BlueFox Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (118)

Lang

en	100
fr	6
ru	4
es	4
it	2

Land

us	34
fr	4
it	2
es	2
ru	2

Skådespelare

BlueFox	5
Cobalt Strike	4
RedLine Stealer	3
Vidar	3
Amadey	2

Intressera

Typ

Not Defined	50
Content Management System	12
Groupware Software	4
Programming Language Software	4
WordPress Plugin	2

Säljare

Not Defined	40
Microsoft	6
Multishop	2
Virtual Programming	2
Synacor	2

Produkt

Multishop CMS	2
Microsoft Outlook	2
MonsterInsights Plugin	2
MLM Forced Matrix	2
Pre Shopping Mall	2

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	OpenX adclick.php Redirect	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00440	0.98	CVE-2014-2230
2	Netjuke explore.php sql injektion	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00287	0.00	CVE-2007-4810
3	Basti2web Book Panel books.php sql injektion	7.3	7.0	$0-$5k	$0-$5k	High	Official Fix	0.00064	0.03	CVE-2009-4889
4	Tiki Admin Password tiki-login.php svag autentisering	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	4.79	CVE-2020-15906
5	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	3.72
6	ZyXEL NAS326/NAS540/NAS542 UDP Packet Format String	9.8	9.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00435	0.00	CVE-2022-34747
7	uTorrent minneskorruption	7.3	7.0	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.12561	0.00	CVE-2009-5134
8	Brand039 MMSLamp default.php sql injektion	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00107	0.00	CVE-2007-6575
9	SMEWeb catalog.php cross site scripting	4.3	4.2	$0-$5k	$0-$5k	High	Unavailable	0.00254	0.00	CVE-2008-2644
10	PhpMyFactures index.php sql injektion	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
11	Gallarific PHP Photo Gallery script gallery.php sql injektion	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00112	0.04	CVE-2011-0519
12	Php-shop-system Com Xobbix index.php sql injektion	7.3	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00122	0.00	CVE-2010-5053
13	Bitmain Antminer D3/Antminer L3+/Antminer S9 restore privilegier eskalering	7.5	7.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01252	0.03	CVE-2018-11220
14	Apertoblog categories.php sql injektion	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00102	0.00	CVE-2008-5775
15	UAEPD Shopping Cart Script products.php sql injektion	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00471	0.02	CVE-2014-1618
16	PHP-Fusion photogallery.php sql injektion	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00153	0.00	CVE-2005-3160
17	Dxproscripts DXShopCart product_detail.php sql injektion	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00064	0.02	CVE-2008-4744
18	Clip-bucket ClipBucket ITEM view_item.php sql injektion	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00395	0.03	CVE-2015-2102
19	Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Version Data version.js informationsgivning	5.3	4.9	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00045	0.44	CVE-2024-4022
20	Grandstream HT800 TR-069 Service förnekande av tjänsten	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00729	0.00	CVE-2020-5761

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Identified	Typ	Förtroende
1	31.41.244.152		BlueFox	28/11/2022	verified	Hög
2	45.8.147.31	vm792438.stark-industries.solutions	BlueFox	28/11/2022	verified	Hög
3	XX.X.XXX.XXX	xxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxxxxxx	28/11/2022	verified	Hög
4	XX.XXX.XXX.XXX	xxx.xxxxxxxx.xxxxxx-xxx.xx	Xxxxxxx	28/11/2022	verified	Hög
5	XX.XXX.XXX.XX	xxxxxxxxxx-xxxxxxx.xxxx.xxxxxxx	Xxxxxxx	28/11/2022	verified	Hög
6	XX.XXX.XX.XX	xxxxxxxxxxx.xx	Xxxxxxx	28/11/2022	verified	Hög
7	XX.XXX.XXX.XXX	xxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxxxxxx	28/11/2022	verified	Hög
8	XXX.XXX.XXX.XXX		Xxxxxxx	28/11/2022	verified	Hög

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klass	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1		CAPEC-10	CWE-20, CWE-73, CWE-119, CWE-121, CWE-122, CWE-134, CWE-287, CWE-306, CWE-404, CWE-416, CWE-610, CWE-824, CWE-835, CWE-908	Unknown Vulnerability	predictive	Hög
2	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Hög
3	T1040	CAPEC-114	CWE-287, CWE-294	Authentication Bypass by Capture-replay	predictive	Hög
4	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxxxxxxx Xxxxxxxxx	predictive	Hög
5	TXXXX.XXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XX, CWE-XXX	Xxxxx Xxxx Xxxxxxxxx	predictive	Hög
6	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
7	TXXXX.XXX	CAPEC-16	CWE-XXX, CWE-XXX, CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Hög
8	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XX, CWE-XXX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Hög
9	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Hög
10	TXXXX	CAPEC-0	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Hög
11	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxx Xxxxxxxxx	predictive	Hög
12	TXXXX	CAPEC-50	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
13	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög
14	TXXXX.XXX	CAPEC-112	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Hög
15	TXXXX.XXX	CAPEC-19	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Hög

IOA - Indicator of Attack (106)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	/forum/away.php	predictive	Hög
2	File	/importexport.php	predictive	Hög
3	File	/index.php	predictive	Medium
4	File	/opt/zimbra/jetty/webapps/zimbra/public	predictive	Hög
5	File	/version.js	predictive	Medium
6	File	adclick.php	predictive	Medium
7	File	addtocart.asp	predictive	Hög
8	File	admin/adm/test.php	predictive	Hög
9	File	agora.cgi	predictive	Medium
10	File	books.php	predictive	Medium
11	File	cat.asp	predictive	Låg
12	File	catalog.php	predictive	Medium
13	File	categories.php	predictive	Hög
14	File	xxxxxx.xxx	predictive	Medium
15	File	xxxxxx.xxx	predictive	Medium
16	File	xxxxxxx.xxx	predictive	Medium
17	File	xxxxxx.xxx	predictive	Medium
18	File	xxxxxxx.xxx	predictive	Medium
19	File	xxx/xxx/xxx_xxxx.x	predictive	Hög
20	File	xxx.xxx	predictive	Låg
21	File	xxxx.xxx	predictive	Medium
22	File	xxxxxxxx.xxx	predictive	Medium
23	File	xxxxxxx.xxx	predictive	Medium
24	File	xxx_xxxxxxx.xxx	predictive	Hög
25	File	xxxx/xxxxxxx.xxx	predictive	Hög
26	File	xxxxxxx\xxxxxxx\xxxxxxx_xxxxx.xxx	predictive	Hög
27	File	xxxxx.xxx	predictive	Medium
28	File	xxxx.xxx	predictive	Medium
29	File	xxxxxxxxxx.xxx	predictive	Hög
30	File	xxxxx.xxx	predictive	Medium
31	File	xxxxxxx/xxxxxxxx/xxxxx.xxx	predictive	Hög
32	File	xxxxxxx.xxx	predictive	Medium
33	File	xxxx-xxxxxx.xxx	predictive	Hög
34	File	xxxx.xxx	predictive	Medium
35	File	xxxx_xxxx.xxx	predictive	Hög
36	File	xxx_xxxx.xxx	predictive	Medium
37	File	xxxxxxxx.xxxx/xxxx.xxxx	predictive	Hög
38	File	xxxxx.xxx	predictive	Medium
39	File	xxxxx_xxxxxxxx_xxxxx.xxx	predictive	Hög
40	File	xxxxxxxxxxxxxxxxxx.xxx	predictive	Hög
41	File	xxxx/xxxxx.xxx	predictive	Hög
42	File	xxxxxxxxxxxx.xxx	predictive	Hög
43	File	xxxxxxx.xxx	predictive	Medium
44	File	xxxxx/xxxxxx/xxxxxxx/xxxxxx.xxxx	predictive	Hög
45	File	xxxxxxxx.xxx	predictive	Medium
46	File	xxxxxxx_xxxxxx.xxx	predictive	Hög
47	File	xxxxxxx_xxxxxxx.xxx	predictive	Hög
48	File	xxxxxxx.xxx	predictive	Medium
49	File	xxx.xxx	predictive	Låg
50	File	xxxxxx_xxxxxxx.xxx	predictive	Hög
51	File	xxxx.xxx	predictive	Medium
52	File	xxxxxxxxxxxx.xxx	predictive	Hög
53	File	xxxxxxxxxxxxxxx.xxx	predictive	Hög
54	File	xxxxxxx.xxx	predictive	Medium
55	File	xxxx-xxxxx.xxx	predictive	Hög
56	File	xxxxxxxx.xxx	predictive	Medium
57	File	xxxxxxxxx.xxx	predictive	Hög
58	File	xxxx_xxxx.xxx	predictive	Hög
59	Library	/_xxx_xxx/xxxxx.xxx	predictive	Hög
60	Library	xx_xxx.xxx	predictive	Medium
61	Library	xxx.xxx	predictive	Låg
62	Argument	xxxxxxx_xxxxxx	predictive	Hög
63	Argument	xxxxx	predictive	Låg
64	Argument	xxxxxxx_xx	predictive	Medium
65	Argument	xx[]	predictive	Låg
66	Argument	xxxxxx	predictive	Låg
67	Argument	xxxx_xx	predictive	Låg
68	Argument	xxx	predictive	Låg
69	Argument	xxxxxxxx_xx	predictive	Medium
70	Argument	xxxxx	predictive	Låg
71	Argument	xxx_xx	predictive	Låg
72	Argument	xxx	predictive	Låg
73	Argument	xxxxxx[xxxxxx_xxxx]	predictive	Hög
74	Argument	xxxxxxx_xx	predictive	Medium
75	Argument	xxxxxx	predictive	Låg
76	Argument	xxxx	predictive	Låg
77	Argument	xxxx	predictive	Låg
78	Argument	xx_xx	predictive	Låg
79	Argument	xx	predictive	Låg
80	Argument	xxxxxxxxxxxxxxxx	predictive	Hög
81	Argument	xxxxx	predictive	Låg
82	Argument	xx_xxxx	predictive	Låg
83	Argument	xx_xxxx	predictive	Låg
84	Argument	xxx_xxx	predictive	Låg
85	Argument	xxxx	predictive	Låg
86	Argument	xxxxxx	predictive	Låg
87	Argument	xxxxxxxx	predictive	Medium
88	Argument	xxxxxxx/xxxxxxxx/xxxxxxxx/xxxxxxxxxxxxxxx/xxxxxxxxxxxxxxx/xxxxxxxx/xxx/xxxx/xxxx	predictive	Hög
89	Argument	xxxxx	predictive	Låg
90	Argument	xxx_x	predictive	Låg
91	Argument	xxx	predictive	Låg
92	Argument	xxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx	predictive	Hög
93	Argument	xxxxxx	predictive	Låg
94	Argument	xxxxxxx	predictive	Låg
95	Argument	xxxxxxxxxxx	predictive	Medium
96	Argument	xxxxxx	predictive	Låg
97	Argument	xxxxx	predictive	Låg
98	Argument	xxxxxxxxx	predictive	Medium
99	Argument	xxx	predictive	Låg
100	Argument	xxxxxxx	predictive	Låg
101	Argument	xxxxxx	predictive	Låg
102	Argument	\xxxxxx\	predictive	Medium
103	Input Value	xxxxxxxxx--><xxxxxx%xx>xxxxx(xxxx)</xxxxxx><!--	predictive	Hög
104	Pattern	xxxxxxxx-xxx-xxx\|xx\|	predictive	Hög
105	Network Port	xxxxx	predictive	Låg
106	Network Port	xxx/xxxx (xxx)	predictive	Hög

Referenser (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Interested in the pricing of exploits?

See the underground prices here!