Colibri Loader Analysisinfo

IOB - Indicator of Behavior (69)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en58
fr8
es2
pl2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

HP SAN4
HP iQ4
Coinsoft Technologies phpCOIN4
IW Guestbook4
Microsoft Windows4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1HP SAN/iQ hydra.exe credentials management4.33.9$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.005660.00CVE-2012-4362
2Hydra HTTP Header read.c process_header_end null pointer dereference6.46.4$0-$5k$0-$5kNot DefinedNot Defined0.001390.07CVE-2019-17502
3IW Guestbook badwords_edit.asp sql injection6.35.7$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.00
4Hydra authentication replay5.75.5$0-$5k$0-$5kNot DefinedOfficial Fix0.000990.00CVE-2020-5300
5OmniSecure AddUrlShield index.php sql injection6.35.7$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.00
6ORY Hydra error Reflected cross site scripting5.25.1$0-$5k$0-$5kNot DefinedOfficial Fix0.001020.00CVE-2019-8400
7PHPGurukul Hospital Management System dashboard.php access control5.55.5$0-$5k$0-$5kNot DefinedNot Defined0.013160.07CVE-2020-35745
8HP SAN/iQ Login hydra.exe memory corruption10.09.5$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.437140.00CVE-2011-4157
9HP LeftHand Virtual SAN Appliance hydra memory corruption10.09.5$25k-$100k$0-$5kHighOfficial Fix0.955740.00CVE-2013-2343
10Coinsoft Technologies phpCOIN db.php file inclusion7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.069510.00CVE-2005-4211
11Coinsoft Technologies phpCOIN db.php path traversal5.34.8$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.051190.00CVE-2005-4212
12Ilohamail cross site scripting4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000000.06
13DrayTek Vigor2960/Vigor3900/Vigor300B mainfunction.cgi injection9.89.8$25k-$100k$0-$5kHighNot Defined0.966740.00CVE-2020-8515
14simplesamlphp simplesamlphp-module-openidprovider trust.tpl.php cross site scripting4.14.1$0-$5k$0-$5kNot DefinedOfficial Fix0.001950.06CVE-2010-10008
15Small CRM cross site scripting3.53.4$0-$5k$0-$5kNot DefinedNot Defined0.000620.05CVE-2023-44075
16Intern Record System controller.php cross site scripting4.44.4$0-$5kCalculatingNot DefinedNot Defined0.000760.00CVE-2022-40348
17Wireshark denial of service7.57.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.002190.00CVE-2009-2563
18Sitekit CMS registration-form.html cross site scripting3.53.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.00
19Microsoft Windows Backup Service Privilege Escalation7.77.1$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.000910.00CVE-2023-21752
20SunHater KCFinder upload.php cross site scripting5.75.7$0-$5k$0-$5kNot DefinedNot Defined0.001940.00CVE-2019-14315

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
165.109.7.23static.23.7.109.65.clients.your-server.deColibri Loader10/05/2022verifiedMedium
2XXX.XXX.XXX.XXXXxxxxxx Xxxxxx01/17/2023verifiedMedium

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueClassVulnerabilitiesAccess VectorTypeConfidence
1T1006CAPEC-126CWE-22Path TraversalpredictiveHigh
2T1040CAPEC-102CWE-294Authentication Bypass by Capture-replaypredictiveHigh
3TXXXXCAPEC-XXCWE-XXXxxxxxxx Xxxxxxxxxxxxxx Xx Xxxx Xxxxxx Xxxxx XxxxxxxxxxxpredictiveHigh
4TXXXXCAPEC-XXXCWE-XXXxxxxxxx XxxxxxxxxpredictiveHigh
5TXXXX.XXXCAPEC-XXXCWE-XX, CWE-XXXxxxx Xxxxx Xxxx XxxxxxxxxpredictiveHigh
6TXXXXCWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHigh
7TXXXXCAPEC-XXXCWE-XXXxx XxxxxxxxxpredictiveHigh
8TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveHigh

IOA - Indicator of Attack (32)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/cwc/loginpredictiveMedium
2File/intern/controller.phppredictiveHigh
3File/iwguestbook/admin/badwords_edit.asppredictiveHigh
4File/iwguestbook/admin/messages_edit.asppredictiveHigh
5Fileadmin/dashboard.phppredictiveHigh
6Filexxxxx.xxxpredictiveMedium
7Filexxx-xxx/xxxxxxxxxxxx.xxxpredictiveHigh
8Filexxxx_xxxxxxxx/xx.xxxpredictiveHigh
9Filexxxxx.xxxpredictiveMedium
10Filexxxxx.xxxpredictiveMedium
11Filexxxxx.xxx/xxxxxxxxxxxxx/xxxpredictiveHigh
12Filexxxxxx/xxxxxxxxx/xxxxxpredictiveHigh
13Filexxxx.xpredictiveLow
14Filexxxxxxxxxxxx-xxxx.xxxxpredictiveHigh
15Filexxxxxxxxx/xxxxx.xxx.xxxpredictiveHigh
16Filexxxxxx.xxxpredictiveMedium
17Filexx-xxxxx/xxxxx-xxxxxx.xxxpredictiveHigh
18ArgumentxxxxxxxpredictiveLow
19ArgumentxxxxxxpredictiveLow
20ArgumentxxxxxxxxxxxxxxxpredictiveHigh
21ArgumentxxxxxxxxxpredictiveMedium
22Argumentxxxxxxx-xxxxxxpredictiveHigh
23Argumentxxxxx_xxxxpredictiveMedium
24Argumentxxxxxx$xxxxxpredictiveMedium
25ArgumentxxpredictiveLow
26ArgumentxxxxxpredictiveLow
27Argumentxxxx/xxxxxpredictiveMedium
28Argumentxxxx_xxpredictiveLow
29ArgumentxxxxxxpredictiveLow
30ArgumentxxxxxxxpredictiveLow
31Argument_xxxx[_xxx_xxxx_xxxxpredictiveHigh
32Input Valuex+xxxxx+xxxxxx+x,xxxxxxx,xxxxxxxxxxx+xxxx+xxxxx#predictiveHigh

References (3)

The following list contains external sources which discuss the actor and the associated activities:

Samples (3)

The following list contains associated samples:

This view requires CTI permissions

Just purchase a CTI license today!