Bronze Butler Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (19)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	18
de	2

Country

cn	10
us	6
kr	2
jp	2

Actors

Daserf	1
Winnti	1

Activities

Interest

Timeline

Type

Not Defined	8
Content Management System	4
Software Management Software	4
Web Browser	2

Vendor

Not Defined	10
Shenzhen Yunni Technology	2
Thomas R. Pasawicz	2
Microsoft	2
Hisilicon	2

Product

WordPress	4
Webmin	4
Shenzhen Yunni Technology iLnkP2P	2
Thomas R. Pasawicz HyperBook Guestbook	2
Microsoft Internet Explorer	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Coremail Document Attachment cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00120	0.00	CVE-2015-6942
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.02016	0.00	CVE-2007-1192
3	Webmin cross site scripting	5.2	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00118	0.01	CVE-2017-2106
4	Webmin Login Form miniserv.pl memory allocation	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.03978	0.00	CVE-2005-3912
5	ExpressVPN Service Port 2015 Xvpnd.exe XVPN.SetPreference path traversal	6.2	6.0	$0-$5k	$0-$5k	Not Defined	Workaround	0.00044	0.00	CVE-2018-15490
6	Shenzhen Yunni Technology iLnkP2P UID Generator Random cryptographic issues	7.7	7.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00176	0.08	CVE-2019-11219
7	Shenzhen Yunni Technology iLnkP2P Authentication improper authentication	7.7	7.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00669	0.05	CVE-2019-11220
8	Hisilicon HI3510 Web Management Portal Credentials permission	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00104	0.00	CVE-2019-10710
9	Hisilicon HI3510 RTSP Stream/Web Portal access control	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Workaround	0.00168	0.00	CVE-2019-10711
10	WordPress URL Validator redirect	6.6	6.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00509	0.04	CVE-2018-10101
11	WordPress Password Reset wp-login.php mail password recovery	6.1	5.8	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.02827	0.03	CVE-2017-8295
12	WordPress Admin Shell privileges management	7.3	6.6	$25k-$100k	$0-$5k	Functional	Workaround	0.00000	0.00
13	My Link Trader out.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.05
14	Apple macOS AppleSMC null pointer dereference	7.8	7.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00045	0.00	CVE-2016-4678
15	Node.js ServerResponse#writeHead Split response splitting	6.1	5.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00437	0.00	CVE-2016-5325
16	Microsoft Internet Explorer Garbage Collection jscript9.dll ProcessMark information disclosure	5.3	4.8	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00000	0.00
17	IBM Java Virtual Machine information disclosure	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00555	0.02	CVE-2015-1914

IOC - Indicator of Compromise (6)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	27.255.69.209		Bronze Butler	12/16/2020	verified	High
2	27.255.91.238		Bronze Butler	12/16/2020	verified	High
3	XXX.XXX.X.XX		Xxxxxx Xxxxxx	12/16/2020	verified	High
4	XXX.XXX.XXX.XXX		Xxxxxx Xxxxxx	12/16/2020	verified	High
5	XXX.XX.XXX.XXX	xxx-xxx-xxxxx.xx.xxxxxx.xx.xx	Xxxxxx Xxxxxx	12/16/2020	verified	High
6	XXX.XXX.XXX.XX		Xxxxxx Xxxxxx	12/16/2020	verified	High

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
5	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
7	TXXXX	CAPEC-50	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
8	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
9	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (11)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/out.php	predictive	Medium
2	File	data/gbconfiguration.dat	predictive	High
3	File	xxxxxxxx.xx	predictive	Medium
4	File	xx-xxxxx.xxx	predictive	Medium
5	File	xxxxx.xxx	predictive	Medium
6	Library	xxxxxxxx.xxx	predictive	Medium
7	Argument	xxxx	predictive	Low
8	Argument	xx	predictive	Low
9	Argument	xxxxxx	predictive	Low
10	Argument	xxxxxxxx	predictive	Medium
11	Network Port	xxx/xxxx	predictive	Medium

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!