Chafer Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (357)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Language

en	308
es	18
fr	8
zh	6
ru	6

Country

US: USA	194
RU: Russia	32
CN: China	22
ES: Spain	20
GB: Great Britain	18

Actors

Chafer	5
APT39	2
MyKings	1
Cobalt Strike	1
MechaFlounder	1

Activities

Interest

Timeline

Type

Not Defined	112
Content Management System	36
WordPress Plugin	16
Operating System	16
Web Server	16

Vendor

Not Defined	138
Microsoft	18
D-Link	12
Apache	12
Google	10

Product

WordPress	14
Microsoft Windows	8
Google Chrome	8
PHP	6
BigBlueButton	6

Vulnerabilities

These are the vulnerabilities that we have identified as researched, approached, or attacked.

#	Vulnerability	Base	Temp	0day	Today	Exp	Cou	KEV	EPSS	CTI	CVE
1	nginx request smuggling	6.9	6.9	$0-$5k	$0-$5k	Not defined	Not defined		0.00000	1.50	CVE-2020-12440
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	possible	0.02956	0.00	CVE-2007-1192
3	Microsoft IIS uncpath cross site scripting	5.2	5.0	$5k-$25k	$0-$5k	Proof-of-Concept	Official fix		0.01387	0.00	CVE-2017-0055
4	VMware vRealize Orchestrator Path redirect	3.0	2.9	$5k-$25k	$0-$5k	Not defined	Official fix		0.00582	0.00	CVE-2021-22036
5	vm2 injection	9.9	9.7	$0-$5k	$0-$5k	Not defined	Official fix	possible	0.50996	0.03	CVE-2023-32314
6	OpenSSH Authentication Username information disclosure	5.3	4.8	$5k-$25k	$0-$5k	High	Official fix	expected	0.92487	0.56	CVE-2016-6210
7	PHPMailer Phar Deserialization addAttachment deserialization	5.5	5.3	$0-$5k	$0-$5k	Not defined	Official fix		0.01150	0.00	CVE-2020-36326
8	jQuery Property extend Pollution cross site scripting	6.6	6.3	$0-$5k	$0-$5k	Proof-of-Concept	Official fix		0.02022	0.37	CVE-2019-11358
9	Rust Programming Language Standard Library type_id memory corruption	7.7	7.5	$0-$5k	$0-$5k	Not defined	Official fix		0.00997	0.00	CVE-2019-12083
10	PHP ldap_escape out-of-bounds write	9.8	9.6	$25k-$100k	$5k-$25k	Not defined	Official fix		0.00180	0.00	CVE-2024-11236
11	phpMyAdmin grab_globals.lib.php path traversal	4.8	4.4	$5k-$25k	$0-$5k	Proof-of-Concept	Official fix		0.05909	0.00	CVE-2005-3299
12	WordPress sql injection	6.8	6.7	$5k-$25k	$0-$5k	Not defined	Official fix		0.06748	0.00	CVE-2022-21664
13	Apple iOS WebKit buffer overflow	8.0	7.9	$25k-$100k	$5k-$25k	High	Official fix	verified	0.00901	0.00	CVE-2021-30666
14	WordPress path traversal	5.7	5.6	$5k-$25k	$0-$5k	Not defined	Official fix	expected	0.85513	0.00	CVE-2023-2745
15	Canon IJ Network Tool Wi-Fi Connection Setup missing password field masking	5.4	5.4	$0-$5k	$0-$5k	Not defined	Not defined		0.00035	0.00	CVE-2023-1763
16	ciubotaru share-on-diaspora new_window.php cross site scripting	4.4	4.3	$0-$5k	$0-$5k	Not defined	Official fix		0.00070	0.09	CVE-2017-20176
17	Postfix Admin functions.inc.php sql injection	7.3	7.0	$5k-$25k	$0-$5k	High	Official fix		0.00515	0.00	CVE-2014-2655
18	D-Link DCS-2530L/DCS-2670L ddns_enc.cgi command injection	7.5	7.5	$5k-$25k	$5k-$25k	Not defined	Not defined		0.18257	0.02	CVE-2020-25079
19	Microsoft IIS IP/Domain Restriction access control	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official fix		0.09610	0.65	CVE-2014-4078
20	SourceCodester Library Management System bookdetails.php sql injection	7.1	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not defined		0.00072	0.00	CVE-2022-2214

Campaigns (2)

These are the campaigns that can be associated with the actor:

Chafer
Xxxxxx

IOC - Indicator of Compromise (11)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	83.142.230.113		Chafer		12/22/2020	verified	Low
2	89.38.97.112	89-38-97-112.hosted-by-worldstream.net	Chafer		12/22/2020	verified	Very Low
3	89.38.97.115	89-38-97-115.hosted-by-worldstream.net	Chafer		12/22/2020	verified	Very Low
4	XX.XXX.XXX.XXX		Xxxxxx		12/22/2020	verified	Low
5	XX.XXX.XX.XXX	xx-xxx-xx-xxx.xxxxxx.xxxx.xx	Xxxxxx		12/22/2020	verified	Low
6	XXX.XX.XXX.XXX	xxx.xx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxx	Xxxxxx	03/27/2022	verified	Very Low
7	XXX.XXX.XXX.XX		Xxxxxx		12/22/2020	verified	Low
8	XXX.XXX.XXX.XX		Xxxxx	Xxxxxx	12/12/2020	verified	Low
9	XXX.XXX.XXX.XXX	xxx-xx.xxxxxx.xx	Xxxxxx		12/22/2020	verified	Very Low
10	XXX.XX.XXX.XX	xxx.xxxxxxxxxxxxxxx.xxxx	Xxxxxx		12/22/2020	verified	Low
11	XXX.XXX.XX.XX		Xxxxx	Xxxxxx	12/12/2020	verified	Low

TTP - Tactics, Techniques, Procedures (19)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-21, CWE-22	Path Traversal	predictive	High
2	T1040	CAPEC-102	CWE-294, CWE-319	Authentication Bypass by Capture-replay	predictive	High
3	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
4	T1059	CAPEC-242	CWE-94, CWE-1321	Argument Injection	predictive	High
5	TXXXX.XXX	CAPEC-XXX	CWE-XX, CWE-XX	Xxxxx Xxxxx Xxxx Xxxxxxxxx	predictive	High
6	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
7	TXXXX.XXX	CAPEC-XX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
8	TXXXX	CAPEC-XXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
9	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
10	TXXXX		CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
11	TXXXX		CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
12	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
13	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
14	TXXXX	CAPEC-XX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
15	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
16	TXXXX.XXX		CWE-XX	Xxxxxxxxxxxxx	predictive	High
17	TXXXX		CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
18	TXXXX.XXX	CAPEC-X	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High
19	TXXXX		CWE-XXX	Xxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (147)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	//etc/RT2870STA.dat	predictive	High
2	File	/admin/index.php?id=themes&action=edit_template&filename=blog	predictive	High
3	File	/api/login	predictive	Medium
4	File	/appConfig/userDB.json	predictive	High
5	File	/bin/boa	predictive	Medium
6	File	/cgi-bin/wapopen	predictive	High
7	File	/cgi-bin/widget_api.cgi	predictive	High
8	File	/CPE	predictive	Low
9	File	/cwp_{SESSION_HASH}/admin/loader_ajax.php	predictive	High
10	File	/jquery_file_upload/server/php/index.php	predictive	High
11	File	/librarian/bookdetails.php	predictive	High
12	File	/magnoliaPublic/travel/members/login.html	predictive	High
13	File	/Main_AdmStatus_Content.asp	predictive	High
14	File	/public/login.htm	predictive	High
15	File	/requests.php	predictive	High
16	File	/self.key	predictive	Medium
17	File	/xxxxxxx/	predictive	Medium
18	File	/xxx/xxx/xxxxx	predictive	High
19	File	/xxxxxxxx/xxxx_xxxxx.xxx	predictive	High
20	File	xxxxxxx.xxx	predictive	Medium
21	File	xxxxx.xxx	predictive	Medium
22	File	xxxxx/xxxx_xxxxx_xxxx.xxx	predictive	High
23	File	xxxxxxxxxxxxx/xxxxxxxxxx/xxx_xxxxx/xxxxxxx/xxxxx.xxx	predictive	High
24	File	xxxxxxxxxx.xxx	predictive	High
25	File	xxxxxxxxxxx.xxx	predictive	High
26	File	xx_xxxxxxxxxx.xxx	predictive	High
27	File	xxx:.xxx	predictive	Medium
28	File	xxx/xxx.xxx	predictive	Medium
29	File	xxxxxxx.xxx	predictive	Medium
30	File	xxxxxx_xxxxxx.xxx	predictive	High
31	File	xxxxxxxx.xxx	predictive	Medium
32	File	xxx-xxx/xxxx_xxx.xxx	predictive	High
33	File	xxxxxx.xxx	predictive	Medium
34	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
35	File	xxxxxx.xxx	predictive	Medium
36	File	xxx.xxx	predictive	Low
37	File	xxxxx.xxx	predictive	Medium
38	File	xxx/xxxxxxxx/xxx_xxxxxxxxxxxx.xx	predictive	High
39	File	xxxx_xxxxxx.xxx	predictive	High
40	File	xxxxxxxxx.xxx.xxx	predictive	High
41	File	xxxxxxxxxxxx_xxxx.xxx	predictive	High
42	File	xxx_xxxxxx.xxx	predictive	High
43	File	xxxx_xxxxxxx.xxx.xxx	predictive	High
44	File	xxxx_xxxx.x	predictive	Medium
45	File	xxxxxxxxx.xxx	predictive	High
46	File	xxxxxxxx/xxxxx.xxxx-xxx.xxx	predictive	High
47	File	xxxxx.xxx	predictive	Medium
48	File	xxxxxx.x	predictive	Medium
49	File	xxxxxxxx-xxxxxxx.xxx	predictive	High
50	File	xxxx/xxx_xxx.x	predictive	High
51	File	xxxxxxxx.xxx	predictive	Medium
52	File	xxxxxxx/xxxxxxx/xxx_xxxxxxx.x	predictive	High
53	File	xxx_xxxxxx.xx	predictive	High
54	File	xxxx/xxxx/xxxxx.xxx	predictive	High
55	File	xxx_xxxxxx.xxx	predictive	High
56	File	xxxxxx.xxx	predictive	Medium
57	File	xxxxxxxxxxxxxx.xxx	predictive	High
58	File	xxxxxxx.xxx	predictive	Medium
59	File	xxxxx.xxxxx.xxx	predictive	High
60	File	xxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]	predictive	High
61	File	xxxx/xxxxx	predictive	Medium
62	File	xxxxx.xxx	predictive	Medium
63	File	xxxxxxxx.xxx	predictive	Medium
64	File	xxxxxxxxxx.xxx	predictive	High
65	File	xxxxxxxx_xxxx.xxx	predictive	High
66	File	xxxxxxxx.xxx?x=xxxxxx&x=xxxxxxxxxx	predictive	High
67	File	xxxxxxx.x	predictive	Medium
68	File	xxxxxx.xxx	predictive	Medium
69	File	xxxx.xxx	predictive	Medium
70	File	xxxxx/xxx/xxxx.x	predictive	High
71	File	xxxxxx_xxx_xxxxx_xxx.xxx	predictive	High
72	File	xxxxxx.x	predictive	Medium
73	File	xxx_xxx_xxxxx.xxx	predictive	High
74	File	xxxx/xxxxxxxxxxxxxxx.xxxxxx	predictive	High
75	File	xxxxxxx_xxxxx.xxx	predictive	High
76	File	xxxxxxx_xxxxxxxxxx.xxx	predictive	High
77	File	xxx.xxx	predictive	Low
78	File	xxxxxx.xxx	predictive	Medium
79	File	xxxxxxx.xxx	predictive	Medium
80	File	xxxxxx.xxx	predictive	Medium
81	File	xxxxx.xxx	predictive	Medium
82	File	xxxxxxxxxxxxxx.xxx	predictive	High
83	File	xxxxxxx.xxx	predictive	Medium
84	File	xx-xxxxx/xxxx-xxx.xxx	predictive	High
85	File	xx-xxxxxxxx-xxxx.xxx	predictive	High
86	File	xx-xxxxxxx/xxxxxxx/xxxx-xx-xxxx/	predictive	High
87	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	High
88	File	xx-xxxxxxxx/xxxxx-xx-xxxxxx-xxxxxx.xxx	predictive	High
89	File	xx-xxxxxxxxxxx.xxx	predictive	High
90	Library	xxxxxxx/xxx/xxxxxx.xxx.xxx	predictive	High
91	Library	xxxxxx.xxx	predictive	Medium
92	Argument	$xxxxx_xxxxxxxxxx	predictive	High
93	Argument	xxxxxxx	predictive	Low
94	Argument	xxxxx	predictive	Low
95	Argument	xxxxxx	predictive	Low
96	Argument	xxx	predictive	Low
97	Argument	xxxxx	predictive	Low
98	Argument	xxxxxxxxxxxxxxx	predictive	High
99	Argument	xxxx/xxxx	predictive	Medium
100	Argument	xxxxxxxx	predictive	Medium
101	Argument	xxxx	predictive	Low
102	Argument	xxxxxxxxxx	predictive	Medium
103	Argument	xxxx	predictive	Low
104	Argument	xxxxxxxxxx	predictive	Medium
105	Argument	xxxx_xxxxxxxx	predictive	High
106	Argument	xx_xx	predictive	Low
107	Argument	xxxx[xxx]	predictive	Medium
108	Argument	xxxxx/xxxxxx/xxxxxx	predictive	High
109	Argument	xxxxxxxx	predictive	Medium
110	Argument	xxxx	predictive	Low
111	Argument	xxxxx	predictive	Low
112	Argument	xxxxx_xx	predictive	Medium
113	Argument	xxxx_xxxxxxx	predictive	Medium
114	Argument	xx	predictive	Low
115	Argument	xxxx	predictive	Low
116	Argument	xxxxxxxxxxxxx/xxxxxxxxxxxxxx	predictive	High
117	Argument	x/xx/xxx	predictive	Medium
118	Argument	xxxx_xxxx	predictive	Medium
119	Argument	xx_xxxxxxx	predictive	Medium
120	Argument	xxx	predictive	Low
121	Argument	xxxxxxxxx/xxxxxx/xxxxxxxxx	predictive	High
122	Argument	xxxxxxxxxx	predictive	Medium
123	Argument	xxxxxxxx_xxxx	predictive	High
124	Argument	xxxxxxxxxxxxx	predictive	High
125	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	High
126	Argument	xxxxxx	predictive	Low
127	Argument	xxxxx_xxxx	predictive	Medium
128	Argument	xxxxxxxx	predictive	Medium
129	Argument	xxxxxxxx	predictive	Medium
130	Argument	xxxxxxx	predictive	Low
131	Argument	xxxx xxxxx	predictive	Medium
132	Argument	xxxx_xxxxx	predictive	Medium
133	Argument	xxxx	predictive	Low
134	Argument	xxxxxx	predictive	Low
135	Argument	xxxxxxxxxx	predictive	Medium
136	Argument	x/xxxxxxxxxxxx	predictive	High
137	Argument	xxxx	predictive	Low
138	Argument	xxxxxxxx	predictive	Medium
139	Argument	xxxxx/xxx	predictive	Medium
140	Argument	xxx	predictive	Low
141	Argument	xxxxxx	predictive	Low
142	Argument	xxxxxxxx	predictive	Medium
143	Argument	xxxxxxxxx_xxxxxx_xx_[xxxx]	predictive	High
144	Input Value	' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)-- xxxx	predictive	High
145	Input Value	../..	predictive	Low
146	Network Port	xxx/xxxx	predictive	Medium
147	Network Port	xxx/xxx (xxx)	predictive	High

References (5)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!