%xxxxxxxxx%xxxxxxx(x)>%xx	predictive	高
167	Input Value	.%xx.../.%xx.../	predictive	高
168	Input Value	..\..\xxx.xxxxxx	predictive	高
169	Input Value	/xxxx.xxx	predictive	中
170	Input Value	xxxx	predictive	低
171	Input Value	</xxxxxx><xxxxxx>xxxxx(x)</xxxxxx>	predictive	高
172	Input Value	xxxxx	predictive	低
173	Input Value	xxxx -x xxxxxxxx=xxxxxx.xxxxxxx xxxx://xxx.xxx.x.x/xxxxxx.xxx	predictive	高
174	Input Value	xxxxxxxxx' xxx 'x'='x	predictive	高
175	Input Value	xxx?xxxx.xxx	predictive	中
176	Input Value	xxxx:xxxxxx	predictive	中
177	Input Value	\x	predictive	低
178	Pattern	xxxxxxx-xxxxxxxxxxx\|xx\| xxxx-xxxx	predictive	高
179	Network Port	xx xxxxxxx xxx.xx.xx.xx	predictive	高
180	Network Port	xxxx xxxx	predictive	中
181	Network Port	xxx/xx (xxx)	predictive	中
182	Network Port	xxx/xxxx	predictive	中
183	Network Port	xxx xxxxxx xxxx	predictive	高

参考 (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Do you need the next level of professionalism?

Upgrade your account now!