Hotcroissant Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (11)

Idioma

en	12

País

us	8
ru	2
cn	2

Actores

Hotcroissant	1
Responder	1
Cobalt Strike	1
RedLine Stealer	1
Ave Maria	1

Interesar

Escribe

Not Defined	6
Operating System	2
Mail Server Software	2
Programming Language Software	2

Proveedor

Not Defined	4
Microsoft	2
Yokogawa	2
MDaemon	2
Thomas R. Pasawicz	2

Producto

Microsoft Windows	2
Yokogawa CENTUM CS 3000	2
Communigate Pro	2
MDaemon Webmail	2
PHP	2

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	Yokogawa CENTUM CS 3000 escalada de privilegios	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00763	0.00	CVE-2018-16196
2	Python socket.recvfrom_into desbordamiento de búfer	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.52975	0.02	CVE-2014-1912
3	Microsoft Windows Print Spooler Local Privilege Escalation	7.5	6.9	$25k-$100k	$0-$5k	High	Official Fix	0.96825	0.00	CVE-2021-1675
4	MODX Revolution index.php sql injection	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00385	0.00	CVE-2014-2736
5	Communigate Pro Pronto! Mail Composer Stored cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00165	0.00	CVE-2018-18621
6	Laravel Framework Token Encrypter.php decrypt escalada de privilegios	6.8	6.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.62418	0.03	CVE-2018-15133
7	Pivotal RabbitMQ password escalada de privilegios	7.7	7.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00343	0.00	CVE-2016-9877
8	MDaemon Webmail cross site scripting	5.4	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00070	0.02	CVE-2019-8983
9	PHP com_print_typeinfo desbordamiento de búfer	10.0	9.4	$25k-$100k	$0-$5k	Proof-of-Concept	Not Defined	0.25603	0.04	CVE-2012-2376
10	GraphicsMagick DPX Image dpx.c ReadDPXImage denegación de servicio	4.4	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00140	0.03	CVE-2017-10799
11	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgación de información	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192

Campañas (1)

These are the campaigns that can be associated with the actor:

Hotcroissant

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Campañas	Identified	Escribe	Confianza
1	94.177.123.138		Lazarus	Hotcroissant	2020-12-17	verified	Alto

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1059.007	CWE-79	Cross Site Scripting	predictive	Alto
2	TXXXX	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
3	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
4	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (9)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	/MIME/INBOX-MM-1/	predictive	Alto
2	File	coders/dpx.c	predictive	Medio
3	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Alto
4	File	xxxxxxxxxx/xxxxxxxxxx/xxxxxxxxx.xxx	predictive	Alto
5	File	xxxxx.xxx	predictive	Medio
6	File	xxxxxxxx/xxxxxxxx	predictive	Alto
7	Argument	xx	predictive	Bajo
8	Argument	xxxxx	predictive	Bajo
9	Argument	x-xxxx-xxxxx	predictive	Medio

Referencias (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Might our Artificial Intelligence support you?

Check our Alexa App!