Allakore Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (77)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	52
de	24
ru	2

Country

us	28
de	24
ca	2

Actors

ActionRAT	1
Allakore	1
Dridex	1

Activities

Interest

Timeline

Type

Not Defined	22
Learning Management Software	8
Programming Language Software	6
Content Management System	6
Packet Analyzer Software	4

Vendor

Not Defined	20
Vlad Alexa Mancini	4
Thomas R. Pasawicz	2
Linksys	2
PowerScripts	2

Product

Moodle	8
tcpdump	4
Vlad Alexa Mancini PHPFootball	4
PHP	2
Thomas R. Pasawicz HyperBook Guestbook	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.00	0.01806	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	1.92	0.00954	CVE-2010-0966
3	Tiki Admin Password tiki-login.php improper authentication	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	6.13	0.00786	CVE-2020-15906
4	Joomla CMS com_easyblog sql injection	6.3	6.1	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.61	0.00000
5	DragDropCart productdetail.php cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00000
6	Michael Salzer Guestbox gbshow.php cross site scripting	4.3	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.04588	CVE-2006-0860
7	Vunet VU Web Visitor Analyst redir.asp sql injection	7.3	7.1	$0-$5k	$0-$5k	High	Workaround	0.14	0.00119	CVE-2010-2338
8	DolphinPHP User Management Page cross site scripting	3.5	3.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.04	0.00053	CVE-2022-1086
9	LogicBoard CMS away.php redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	3.69	0.00000
10	vu Mass Mailer Login Page redir.asp sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.28	0.00181	CVE-2007-6138
11	Dataiku DSS Project access control	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00054	CVE-2021-27225
12	payfort-php-SDK success.php cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00671	CVE-2018-19188
13	MidiCart PHP Shopping Cart item_show.php sql injection	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.04	0.00000
14	Cisco Linksys EA2700 URL information disclosure	4.3	4.1	$5k-$25k	$0-$5k	Proof-of-Concept	Unavailable	0.00	0.00000
15	Mozilla Firefox/Thunderbird SetOffsets resource management	7.5	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.04	0.09052	CVE-2013-1677
16	IBM InfoSphere Master Data Management cross site scripting	3.5	3.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00063	CVE-2015-1968
17	IBM Rational Collaborative Lifecycle Management Jazz Foundation cross site scripting	3.5	3.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00063	CVE-2015-0130
18	McAfee ePolicy Orchestrator cross site scripting	4.3	4.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00192	CVE-2015-4559
19	Moodle configonlylib.php min_get_slash_argument path traversal	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.00177	CVE-2015-1493
20	WordPress Shortcodes/Post Content server-side request forgery	6.3	5.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.03	0.03513	CVE-2013-0235

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	144.91.65.100	vmi652772.contaboserver.net	Allakore	09/07/2021	verified	High
2	144.91.91.236	vmi512038.contaboserver.net	Allakore	09/07/2021	verified	High
3	XXX.XX.XXX.XX	xxxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxxx	09/07/2021	verified	High
4	XXX.XX.XXX.XXX	xxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxxx	09/07/2021	verified	High
5	XXX.XX.XX.XX	xxxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxxx	09/07/2021	verified	High
6	XXX.XXX.XXX.XXX	xxxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxxx	09/07/2021	verified	High
7	XXX.XXX.XX.XXX	xxxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxxxxx	09/07/2021	verified	High

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-22	Pathname Traversal	predictive	High
2	T1055	CWE-74	Injection	predictive	High
3	TXXXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
4	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX	CWE-XXX, CWE-XXX	X2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxx Xxxxxxxxxxx Xxx Xxx Xxxxxxx	predictive	High
6	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
7	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
9	TXXXX	CWE-XXX	Xxxxxxxxxxxxx	predictive	High
10	TXXXX	CWE-XXX, CWE-XXX	X2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxxxxxxxx Xxxxxxx Xxxxxxxxxx	predictive	High

IOA - Indicator of Attack (37)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/forum/away.php	predictive	High
2	File	/wordpress/wp-admin/admin.php	predictive	High
3	File	admin/index.php	predictive	High
4	File	data/gbconfiguration.dat	predictive	High
5	File	filter.php	predictive	Medium
6	File	xxxxxx.xxx	predictive	Medium
7	File	xxx/xxxxxx.xxx	predictive	High
8	File	xxxx_xxxx.xxx	predictive	High
9	File	xxx/xxxx/xxx.x/xxxx_xxxxxx.x	predictive	High
10	File	xxxxx.xxx	predictive	Medium
11	File	xxxxxxx.xxx	predictive	Medium
12	File	xxxxxxxxx/xxxx-xxxx	predictive	High
13	File	xxxx.xxx	predictive	Medium
14	File	xxxxx/xxxxxxx/	predictive	High
15	File	xxxxxx.xxx	predictive	Medium
16	File	xxxxxxxxxxxxx.xxx	predictive	High
17	File	xxxxx.xxx	predictive	Medium
18	File	xxxxxxxxxxxxxx.xxx	predictive	High
19	File	xxxxx.xxx	predictive	Medium
20	File	xxxxxxx.xxx	predictive	Medium
21	File	xxxx-xxxxx.xxx	predictive	High
22	Library	xxx/xxxxxxxxxxxxx.xxx	predictive	High
23	Argument	xxxxxxxx	predictive	Medium
24	Argument	xxxx_xx	predictive	Low
25	Argument	xxxxxxx	predictive	Low
26	Argument	xxxx	predictive	Low
27	Argument	xxxx_xx	predictive	Low
28	Argument	xxxxxxxx	predictive	Medium
29	Argument	xx	predictive	Low
30	Argument	xxxxxxxxxx	predictive	Medium
31	Argument	xxxxxx	predictive	Low
32	Argument	xxxxxxxx	predictive	Medium
33	Argument	xxxxxxx	predictive	Low
34	Argument	xxxxxxx_xx	predictive	Medium
35	Argument	xxxxxxx	predictive	Low
36	Argument	xxxx	predictive	Low
37	Argument	xxxxx	predictive	Low

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!