BadBazaar Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (392)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	290
zh	60
fr	12
es	8
de	8

Country

US: USA	238
CN: China	110
CA: Canada	10
DE: Germany	10
FR: France	8

Actors

BadBazaar	12
Cobalt Strike	7
Sliver	4
pupy	3
Curious Gorge	2

Activities

Interest

Timeline

Type

Not Defined	98
Content Management System	16
Forum Software	10
Operating System	8
Firewall Software	8

Vendor

Not Defined	108
Cisco	14
Google	8
Microsoft	6
Synacor	6

Product

Google Android	6
Postfix	4
Microsoft Windows	4
Synacor Zimbra Collaboration	4
WordPress	4

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Tiki Admin Password tiki-login.php improper authentication	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.91980	0.77	CVE-2020-15906
2	Ignite Realtime Openfire Administration Console improper authentication	7.8	7.7	$0-$5k	$0-$5k	High	Official Fix	0.97070	0.04	CVE-2023-32315
3	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02820	0.34	CVE-2010-0966
4	Devilz Clanportal index.php sql injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00911	0.04	CVE-2006-3347
5	LogicBoard CMS away.php redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	0.29
6	TikiWiki tiki-register.php input validation	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01075	0.27	CVE-2006-6168
7	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.03828	0.00	CVE-2007-1192
8	jforum username User input validation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00318	0.04	CVE-2019-7550
9	DZCP deV!L`z Clanportal browser.php information disclosure	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.04604	0.09	CVE-2007-1167
10	vBulletin redirector.php	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00233	0.02	CVE-2018-6200
11	Synacor Zimbra Collaboration mboximport pathname traversal	4.7	4.5	$0-$5k	$0-$5k	High	Official Fix	0.90217	0.05	CVE-2022-27925
12	Google Chrome WebGPU use after free	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00482	0.00	CVE-2022-2007
13	RoundCube sql injection	8.6	8.5	$0-$5k	$0-$5k	High	Official Fix	0.02018	0.02	CVE-2021-44026
14	Pligg cloud.php sql injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.16
15	Google Chrome Compositing out-of-bounds	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00238	0.03	CVE-2022-2010
16	Google Chrome WebGL out-of-bounds	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00266	0.03	CVE-2022-2008
17	Apple Mac OS X TCP Timestamp information disclosure	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00474	0.00	CVE-2003-0882
18	eSyndicat Directory Software suggest-listing.php cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.26
19	SPIP spip.php cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00193	1.07	CVE-2022-28959
20	MGB OpenSource Guestbook email.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.01434	0.22	CVE-2007-0354

IOC - Indicator of Compromise (16)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	45.63.89.238	45.63.89.238.vultrusercontent.com	BadBazaar	09/20/2023	verified	Medium
2	45.133.238.92		BadBazaar	09/20/2023	verified	High
3	45.154.12.132		BadBazaar	09/20/2023	verified	High
4	45.154.12.151		BadBazaar	09/20/2023	verified	High
5	XX.XXX.XX.XXX		Xxxxxxxxx	09/20/2023	verified	High
6	XX.XXX.XX.XXX	xx-xx.xxxxxxxxxxxxxxx.xxx	Xxxxxxxxx	09/20/2023	verified	High
7	XX.XXX.XXX.XXX		Xxxxxxxxx	09/20/2023	verified	High
8	XX.XXX.XXX.XXX	xx.xxx.xxx.xxx.xxxxxx.xxxx.xxx	Xxxxxxxxx	09/20/2023	verified	High
9	XXX.XX.XXX.XXX		Xxxxxxxxx	09/20/2023	verified	High
10	XXX.XX.XXX.XXX		Xxxxxxxxx	09/20/2023	verified	High
11	XXX.XXX.XX.XXX	xxxxxx.xxx.xx.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxxxxx	09/20/2023	verified	High
12	XXX.XXX.XX.XXX		Xxxxxxxxx	09/20/2023	verified	High
13	XXX.XX.XX.XX		Xxxxxxxxx	09/20/2023	verified	High
14	XXX.XXX.XXX.XX		Xxxxxxxxx	09/20/2023	verified	High
15	XXX.XX.XXX.XXX	xxx-xx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxxxxxxx	08/06/2024	verified	Very High
16	XXX.XXX.XX.XX	xxx.xxx.xx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxx	09/20/2023	verified	Medium

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-21, CWE-22	Path Traversal	predictive	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CAPEC-137	CWE-88, CWE-94	Argument Injection	predictive	High
4	TXXXX.XXX	CAPEC-XXX	CWE-XX, CWE-XX	Xxxxx Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
7	TXXXX	CAPEC-XXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
8	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
9	TXXXX		CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
10	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
11	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
12	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
13	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
14	TXXXX.XXX	CAPEC-XX	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	High
15	TXXXX.XXX	CAPEC-X	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (132)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/ajax/device_entities.php?entity_type=netscalervsvr	predictive	High
2	File	/api/admin/user/list	predictive	High
3	File	/cgi-bin/supervisor/PwdGrp.cgi	predictive	High
4	File	/current_action.php?action=reboot	predictive	High
5	File	/etc/postfix/sender_login	predictive	High
6	File	/file/upload/1	predictive	High
7	File	/filemanager/ajax_calls.php	predictive	High
8	File	/forum/away.php	predictive	High
9	File	/Items/*/RemoteImages/Download	predictive	High
10	File	/login.php	predictive	Medium
11	File	/opt/zimbra/jetty/webapps/zimbra/public	predictive	High
12	File	/secure/QueryComponent!Default.jspa	predictive	High
13	File	/spip.php	predictive	Medium
14	File	actions/CompanyDetailsSave.php	predictive	High
15	File	adclick.php	predictive	Medium
16	File	admin/index.php	predictive	High
17	File	xxxxxx.xxx	predictive	Medium
18	File	xxxxxxx/xxxxxxx/xxxxxx.xxx	predictive	High
19	File	xxxxx.xxx	predictive	Medium
20	File	xxxxxxx_xxx.xxx	predictive	High
21	File	xxxxxx.xxx.xxx	predictive	High
22	File	xxxx_xxxx.xxx	predictive	High
23	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
24	File	xxxx/xxxxxxxx.xxxx.xxxxxxx.xxx	predictive	High
25	File	xxxxxx.xxx	predictive	Medium
26	File	xxx/xxxxxx/xxxxxx/xxxxxxxxxxx/xxx.xxx	predictive	High
27	File	xxxxx.xxx	predictive	Medium
28	File	xxxx/xxxxx.x	predictive	Medium
29	File	xxxx.xxx	predictive	Medium
30	File	xxxxxxx_x.x	predictive	Medium
31	File	xxxx/xxxx.xx	predictive	Medium
32	File	xxxxxxxxx.xxx.xxx	predictive	High
33	File	xx_xxx_xx.x	predictive	Medium
34	File	xxxx.xxx	predictive	Medium
35	File	xxxxxxxxx.xxx	predictive	High
36	File	xxxxxxxxxx.xxxx	predictive	High
37	File	xxx/xxxxxx.xxx	predictive	High
38	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	High
39	File	xxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxx	predictive	High
40	File	xxxxx.xxx	predictive	Medium
41	File	xxxxxxxxxx.xxx	predictive	High
42	File	xxxxxxxxxx/xxx/xxxxxx_xxxx.xxx	predictive	High
43	File	xxxxxxxx_xxxxxxx.xxxxx.xxx	predictive	High
44	File	xxxxxxx/xxx_xxxxx.x	predictive	High
45	File	xxxxxxxx.x	predictive	Medium
46	File	xxxxx.xxxx	predictive	Medium
47	File	xxxxx_xx.xxxx	predictive	High
48	File	xxxxxxx/xxx.xxx	predictive	High
49	File	xxx/xxxx/xx_xxxxxxxx.x	predictive	High
50	File	xxxxx.x	predictive	Low
51	File	xxxxxxxx.xxx	predictive	Medium
52	File	xxxxxx.x	predictive	Medium
53	File	xxxxxxxxx_xxxxx.xxxxx.xxx	predictive	High
54	File	xxxxxxxxx/xxxxxxxxxxxx	predictive	High
55	File	xxxxxxx/xxxxxxxxxxxxxxxx/xxxxxxxxx/xxxxxxxx.xxxx	predictive	High
56	File	xxxxxxxx.xx	predictive	Medium
57	File	xxxx.xxx	predictive	Medium
58	File	xxxxxxx_xxxxxxx.xxx	predictive	High
59	File	xxxx.xxx	predictive	Medium
60	File	xxxxx.xxx	predictive	Medium
61	File	xxxxx.xxx	predictive	Medium
62	File	xxxxxxxxxx.xxx	predictive	High
63	File	xxxxxxxx.xxx	predictive	Medium
64	File	xxxxxxxx.xxx	predictive	Medium
65	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	High
66	File	xxxxxxxx_xxxx.xxx	predictive	High
67	File	xxxxxxxx_xxxxxxxxx.xxx	predictive	High
68	File	xxxxxxx-xxxxxxxx.xxx	predictive	High
69	File	xxxxxxx-xxxxxxx.xxx	predictive	High
70	File	xxxx-xxxx_xxxx_xxxxxxx.xxx	predictive	High
71	File	xxxx-xxxxx.xxx	predictive	High
72	File	xxxx-xxxxxxxx.xxx	predictive	High
73	File	xxxxx_xxxxx.xxx	predictive	High
74	File	xxxxxx_xxxxxxxx.xxx	predictive	High
75	File	xxxxx.xxxx	predictive	Medium
76	File	xxxx.xxx	predictive	Medium
77	File	xxxxxxx.xxx	predictive	Medium
78	File	xxxxxxx.xxx	predictive	Medium
79	File	xx-xxxxx-xxxxxx.xxx	predictive	High
80	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	High
81	File	xx-xxxxxxxx/xxxx.xxx	predictive	High
82	Library	xxx.xxx	predictive	Low
83	Argument	xxxxxx	predictive	Low
84	Argument	xxxxxxxx	predictive	Medium
85	Argument	xxxxx_xxxx	predictive	Medium
86	Argument	xxx	predictive	Low
87	Argument	xxxxxxxxxx	predictive	Medium
88	Argument	xxx	predictive	Low
89	Argument	xxxx	predictive	Low
90	Argument	xxxxxx_xx[]	predictive	Medium
91	Argument	xxx	predictive	Low
92	Argument	xxxxxxxxxxxxxxxxx	predictive	High
93	Argument	xxx	predictive	Low
94	Argument	xxxxx	predictive	Low
95	Argument	xxxxxxx[]	predictive	Medium
96	Argument	xxxxx	predictive	Low
97	Argument	xxxx	predictive	Low
98	Argument	xxxxxxxx	predictive	Medium
99	Argument	xxxxxxxxxxxx	predictive	Medium
100	Argument	xx	predictive	Low
101	Argument	xxxx	predictive	Low
102	Argument	xxxx_xxxxx	predictive	Medium
103	Argument	xx	predictive	Low
104	Argument	xxxxxxxx	predictive	Medium
105	Argument	xxxxxxx_xxxx	predictive	Medium
106	Argument	xxxxx	predictive	Low
107	Argument	xxxxx_xxx	predictive	Medium
108	Argument	xxxxxxxxx	predictive	Medium
109	Argument	xxxxx_xxxxxx_xxx/xxxxx_xxxx_xxxxxxxx	predictive	High
110	Argument	xxxxxxxx	predictive	Medium
111	Argument	xxxxxxxx	predictive	Medium
112	Argument	xxxx_xxxxxx	predictive	Medium
113	Argument	xxxxxx	predictive	Low
114	Argument	xx	predictive	Low
115	Argument	xxxxxxxx	predictive	Medium
116	Argument	xxxxxx_xxxx	predictive	Medium
117	Argument	xxxxxxxxx	predictive	Medium
118	Argument	xxxxxx/xxxxxx_xxxxxx	predictive	High
119	Argument	xxxx_xxxxx	predictive	Medium
120	Argument	xxxxxxxxx_xxxxxx_xxx	predictive	High
121	Argument	xxxxx_xxxx	predictive	Medium
122	Argument	xxxxxxxxxxxx	predictive	Medium
123	Argument	xxx	predictive	Low
124	Argument	xxxxx	predictive	Low
125	Argument	xxxx	predictive	Low
126	Argument	xxx	predictive	Low
127	Argument	\xxxxxx\	predictive	Medium
128	Input Value	%xxxxxx+-x+x+xx.x.xx.xxx%xx%xx	predictive	High
129	Input Value	..	predictive	Low
130	Input Value	xxxx://xxx.xxxxxx.xxx	predictive	High
131	Input Value	\xxx\xxx	predictive	Medium
132	Network Port	xxx/xxx (xxxx)	predictive	High

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!