Amadey Bot تحليل

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (134)

اللغة

en	108
ru	12
fr	4
jp	2
pl	2

البلد

ru	76
us	14
de	2
fr	2

الفاعلين

Amadey	2
RedLine Stealer	2
Amadey Bot	2
Rhadamanthys	2
Meterpreter	1

الاهتمام

النوع

Not Defined	82
Content Management System	8
Enterprise Resource Planning Software	6
Domain Name Software	6
Web Server	4

المجهز

Not Defined	40
D-Link	12
SourceCodester	10
NVIDIA	6
Dolibarr	6

منتج

D-Link DWL-6610	6
D-Link DI-7200GV2.E1	6
Dolibarr ERP CRM	6
Croc	4
NVIDIA DGX H100 BMC	4

الثغرات

#	الثغرة	Base	Temp	0day	اليوم	ق�	معالجة	EPSS	CTI	CVE
1	openSUSE welcome Local Privilege Escalation	4.5	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00055	0.02	CVE-2023-32184
2	SourceCodester Medical Certificate Generator App action.php حقن إس كيو إل	8.1	7.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00116	0.04	CVE-2023-0774
3	Microsoft Exchange Server Remote Code Execution	7.6	7.1	$25k-$100k	$0-$5k	Functional	Official Fix	0.23441	0.00	CVE-2021-31206
4	nginx تجاوز الصلاحيات	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	2.31	CVE-2020-12440
5	JetBrains TeamCity توثيق ضعيف	8.5	8.2	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.97071	0.04	CVE-2023-42793
6	Nagios XI POST Request banner_message-ajaxhelper.php حقن إس كيو إل	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00085	0.04	CVE-2023-40931
7	Openupload Stable compress-inc.php تجاوز الصلاحيات	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00097	0.00	CVE-2023-36319
8	Dolibarr ERP CRM تجاوز الصلاحيات	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00097	0.03	CVE-2023-38887
9	NVIDIA DGX H100 BMC Host KVM Daemon تلف الذاكرة	7.8	7.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00042	0.05	CVE-2023-25527
10	NVIDIA Cumulus Linux VxLAN-encapsulated IPv6 Packet الكشف عن المعلومات	5.9	5.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00087	0.00	CVE-2023-25525
11	Mitsubishi Electric GX Works3 Incomplete Fix CVE-2020-14496 تجاوز الصلاحيات	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00042	0.00	CVE-2023-4088
12	NVIDIA DGX H100 BMC Web Server Plugin تلف الذاكرة	9.1	9.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00119	0.00	CVE-2023-25528
13	Dolibarr ERP CRM Command Privilege Escalation	6.7	6.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00160	0.02	CVE-2023-38886
14	Dolibarr ERP CRM REST API Module testSqlAndScriptject سكربتات مشتركة	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00178	0.02	CVE-2023-38888
15	IOBit Malware Fighter ImfHpRegFilter.sys الحرمان من الخدمة	4.4	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00042	0.00	CVE-2020-24089
16	ISL ARP Guard سكربتات مشتركة	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00044	0.02	CVE-2023-39575
17	Nagios XI Custom Logo سكربتات مشتركة	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00053	0.05	CVE-2023-40932
18	graphql Query Parser OverlappingFieldsCanBeMergedRule الحرمان من الخدمة	4.5	4.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00053	0.02	CVE-2023-26144
19	Linux Kernel BPF verifier.c backtrack_insn Remote Code Execution	9.5	9.4	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00043	0.00	CVE-2023-2163
20	Croc Custom Shared Secret Privilege Escalation	5.4	5.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00052	0.03	CVE-2023-43617

حملات (2)

These are the campaigns that can be associated with the actor:

Azorult
Xxxxxxxxxxx

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	عنوان بروتوكول الإنترنت	Hostname	ممثل	حملات	Identified	النوع	الثقة
1	2.59.42.63	vds-cw08597.timeweb.ru	Amadey Bot	Azorult	04/03/2022	verified	عالي
2	XX.XXX.XX.XXX		Xxxxxx Xxx		02/04/2024	verified	عالي
3	XXX.XX.X.XX	xxxxxxxxxxxx.xxxx.xxxxxxx	Xxxxxx Xxx	Xxxxxxxxxxx	02/08/2022	verified	عالي
4	XXX.XX.X.XX	xxxxxxxxxx.xxxx.xxxxxxx	Xxxxxx Xxx	Xxxxxxxxxxx	02/08/2022	verified	عالي

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	الثغرات	متجه الوصول	النوع	الثقة
1	T1006	CWE-22	Path Traversal	predictive	عالي
2	T1040	CWE-319	Authentication Bypass by Capture-replay	predictive	عالي
3	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	عالي
4	TXXXX	CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	عالي
5	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	عالي
6	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	عالي
7	TXXXX	CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	predictive	عالي
8	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	عالي
9	TXXXX	CWE-XXXX	Xxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxx Xxxxxxxx Xxxx Xx X Xxxxxxxx Xxxxxx	predictive	عالي
10	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	عالي
11	TXXXX	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	عالي
12	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	عالي
13	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	عالي
14	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	عالي
15	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	عالي

IOA - Indicator of Attack (101)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	الفئة	Indicator	النوع	الثقة
1	File	.ssh/authorized_keys	predictive	عالي
2	File	/admin/api/theme-edit/	predictive	عالي
3	File	/face-recognition-php/facepay-master/camera.php	predictive	عالي
4	File	/forum/PostPrivateMessage	predictive	عالي
5	File	/home/masterConsole	predictive	عالي
6	File	/hrm/employeeadd.php	predictive	عالي
7	File	/hrm/employeeview.php	predictive	عالي
8	File	/m4pdf/pdf.php	predictive	عالي
9	File	/nagiosxi/admin/banner_message-ajaxhelper.php	predictive	عالي
10	File	action.php	predictive	متوسط
11	File	admin.php&r=article/AdminContent/edit	predictive	عالي
12	File	admin.xml	predictive	متوسط
13	File	xxxxx/?xxxx=xxxxx	predictive	عالي
14	File	xxxx/xx_*.xxx	predictive	عالي
15	File	xxx.xxx	predictive	واطئ
16	File	xxxxxxxxxxx/xxxxxxxxxxx/xxxxxxxxx.xxx	predictive	عالي
17	File	xxxxxx/xxxxx/xxxxx.xxx	predictive	عالي
18	File	xxxxxxxx-xxx.xxx	predictive	عالي
19	File	xxxx/xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxx/xxx/xxxxxx.xxxxxxxxx.xxx	predictive	عالي
20	File	xxxxxx.xxxx	predictive	متوسط
21	File	xxxxx_xxxx.x	predictive	متوسط
22	File	xxxx_xxxxxx.xxx	predictive	عالي
23	File	xxxx_xxxxxxxxx.xxxxx	predictive	عالي
24	File	xx/xxxxx.xxx	predictive	متوسط
25	File	xxx/xxxxx.xxxxxxxxxxx.xxx	predictive	عالي
26	File	xxx/xxxxxx.xxx	predictive	عالي
27	File	xxxxx.xxx	predictive	متوسط
28	File	xxxxx.xxx?xxxx=xxxxx	predictive	عالي
29	File	xxxx_xxxx.xxx	predictive	عالي
30	File	xxxxxx.xxxxxxxxxx.xx	predictive	عالي
31	File	xxxxxx/xxx/xxxxxxxx.x	predictive	عالي
32	File	xxx/xxxxxxx/xxxxxx.xx	predictive	عالي
33	File	xxx/xxxxxx.xx	predictive	عالي
34	File	xxxxx.xxx	predictive	متوسط
35	File	xxxxx.xxx	predictive	متوسط
36	File	xxxx/xxx/xxxx/xxxx/xxx/xxxxxxx/xxxxxx/xxxxxxxxxxxxxxxxxxxx/xxxx/xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	عالي
37	File	xxxx/xxx/xxxx/xxxxxx/xxxxx/xxxxxxxx/xxxxxxxxxx/xxxxxxxxx.xxx	predictive	عالي
38	File	xxxxxxxxxx.xx	predictive	عالي
39	File	xxxx_xxxxxxxx.xxx	predictive	عالي
40	File	xxxxxxxx.xxx	predictive	متوسط
41	File	xxxxx_xxxxxx.xxx	predictive	عالي
42	File	xxxxx.x	predictive	واطئ
43	File	xxxxxxx_xxxxx.xxx	predictive	عالي
44	File	xxxxxxx/xxxxxxxxxx.xx	predictive	عالي
45	File	xxx_xxx.xxx	predictive	متوسط
46	File	xxxxxx-xxxxxxxx.xxx	predictive	عالي
47	File	xxxxxxxxx/xxxx/xxxxxxxx+xxxxxxxxx.x	predictive	عالي
48	File	xxxx_xxxxx.xxxx	predictive	عالي
49	File	xxx/xxxx/xxxx/xxxxxx/xxx/xxxxxxxxxxxxxxxx.xxxx	predictive	عالي
50	File	xxx/xxxx/xxxx/xxx/xxxxxx/xxxxxx/xxx/xxxxxxxxxxxxxxxxxx.xxxx	predictive	عالي
51	File	xxx/xxxxxxxxx.x	predictive	عالي
52	File	xxxxx_xxxxx.xxx	predictive	عالي
53	File	xxxxxx-xxxxxx.xxx	predictive	عالي
54	File	xxx/xxx.xxxxx.xxx	predictive	عالي
55	File	xxxxxxxx.xxx	predictive	متوسط
56	File	xxxx_xxxxxxxx.xxx	predictive	عالي
57	File	xxxxxxx.xxxx.xxx	predictive	عالي
58	Library	xxxxxx[xxxxxx_xxxx	predictive	عالي
59	Library	xxxxxxxxxxxxxx.xxx	predictive	عالي
60	Library	xxxxxx.xxx	predictive	متوسط
61	Library	xxxxx.xxx	predictive	متوسط
62	Argument	xxxxxx	predictive	واطئ
63	Argument	xxxxx	predictive	واطئ
64	Argument	xxxxxxxx	predictive	متوسط
65	Argument	xxxxxxxxxxxx	predictive	متوسط
66	Argument	xx	predictive	واطئ
67	Argument	xxxx_xx	predictive	واطئ
68	Argument	xxxxxxx	predictive	واطئ
69	Argument	xxxxxxxxxxxxx	predictive	عالي
70	Argument	xxxxxx[xxxxxx_xxxx]	predictive	عالي
71	Argument	xxxxxxx	predictive	واطئ
72	Argument	xxxxx	predictive	واطئ
73	Argument	xxxxxxxx	predictive	متوسط
74	Argument	xxxx_xx	predictive	واطئ
75	Argument	xx_xx	predictive	واطئ
76	Argument	xx	predictive	واطئ
77	Argument	xx	predictive	واطئ
78	Argument	xx_xxxxx	predictive	متوسط
79	Argument	xxxxxxxx	predictive	متوسط
80	Argument	xxxxx/xxxxxx	predictive	متوسط
81	Argument	xxxx	predictive	واطئ
82	Argument	xxxx	predictive	واطئ
83	Argument	xxxxx	predictive	واطئ
84	Argument	xxx_xxxx	predictive	متوسط
85	Argument	xxxx	predictive	واطئ
86	Argument	xxxx_xxxxxxxxxx	predictive	عالي
87	Argument	xxxxx	predictive	واطئ
88	Argument	xxxx_xxxx	predictive	متوسط
89	Argument	xxxxxxxx	predictive	متوسط
90	Argument	xxxx	predictive	واطئ
91	Argument	xxxxxx	predictive	واطئ
92	Argument	xxxxxxxxxxxxx	predictive	عالي
93	Argument	xxxxxx_xxxxxxxx	predictive	عالي
94	Argument	xxxxxxx/xxxxxxx	predictive	عالي
95	Argument	xxxx/xxxxxx xxxx	predictive	عالي
96	Argument	xxxx_xxx	predictive	متوسط
97	Argument	xxx	predictive	واطئ
98	Argument	xxx_xxx	predictive	واطئ
99	Argument	xxxxxx	predictive	واطئ
100	Argument	xxxxxxxx	predictive	متوسط
101	Argument	xxxxx	predictive	واطئ

المصادر (4)

The following list contains external sources which discuss the actor and the associated activities:

التالي ▸نظرة عامة◂ السابق

Interested in the pricing of exploits?

See the underground prices here!