Chafer 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (329)

言語

en	292
es	12
ru	6
it	6
fr	6

国・地域

us	182
ru	20
ir	16
es	16
cn	16

アクター

Chafer	6
APT39	2
MechaFlounder	2
MyKings	1
Cobalt Strike	1

関心

タイプ

Not Defined	104
Content Management System	24
Web Server	18
Operating System	16
WordPress Plugin	12

ベンダー

Not Defined	114
Microsoft	16
Apache	12
Google	8
VMware	6

製品

WordPress	8
Apache HTTP Server	8
Microsoft Windows	8
Google Chrome	6
Joomla	6

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash 情報の漏洩	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	nginx 特権昇格	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	2.67	CVE-2020-12440
3	Microsoft IIS クロスサイトスクリプティング	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.13	CVE-2017-0055
4	VMware vRealize Orchestrator Path Redirect	3.0	2.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00119	0.00	CVE-2021-22036
5	vm2 特権昇格	9.9	9.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00537	0.04	CVE-2023-32314
6	OpenSSH Authentication Username 情報の漏洩	5.3	4.8	$5k-$25k	$0-$5k	High	Official Fix	0.10737	0.39	CVE-2016-6210
7	PHPMailer Phar Deserialization addAttachment 特権昇格	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00748	0.00	CVE-2020-36326
8	jQuery Property extend Pollution クロスサイトスクリプティング	6.6	6.3	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.03535	0.39	CVE-2019-11358
9	Rust Programming Language Standard Library type_id メモリ破損	7.7	7.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00301	0.00	CVE-2019-12083
10	WordPress SQLインジェクション	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00467	0.00	CVE-2022-21664
11	Apple iOS WebKit メモリ破損	6.3	6.0	$100k 以上	$5k-$25k	High	Official Fix	0.00424	0.00	CVE-2021-30666
12	WordPress ディレクトリトラバーサル	5.7	5.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00326	0.04	CVE-2023-2745
13	Canon IJ Network Tool Wi-Fi Connection Setup 情報の漏洩	5.4	5.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00052	0.00	CVE-2023-1763
14	ciubotaru share-on-diaspora new_window.php クロスサイトスクリプティング	4.4	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00063	0.04	CVE-2017-20176
15	Postfix Admin functions.inc.php SQLインジェクション	7.3	7.0	$5k-$25k	$0-$5k	High	Official Fix	0.00253	0.03	CVE-2014-2655
16	D-Link DCS-2530L/DCS-2670L ddns_enc.cgi 特権昇格	7.5	7.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00135	0.02	CVE-2020-25079
17	Microsoft IIS IP/Domain Restriction 特権昇格	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00817	0.47	CVE-2014-4078
18	SourceCodester Library Management System bookdetails.php SQLインジェクション	7.1	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00322	0.04	CVE-2022-2214
19	Phplinkdirectory PHP Link Directory conf_users_edit.php 未知の脆弱性	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00526	0.00	CVE-2011-0643
20	Lotus Domino Request 情報の漏洩	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00877	0.00	CVE-2002-0245

キャンペーン (2)

These are the campaigns that can be associated with the actor:

Chafer
Xxxxxx

IOC - Indicator of Compromise (11)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	キャンペーン	Identified	タイプ	信頼度
1	83.142.230.113		Chafer		2020年12月22日	verified	高
2	89.38.97.112	89-38-97-112.hosted-by-worldstream.net	Chafer		2020年12月22日	verified	高
3	89.38.97.115	89-38-97-115.hosted-by-worldstream.net	Chafer		2020年12月22日	verified	高
4	XX.XXX.XXX.XXX		Xxxxxx		2020年12月22日	verified	高
5	XX.XXX.XX.XXX	xx-xxx-xx-xxx.xxxxxx.xxxx.xx	Xxxxxx		2020年12月22日	verified	高
6	XXX.XX.XXX.XXX	xxx.xx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxx	Xxxxxx	2022年03月27日	verified	高
7	XXX.XXX.XXX.XX		Xxxxxx		2020年12月22日	verified	高
8	XXX.XXX.XXX.XX		Xxxxx	Xxxxxx	2020年12月12日	verified	高
9	XXX.XXX.XXX.XXX	xxx-xx.xxxxxx.xx	Xxxxxx		2020年12月22日	verified	高
10	XXX.XX.XXX.XX	xxx.xxxxxxxxxxxxxxx.xxxx	Xxxxxx		2020年12月22日	verified	高
11	XXX.XXX.XX.XX		Xxxxx	Xxxxxx	2020年12月12日	verified	高

TTP - Tactics, Techniques, Procedures (18)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CWE-21, CWE-22	Path Traversal	predictive	高
2	T1040	CWE-294, CWE-319	Authentication Bypass by Capture-replay	predictive	高
3	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	高
4	T1059	CWE-94	Argument Injection	predictive	高
5	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	高
6	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
7	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	高
8	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
9	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
10	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	高
11	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	高
12	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	高
13	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
14	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	高
15	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
16	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	高
17	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高
18	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxx	predictive	高

IOA - Indicator of Attack (138)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	//etc/RT2870STA.dat	predictive	高
2	File	/admin/index.php?id=themes&action=edit_template&filename=blog	predictive	高
3	File	/api/login	predictive	中
4	File	/appConfig/userDB.json	predictive	高
5	File	/bin/boa	predictive	中
6	File	/cgi-bin/wapopen	predictive	高
7	File	/CPE	predictive	低
8	File	/cwp_{SESSION_HASH}/admin/loader_ajax.php	predictive	高
9	File	/jquery_file_upload/server/php/index.php	predictive	高
10	File	/librarian/bookdetails.php	predictive	高
11	File	/magnoliaPublic/travel/members/login.html	predictive	高
12	File	/Main_AdmStatus_Content.asp	predictive	高
13	File	/public/login.htm	predictive	高
14	File	/requests.php	predictive	高
15	File	/self.key	predictive	中
16	File	/xxxxxxx/	predictive	中
17	File	/xxx/xxx/xxxxx	predictive	高
18	File	/xxxxxxxx/xxxx_xxxxx.xxx	predictive	高
19	File	xxxxxxx.xxx	predictive	中
20	File	xxxxx.xxx	predictive	中
21	File	xxxxx/xxxx_xxxxx_xxxx.xxx	predictive	高
22	File	xxxxxxxxxxxxx/xxxxxxxxxx/xxx_xxxxx/xxxxxxx/xxxxx.xxx	predictive	高
23	File	xxxxxxxxxx.xxx	predictive	高
24	File	xxxxxxxxxxx.xxx	predictive	高
25	File	xx_xxxxxxxxxx.xxx	predictive	高
26	File	xxx:.xxx	predictive	中
27	File	xxx/xxx.xxx	predictive	中
28	File	xxxxxxx.xxx	predictive	中
29	File	xxxxxx_xxxxxx.xxx	predictive	高
30	File	xxxxxxxx.xxx	predictive	中
31	File	xxx-xxx/xxxx_xxx.xxx	predictive	高
32	File	xxxxxx.xxx	predictive	中
33	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	高
34	File	xxxxxx.xxx	predictive	中
35	File	xxx.xxx	predictive	低
36	File	xxxxx.xxx	predictive	中
37	File	xxx/xxxxxxxx/xxx_xxxxxxxxxxxx.xx	predictive	高
38	File	xxxxxxxxx.xxx.xxx	predictive	高
39	File	xxxxxxxxxxxx_xxxx.xxx	predictive	高
40	File	xxx_xxxxxx.xxx	predictive	高
41	File	xxxx_xxxxxxx.xxx.xxx	predictive	高
42	File	xxxx_xxxx.x	predictive	中
43	File	xxxxxxxxx.xxx	predictive	高
44	File	xxxxxxxx/xxxxx.xxxx-xxx.xxx	predictive	高
45	File	xxxxx.xxx	predictive	中
46	File	xxxxxx.x	predictive	中
47	File	xxxx/xxx_xxx.x	predictive	高
48	File	xxxxxxxx.xxx	predictive	中
49	File	xxxxxxx/xxxxxxx/xxx_xxxxxxx.x	predictive	高
50	File	xxx_xxxxxx.xx	predictive	高
51	File	xxxx/xxxx/xxxxx.xxx	predictive	高
52	File	xxx_xxxxxx.xxx	predictive	高
53	File	xxxxxx.xxx	predictive	中
54	File	xxxxxxxxxxxxxx.xxx	predictive	高
55	File	xxxxxxx.xxx	predictive	中
56	File	xxxxx.xxxxx.xxx	predictive	高
57	File	xxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]	predictive	高
58	File	xxxx/xxxxx	predictive	中
59	File	xxxxx.xxx	predictive	中
60	File	xxxxxxxx.xxx	predictive	中
61	File	xxxxxxxxxx.xxx	predictive	高
62	File	xxxxxxxx_xxxx.xxx	predictive	高
63	File	xxxxxxxx.xxx?x=xxxxxx&x=xxxxxxxxxx	predictive	高
64	File	xxxxxxx.x	predictive	中
65	File	xxxxxx.xxx	predictive	中
66	File	xxxx.xxx	predictive	中
67	File	xxxxx/xxx/xxxx.x	predictive	高
68	File	xxxxxx_xxx_xxxxx_xxx.xxx	predictive	高
69	File	xxx_xxx_xxxxx.xxx	predictive	高
70	File	xxxx/xxxxxxxxxxxxxxx.xxxxxx	predictive	高
71	File	xxxxxxx_xxxxx.xxx	predictive	高
72	File	xxxxxxx_xxxxxxxxxx.xxx	predictive	高
73	File	xxx.xxx	predictive	低
74	File	xxxxxx.xxx	predictive	中
75	File	xxxxxx.xxx	predictive	中
76	File	xxxxxxxxxxxxxx.xxx	predictive	高
77	File	xxxxxxx.xxx	predictive	中
78	File	xx-xxxxx/xxxx-xxx.xxx	predictive	高
79	File	xx-xxxxxxx/xxxxxxx/xxxx-xx-xxxx/	predictive	高
80	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	高
81	File	xx-xxxxxxxx/xxxxx-xx-xxxxxx-xxxxxx.xxx	predictive	高
82	File	xx-xxxxxxxxxxx.xxx	predictive	高
83	Library	xxxxxxx/xxx/xxxxxx.xxx.xxx	predictive	高
84	Library	xxxxxx.xxx	predictive	中
85	Argument	$xxxxx_xxxxxxxxxx	predictive	高
86	Argument	xxxxxxx	predictive	低
87	Argument	xxxxx	predictive	低
88	Argument	xxxxxx	predictive	低
89	Argument	xxx	predictive	低
90	Argument	xxxxx	predictive	低
91	Argument	xxxxxxxxxxxxxxx	predictive	高
92	Argument	xxxx/xxxx	predictive	中
93	Argument	xxxxxxxx	predictive	中
94	Argument	xxxx	predictive	低
95	Argument	xxxxxxxxxx	predictive	中
96	Argument	xxxx	predictive	低
97	Argument	xxxxxxxxxx	predictive	中
98	Argument	xxxx_xxxxxxxx	predictive	高
99	Argument	xx_xx	predictive	低
100	Argument	xxxx[xxx]	predictive	中
101	Argument	xxxxxxxx	predictive	中
102	Argument	xxxx	predictive	低
103	Argument	xxxxx	predictive	低
104	Argument	xxxxx_xx	predictive	中
105	Argument	xxxx_xxxxxxx	predictive	中
106	Argument	xx	predictive	低
107	Argument	xxxx	predictive	低
108	Argument	xxxxxxxxxxxxx/xxxxxxxxxxxxxx	predictive	高
109	Argument	x/xx/xxx	predictive	中
110	Argument	xxxx_xxxx	predictive	中
111	Argument	xx_xxxxxxx	predictive	中
112	Argument	xxx	predictive	低
113	Argument	xxxxxxxxx/xxxxxx/xxxxxxxxx	predictive	高
114	Argument	xxxxxxxxxx	predictive	中
115	Argument	xxxxxxxxxxxxx	predictive	高
116	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	高
117	Argument	xxxxxx	predictive	低
118	Argument	xxxxx_xxxx	predictive	中
119	Argument	xxxxxxxx	predictive	中
120	Argument	xxxxxxxx	predictive	中
121	Argument	xxxxxxx	predictive	低
122	Argument	xxxx xxxxx	predictive	中
123	Argument	xxxx_xxxxx	predictive	中
124	Argument	xxxx	predictive	低
125	Argument	xxxxxx	predictive	低
126	Argument	xxxxxxxxxx	predictive	中
127	Argument	x/xxxxxxxxxxxx	predictive	高
128	Argument	xxxx	predictive	低
129	Argument	xxxxxxxx	predictive	中
130	Argument	xxxxx/xxx	predictive	中
131	Argument	xxx	predictive	低
132	Argument	xxxxxx	predictive	低
133	Argument	xxxxxxxx	predictive	中
134	Argument	xxxxxxxxx_xxxxxx_xx_[xxxx]	predictive	高
135	Input Value	' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)-- xxxx	predictive	高
136	Input Value	../..	predictive	低
137	Network Port	xxx/xxxx	predictive	中
138	Network Port	xxx/xxx (xxx)	predictive	高

参考 (5)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!