PurpleFox Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (30)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	24
de	2
zh	2
es	2

Country

cn	12
us	10

Actors

PurpleFox	2
Cobalt Strike	1
Mirai	1
OceanLotus	1
UAC-0027	1

Activities

Interest

Timeline

Type

Not Defined	12
Web Browser	4
Router Operating System	4
Firewall Software	2

Vendor

Google	4
Juniper	4
Cisco	2
Thomas R. Pasawicz	2
Jtl-software	2

Product

Google Chrome	4
Cisco Firepower Device Manager	2
Thomas R. Pasawicz HyperBook Guestbook	2
Juniper Junos	2
Jtl-software JTL-Shop	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	MP4v2 MP4 File atom_avcC.cpp Read memory corruption	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01339	0.00	CVE-2018-14446
2	libmp4v2 MP4 File mp4track.cpp FinishSdtp out-of-bounds	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00064	0.00	CVE-2018-17235
3	Google Chrome Compositing out-of-bounds	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00233	0.03	CVE-2022-2010
4	Google Chrome WebGL out-of-bounds	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00240	0.02	CVE-2022-2008
5	Google Chrome WebGPU use after free	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00465	0.03	CVE-2022-2007
6	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.64	CVE-2010-0966
7	Pydio Imagemagick os command injection	6.2	6.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00107	0.05	CVE-2019-10048
8	Popup Maker Plugin do_action authorization	8.2	8.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.11202	0.02	CVE-2019-17574
9	SPIP spip.php cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00132	0.56	CVE-2022-28959
10	Void Contact Form 7 Widget for Elementor Page Builder Plugin void_cf7_opt_in_user_data_track cross-site request forgery	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00063	0.00	CVE-2022-47166
11	Drobo 5N2 NAS Access Control drobo.php information disclosure	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00453	0.07	CVE-2018-14702
12	Juniper Junos J-Web information disclosure	4.3	4.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00151	0.00	CVE-2021-0210
13	Juniper Junos OS J-Web input validation	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00277	0.00	CVE-2021-0269
14	Apache SkyWalking H2/MySQL/TiDB sql injection	7.4	6.8	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.04305	0.04	CVE-2020-9483
15	Symfony Exception information exposure	4.6	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00058	0.04	CVE-2020-5274
16	Jtl-software JTL-Shop druckansicht.php sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00064	0.00	CVE-2010-0691
17	Google Android PackageItemInfo.java loadLabel denial of service	6.0	5.9	$5k-$25k	$5k-$25k	Not Defined	Official Fix	0.00044	0.00	CVE-2021-0651
18	Cisco Firepower Device Manager REST API code injection	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00224	0.00	CVE-2021-1518
19	K7 Ultimate Security Backup Module K7BKCExt.dll link following	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00051	0.03	CVE-2019-16896
20	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.02016	0.00	CVE-2007-1192

IOC - Indicator of Compromise (15)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	61.222.155.49	61-222-155-49.hinet-ip.hinet.net	PurpleFox	12/27/2023	verified	High
2	64.227.152.193		PurpleFox	03/18/2024	verified	High
3	103.94.108.114		PurpleFox	12/27/2023	verified	High
4	XXX.XXX.XX.XX		Xxxxxxxxx	11/06/2023	verified	High
5	XXX.XXX.XX.XX		Xxxxxxxxx	11/06/2023	verified	High
6	XXX.XX.XXX.XXX		Xxxxxxxxx	12/27/2023	verified	High
7	XXX.XXX.XXX.XXX		Xxxxxxxxx	12/27/2023	verified	High
8	XXX.XXX.X.XXX		Xxxxxxxxx	12/27/2023	verified	High
9	XXX.X.XXX.XXX	xxx-x-xxx-xxx.xxx.xxxxxxxx.xx	Xxxxxxxxx	12/27/2023	verified	High
10	XXX.XXX.XXX.XX		Xxxxxxxxx	11/06/2023	verified	High
11	XXX.XXX.XX.XXX		Xxxxxxxxx	11/06/2023	verified	High
12	XXX.XXX.XX.XXX		Xxxxxxxxx	12/27/2023	verified	High
13	XXX.X.XXX.XXX		Xxxxxxxxx	12/27/2023	verified	High
14	XXX.XXX.XXX.XXX		Xxxxxxxxx	12/27/2023	verified	High
15	XXX.XXX.XX.XXX		Xxxxxxxxx	12/27/2023	verified	High

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
2	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
3	TXXXX	CAPEC-108	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (12)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/drobopix/api/drobo.php	predictive	High
2	File	/spip.php	predictive	Medium
3	File	xxxx_xxxx.xxx	predictive	High
4	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
5	File	xxxxxxxxxxxx.xxx	predictive	High
6	File	xxx/xxxxxx.xxx	predictive	High
7	File	xxxxxxxx.xxx	predictive	Medium
8	File	xxxxxxxxxxxxxxx.xxxx	predictive	High
9	File	xxxxxxxxxx.xxx	predictive	High
10	Library	xxxxxxxx.xxx	predictive	Medium
11	Argument	xxxxxxxx	predictive	Medium
12	Argument	xx	predictive	Low

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!