Brunhilda Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (22)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	18
fr	2
de	2

Country

us	4
fr	2
de	2

Actors

Brunhilda	3
MuddyWater	1
RedLine	1
FTP Info Stealer	1
FIN7	1

Activities

Interest

Timeline

Type

Content Management System	4
Operating System	4
Not Defined	4
Programming Language Software	2
Printing Software	2

Vendor

Microsoft	8
Not Defined	6
Joomla	2
HP	2
Solar	2

Product

Microsoft Windows	4
Joomla CMS	2
Microsoft .NET Framework	2
Drupal	2
HP Color LaserJet Pro M280-M281 Multifunction Prin ...	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	VICIdial vicidial.php cross site scripting	4.8	4.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00075	0.04	CVE-2021-35377
2	tinc VPN net_packet.c receive_tcppacket memory corruption	6.3	6.0	$0-$5k	$0-$5k	High	Official Fix	0.05468	0.02	CVE-2013-1428
3	Joomla CMS File Upload media.php input validation	6.3	6.0	$5k-$25k	$0-$5k	High	Official Fix	0.79864	0.05	CVE-2013-5576
4	Microsoft .NET Framework Array Copy memory corruption	7.3	7.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.24098	0.00	CVE-2015-2504
5	Bottle Privilege Escalation	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00690	0.03	CVE-2022-31799
6	Solar appScreener License server-side request forgery	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00221	0.05	CVE-2022-24449
7	Caddy X.509 Certificate information disclosure	4.5	4.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00138	0.00	CVE-2018-19148
8	Drupal Phar Stream Wrapper input validation	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.92709	0.02	CVE-2019-6339
9	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.02016	0.00	CVE-2007-1192
10	Microsoft Windows PowerShell code injection	6.3	5.7	$25k-$100k	$0-$5k	Proof-of-Concept	Unavailable	0.00000	0.00
11	HP HP-UX FTP Server privileges management	7.5	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00000	0.00
12	Microsoft Windows VHD Driver File access control	6.1	5.8	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00046	0.04	CVE-2016-7224
13	Microsoft Edge access control	3.1	3.0	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.06567	0.00	CVE-2016-3274
14	NASM Netwide Assembler preproc.c tokenize memory corruption	6.3	6.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00059	0.00	CVE-2018-8881
15	windows-selenium-chromedriver Download cryptographic issues	6.8	6.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00173	0.00	CVE-2016-10687
16	QEMU NVM Express Controller Emulator out-of-bounds	6.7	6.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00062	0.02	CVE-2018-16847
17	HP Color LaserJet Pro M280-M281 Multifunction Printer Embedded Web Server Reflected cross site scripting	5.2	5.2	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00058	0.03	CVE-2019-6323
18	Microsoft Windows Physical Installation access control	6.4	6.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00248	0.00	CVE-2018-8592
19	IBM Kenexa LCMS Premier on Cloud 7pk security	4.3	4.3	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00049	0.00	CVE-2016-5949
20	Microsoft Internet Explorer information disclosure	4.8	4.7	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.89073	0.00	CVE-2016-3267

IOC - Indicator of Compromise (13)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	45.142.212.216	vm324137.pq.hosting	Brunhilda	05/31/2021	verified	High
2	95.142.40.68	vm482228.eurodir.ru	Brunhilda	05/31/2021	verified	High
3	185.177.92.213	ip-185-177-92-213.ah-server.com	Brunhilda	05/31/2021	verified	High
4	XXX.XXX.XX.XX	xx-xxx-xxx-xx-xx.xx-xxxxxx.xxx	Xxxxxxxxx	05/31/2021	verified	High
5	XXX.XXX.XX.XX	xx-xxx-xxx-xx-xx.xx-xxxxxx.xxx	Xxxxxxxxx	05/31/2021	verified	High
6	XXX.XXX.XX.XX	xx-xxx-xxx-xx-xx.xx-xxxxxx.xxx	Xxxxxxxxx	05/31/2021	verified	High
7	XXX.XXX.XX.XX	xx-xxx-xxx-xx-xx.xx-xxxxxx.xxx	Xxxxxxxxx	05/31/2021	verified	High
8	XXX.XXX.XX.XXX	xx-xxx-xxx-xx-xxx.xx-xxxxxx.xxx	Xxxxxxxxx	05/31/2021	verified	High
9	XXX.XXX.XX.XXX	xx-xxx-xxx-xx-xxx.xx-xxxxxx.xxx	Xxxxxxxxx	05/31/2021	verified	High
10	XXX.XXX.XX.XXX	xx-xxx-xxx-xx-xxx.xx-xxxxxx.xxx	Xxxxxxxxx	05/31/2021	verified	High
11	XXX.XXX.XX.XXX		Xxxxxxxxx	05/31/2021	verified	High
12	XXX.XXX.XX.XXX	xx-xxx-xxx-xx-xxx.xx-xxxxxx.xxx	Xxxxxxxxx	05/31/2021	verified	High
13	XXX.XX.XXX.XXX	xxxxxxxxxx-x.xxx-xxxxxxx.xxx	Xxxxxxxxx	05/31/2021	verified	High

TTP - Tactics, Techniques, Procedures (6)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
2	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
5	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
6	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (5)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/agc/vicidial.php	predictive	High
2	File	administrator/components/com_media/helpers/media.php	predictive	High
3	File	xxx/xxxxxxx.x	predictive	High
4	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
5	File	xxx_xxxxxx.x	predictive	Medium

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you need the next level of professionalism?

Upgrade your account now!