Agent.BTZ Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (16)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	8
fr	8

Country

fr	10
cn	2
ua	2

Actors

Agent.BTZ	3

Activities

Interest

Timeline

Type

Connectivity Software	4
Web Server	4
Web Browser	2
Not Defined	2

Vendor

Not Defined	6
Apache	4
Microsoft	2

Product

OpenSSH	4
Apache HTTP Server	4
Microsoft Internet Explorer	2
RuoYi	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	OpenSSH GSS2 auth-gss2.c Username information disclosure	5.3	5.2	$5k-$25k	$5k-$25k	Not Defined	Workaround	0.00257	0.04	CVE-2018-15919
2	Apache HTTP Server suEXEC Feature .htaccess information disclosure	5.3	5.0	$5k-$25k	$0-$5k	Proof-of-Concept	Workaround	0.00000	0.03
3	RuoYi weak password	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00237	0.07	CVE-2022-37158
4	Microsoft Internet Explorer BackMyParent2 privileges management	5.5	5.2	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00000	0.00
5	Microsoft Internet Explorer Subframe access control	6.3	6.0	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.01570	0.00	CVE-2003-1026
6	Apache HTTP Server ap_rputs integer overflow	5.3	5.1	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00346	0.05	CVE-2022-28614
7	Apache HTTP Server Path Normalization path traversal	7.3	7.0	$5k-$25k	$0-$5k	High	Official Fix	0.97456	0.05	CVE-2021-41773
8	Apache HTTP Server mod_status race condition	7.3	6.4	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.95569	0.00	CVE-2014-0226
9	OpenSSH Readonly Mode sftp-server.c process_open permission	5.3	5.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00660	0.03	CVE-2017-15906
10	Microsoft Windows Path Canonicalisation EclipsedWing code injection	7.3	6.8	$25k-$100k	$0-$5k	High	Official Fix	0.97477	0.04	CVE-2008-4250
11	Google Android Qualcomm Audio Post Processor information disclosure	5.4	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00079	0.02	CVE-2017-0401
12	Apple iTunes memory corruption	9.3	8.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2010-1768

IOC - Indicator of Compromise (9)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	41.223.91.217		Agent.BTZ	02/12/2024	verified	High
2	78.138.25.29		Agent.BTZ	02/12/2024	verified	High
3	XX.XXX.XX.XXX		Xxxxx.xxx	02/12/2024	verified	High
4	XX.XXX.XXX.XX		Xxxxx.xxx	02/12/2024	verified	High
5	XX.XXX.XXX.XX		Xxxxx.xxx	02/12/2024	verified	High
6	XX.XX.XX.XXX	xxxx-xx-xx-xx-xxx.xxxx.xx	Xxxxx.xxx	02/12/2024	verified	High
7	XXX.XXX.XXX.XXX		Xxxxx.xxx	02/12/2024	verified	High
8	XXX.XXX.XX.XXX		Xxxxx.xxx	02/12/2024	verified	High
9	XXX.XX.XXX.XXX		Xxxxx.xxx	02/12/2024	verified	High

TTP - Tactics, Techniques, Procedures (6)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
5	TXXXX	CAPEC-112	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (4)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	.htaccess	predictive	Medium
2	File	xxxx-xxxx.x	predictive	Medium
3	File	xxxx-xxxxxx.x	predictive	High
4	Pattern	\|xx\|	predictive	Low

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!