BBtok Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (66)

Langue

en	56
de	4
it	4
es	2

De campagne

us	66

Acteurs

BBtok	3
RedLine Stealer	2
Ave Maria	2
Nanocore RAT	1
NjRAT	1

Intérêt

Taper

Not Defined	12
Content Management System	10
Web Browser	2
Virtualization Software	2
Forum Software	2

Fournisseur

Not Defined	14
Virtual Programming	2
Google	2
DESTOON	2
Genetechsolutions	2

Produit

Serendipity	4
ASP Portal	2
Virtual Programming VP-ASP	2
Google Chrome	2
DESTOON B2B	2

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	DZCP deV!L`z Clanportal config.php elévation de privilèges	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.78	CVE-2010-0966
2	OpenBB read.php sql injection	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00248	0.04	CVE-2005-1612
3	YaBB cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00172	0.03	CVE-2005-4426
4	WoltLab Burning Book addentry.php sql injection	7.3	6.8	$0-$5k	$0-$5k	Functional	Unavailable	0.00804	0.02	CVE-2006-5509
5	Devilz Clanportal sql injection	7.3	7.0	$0-$5k	$0-$5k	High	Official Fix	0.00684	0.03	CVE-2006-6339
6	deV!Lz Clanportal index.php sql injection	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00342	0.00	CVE-2008-4889
7	Horde Webmail Redirect go.php elévation de privilèges	5.3	4.7	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00000	0.02
8	Adobe Flash Player Concurrency buffer overflow	8.0	7.7	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.94781	0.00	CVE-2017-2930
9	D-Link DIR-865L register_send.php authentification faible	7.5	7.1	$5k-$25k	$5k-$25k	Proof-of-Concept	Not Defined	0.00109	0.02	CVE-2013-3096
10	MyBB Remote Code Execution	9.8	9.4	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00341	0.00	CVE-2015-2786
11	Linux Foundation Xen EFLAGS Register SYSENTER elévation de privilèges	6.2	5.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00062	0.02	CVE-2013-1917
12	Mike Spice My Classifieds classifieds.cgi elévation de privilèges	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00540	0.00	CVE-2002-1600
13	Ecommerce Online Store Kit shop.php sql injection	9.8	9.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03763	0.05	CVE-2004-0300
14	Webmin view_man.cgi cross site scripting	5.7	5.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00213	0.00	CVE-2017-9313
15	SAS Web Report Studio javascript: URL logonAndRender.do cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00089	0.00	CVE-2022-25256
16	Access Demo Importer Plugin AJAX Action demo-functions.php plugin_offline_installer elévation de privilèges	8.8	8.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00405	0.00	CVE-2021-39317
17	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	2.25
18	Serendipity exit.php elévation de privilèges	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.17
19	3S-Smart CODESYS Web Server XML buffer overflow	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00183	0.00	CVE-2017-6025
20	YaBB yabb.pl cross site request forgery	8.8	8.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01522	0.00	CVE-2004-2403

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Identified	Taper	Confiance
1	147.124.213.152		BBtok	20/09/2023	verified	Élevé
2	XXX.XXX.XXX.XXX		Xxxxx	23/10/2023	verified	Élevé
3	XXX.XX.XXX.XXX	xxxxx.xx-xxx-xx-xxx.xx	Xxxxx	23/10/2023	verified	Élevé
4	XXX.XXX.XXX.XXX		Xxxxx	20/09/2023	verified	Élevé

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classe	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Élevé
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Élevé
3	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Élevé
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
5	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
7	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Élevé
8	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé

IOA - Indicator of Attack (46)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/forum/away.php	predictive	Élevé
2	File	/horde/util/go.php	predictive	Élevé
3	File	/inc/HTTPClient.php	predictive	Élevé
4	File	/SASWebReportStudio/logonAndRender.do	predictive	Élevé
5	File	addentry.php	predictive	Moyen
6	File	add_edit_cat.asp	predictive	Élevé
7	File	xxxxx/xxxxxxxx.xxx.xxx	predictive	Élevé
8	File	xxxx.xxx	predictive	Moyen
9	File	xxxxxxxx.xxx	predictive	Moyen
10	File	xxxxxxxxxxx.xxx	predictive	Élevé
11	File	xxxxxxx.xxx	predictive	Moyen
12	File	xxxx.xxx	predictive	Moyen
13	File	xxxx.xxx	predictive	Moyen
14	File	xxx/xxxxxx.xxx	predictive	Élevé
15	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	Élevé
16	File	xxxxxxx/xxxxxxxxx_xxxxxxx.xxx.xxx	predictive	Élevé
17	File	xxxxx.xxx	predictive	Moyen
18	File	xxxxxxxxx/xxxxxxxx.xxx	predictive	Élevé
19	File	xxx/xxxx_xxx.xxx	predictive	Élevé
20	File	xxxx.xxx	predictive	Moyen
21	File	xxxx.xxx	predictive	Moyen
22	File	xxxxxxxx_xxxx.xxx	predictive	Élevé
23	File	xxxx.xxx	predictive	Moyen
24	File	xxxxxxxxxxxxxx.xxx	predictive	Élevé
25	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	Élevé
26	File	xx-xxxxx.xxx	predictive	Moyen
27	File	xxxx.xx	predictive	Faible
28	File	~/xxx/xxxx-xxxxxxxxx.xxx	predictive	Élevé
29	Argument	xxxxxxxx	predictive	Moyen
30	Argument	xxx	predictive	Faible
31	Argument	xxxxxxxxx	predictive	Moyen
32	Argument	xxxxxxxx	predictive	Moyen
33	Argument	xxxxxxxx[xxxxxxx]	predictive	Élevé
34	Argument	xxx_xx	predictive	Faible
35	Argument	xxx	predictive	Faible
36	Argument	xxxx	predictive	Faible
37	Argument	xx	predictive	Faible
38	Argument	xxxx	predictive	Faible
39	Argument	xx	predictive	Faible
40	Argument	xxx	predictive	Faible
41	Argument	xxxxx	predictive	Faible
42	Argument	xxxxxx_xxxxxxx_xxxxxxxxx_xxxx/xxxxxx_xxxxxxx_xxxxxxx_xxxx	predictive	Élevé
43	Argument	xxx	predictive	Faible
44	Argument	xxx	predictive	Faible
45	Argument	xxx	predictive	Faible
46	Argument	xxxxx	predictive	Faible

Références (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!