BuerLoader Analiza

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (39)

Język

en	38
de	2

Kraj

us	4
ru	2
ch	2
gb	2

Aktorzy

Buer	1
Emotet	1

Wysiłek

Rodzaj

Not Defined	22
Peer-to-Peer Software	4
Hardware Driver Software	2
File Transfer Software	2
Multimedia Processing Software	2

Sprzedawca

Thomson	10
Not Defined	4
Mirmay	2
NVIDIA	2
FileZilla	2

Produkt

Thomson TCW710	10
Mirmay Secure Private Browser	2
Mirmay File Manager	2
NVIDIA Graphics Drivers	2
FileZilla Server	2

Luki w zabezpieczeniach

#	Słaby punkt	Base	Temp	0day	Dzisiaj	Wyk	Prz	EPSS	CTI	CVE
1	TRENDnet TEW-811DRU httpd security.asp memory corruption	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00137	0.04	CVE-2023-0613
2	laravel privilege escalation	4.1	3.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00160	0.06	CVE-2022-2870
3	Huawei SXXX VRP MPLS LSP Ping information disclosure	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00096	0.04	CVE-2014-8570
4	Apache Commons Text Variable Interpolation privilege escalation	8.0	7.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.97150	0.04	CVE-2022-42889
5	Microsoft Windows IIS Remote Code Execution	7.6	7.0	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00104	0.06	CVE-2022-30209
6	Alkacon OpenCms cross site scripting	6.3	5.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00434	0.03	CVE-2005-4294
7	Microsoft Internet Explorer Embedded Content cross site scripting	6.3	6.0	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.82340	0.03	CVE-2005-3312
8	Mozilla Firefox String nieznana luka	4.3	4.1	$25k-$100k	$0-$5k	Proof-of-Concept	Unavailable	0.00202	0.04	CVE-2005-2602
9	Netegrity SiteMinder Login smpwservicescgi.exe Redirect	5.4	5.0	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00072	0.07	CVE-2005-10001
10	Dreambox DM500 Web Server privilege escalation	7.5	6.8	$25k-$100k	$0-$5k	Proof-of-Concept	Workaround	0.02506	0.04	CVE-2008-3936
11	D-Link DIR URL Filter privilege escalation	5.3	5.1	$25k-$100k	$0-$5k	High	Official Fix	0.02265	0.02	CVE-2008-4133
12	Pro2col Stingray FTS cross site scripting	5.5	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00087	0.14	CVE-2008-10001
13	FFmpeg denial of service	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00186	0.00	CVE-2012-2805
14	Netgear WGR614 Authentication Code weak authentication	4.9	4.9	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00078	0.05	CVE-2012-6340
15	NVIDIA Graphics Drivers registry memory corruption	7.2	6.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.04	CVE-2012-0951
16	DD-WRT Web Interface cross site request forgery	7.5	6.9	$0-$5k	$0-$5k	Unproven	Not Defined	0.00312	0.03	CVE-2012-6297
17	Dell SonicWall Secure Remote Access Appliance editBookmark cross site request forgery	6.3	5.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.01802	0.00	CVE-2015-2248
18	FileZilla Server PORT privilege escalation	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00052	0.25	CVE-2015-10003
19	Kiddoware Kids Place Home Button Protection denial of service	5.4	5.3	$0-$5k	$0-$5k	High	Official Fix	0.00042	0.14	CVE-2015-10002
20	uTorrent memory corruption	6.3	6.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00250	0.05	CVE-2018-25042

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adres IP	Hostname	Aktor	Kampanie	Identified	Rodzaj	Pewność siebie
1	104.248.83.13		BuerLoader		2022-08-10	verified	Wysoki
2	XXX.XX.XXX.XXX	xxx.xxxxxxx.xxx	Xxxxxxxxxx		2022-06-11	verified	Wysoki

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klasa	Luki w zabezpieczeniach	Wektor dostępu	Rodzaj	Pewność siebie
1	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Wysoki
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Wysoki
3	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Wysoki
4	TXXXX	CAPEC-122	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
5	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Wysoki
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Wysoki
7	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	Wysoki
8	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Wysoki

IOA - Indicator of Attack (29)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasa	Indicator	Rodzaj	Pewność siebie
1	File	/backups/	predictive	Medium
2	File	/cgi-bin/editBookmark	predictive	Wysoki
3	File	/goform/RgDdns	predictive	Wysoki
4	File	/goform/RgDhcp	predictive	Wysoki
5	File	/xxxxxx/xxxxxxxxxxxx	predictive	Wysoki
6	File	/xxxxxx/xxxxxx	predictive	Wysoki
7	File	/xxxxxx/xxxxxxxxxx.xxx	predictive	Wysoki
8	File	/xxxxxx/xxxxxxxxxxxxxxxxxx	predictive	Wysoki
9	File	/xxxxxxxxxxxxxxx/xxxxx/xxxxxxxxxxxxxxx.xxx	predictive	Wysoki
10	File	/xxxxxxxx/xxxxxxxx.xxx	predictive	Wysoki
11	File	xxxxx/xxxxxx-xxxxxx.xxx	predictive	Wysoki
12	File	xxxxxxx.xxx	predictive	Medium
13	File	xxxx/xxxxxx/xxxxxx/xxxxxxxx	predictive	Wysoki
14	Argument	xxxxxxxxxxxxxxxxxxxxxxx	predictive	Wysoki
15	Argument	xxxxxxxxxxxx	predictive	Medium
16	Argument	xxxxxx_xxx_xx	predictive	Wysoki
17	Argument	xxxxxxxxxxxx/xxxxxxxxxxxxxx	predictive	Wysoki
18	Argument	xx	predictive	Niski
19	Argument	xxxxx	predictive	Niski
20	Argument	xxxxxxxxxxx	predictive	Medium
21	Argument	xxxxxxxxxxxxxxxxxxxx	predictive	Wysoki
22	Argument	xxxxxx	predictive	Niski
23	Argument	xxxxxxxxxxx/xxxxxxxxxxx/xxxxxxxxxxx	predictive	Wysoki
24	Argument	xxxxxxxx	predictive	Medium
25	Input Value	<xxxxxx>xxxxx(x)</xxxxxx>	predictive	Wysoki
26	Input Value	><xxxxxx>xxxxx(x)</xxxxxx>	predictive	Wysoki
27	Network Port	xxx/xxxxx	predictive	Medium
28	Network Port	xxx/xxxxx	predictive	Medium
29	Network Port	xxx xxxxxx xxxx	predictive	Wysoki

Referencje (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PoprzedniPrzeglądKolejny ▸

Do you need the next level of professionalism?

Upgrade your account now!