Astro Locker Analyse

IOB - Indicator of Behavior (45)

Chronologie

Langue

en42
ru2
zh2

De campagne

us22
ru10
ir4

Acteurs

Activités

Intérêt

Chronologie

Taper

Fournisseur

Produit

Microsoft Windows4
ZyXEL PK5001Z2
Omron CX-One CX-Programmer2
ampleShop2
libssh2

Vulnérabilités

#VulnérabilitéBaseTemp0dayAujourd'huiExpConEPSSCTICVE
1Microsoft Windows Win32k Local Privilege Escalation7.87.1$25k-$100k$5k-$25kUnprovenOfficial Fix0.000480.02CVE-2023-36743
2zoujingli ThinkAdmin Update.php elévation de privilèges8.08.0$0-$5k$0-$5kNot DefinedNot Defined0.010880.02CVE-2020-23653
3Apache HTTP Server ETag divulgation de l'information5.35.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.001610.05CVE-2003-1418
4Huawei Flybox B660 indexdefault.asp authentification faible7.36.7$5k-$25k$0-$5kProof-of-ConceptWorkaround0.000000.05
5OpenKM Community Edition XMLReader Parser XMLTextExtractor.java XML External Entity8.28.1$0-$5k$0-$5kNot DefinedNot Defined0.002010.00CVE-2022-2131
6OpenKM FileUtils.java getFileExtension elévation de privilèges3.63.5$0-$5k$0-$5kNot DefinedOfficial Fix0.000450.00CVE-2022-3969
7Linux Kernel smb2ops.c smb2_dump_detail divulgation de l'information6.26.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.000420.00CVE-2023-6610
8Microsoft Windows Local Security Authority Subsystem Service divulgation de l'information5.14.7$25k-$100k$5k-$25kUnprovenOfficial Fix0.000480.02CVE-2023-36428
9Linux Kernel io_uring Subsystem race condition7.57.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000420.06CVE-2023-1295
10Microsoft Exchange Server Privilege Escalation8.37.6$25k-$100k$5k-$25kUnprovenOfficial Fix0.000800.06CVE-2023-36745
11Microsoft Windows TPM Device Driver Local Privilege Escalation7.87.1$25k-$100k$5k-$25kUnprovenOfficial Fix0.004090.06CVE-2023-29360
12Wazuh Dashboard elévation de privilèges7.57.4$0-$5k$0-$5kNot DefinedOfficial Fix0.000600.03CVE-2023-42455
13Microsoft Exchange Server ProxyShell vulnérabilité inconnue9.48.2$25k-$100k$5k-$25kUnprovenOfficial Fix0.782220.00CVE-2021-34523
14Microsoft Exchange Server ProxyShell Remote Code Execution9.58.2$25k-$100k$5k-$25kUnprovenOfficial Fix0.973190.02CVE-2021-34473
15Microsoft Exchange Server Privilege Escalation8.07.3$5k-$25k$5k-$25kUnprovenOfficial Fix0.000950.04CVE-2023-28310
16Linux Kernel buffer overflow7.47.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.000420.04CVE-2023-0461
17Red Hat DataGrid/Infinispan REST Endpoint authentification faible6.36.3$5k-$25k$5k-$25kNot DefinedNot Defined0.001970.00CVE-2021-31917
18libssh pki_verify_data_signature elévation de privilèges5.55.5$0-$5k$0-$5kNot DefinedNot Defined0.001390.02CVE-2023-2283
19Microsoft Windows HTTP Protocol Stack Remote Code Execution9.88.9$25k-$100k$5k-$25kUnprovenOfficial Fix0.010930.00CVE-2023-23392
20OpenBSD OpenSSH compat.c buffer overflow7.77.6$5k-$25k$0-$5kNot DefinedOfficial Fix0.009580.04CVE-2023-25136

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnérabilitésVecteur d'accèsTaperConfiance
1T1068CWE-284Execution with Unnecessary PrivilegespredictiveÉlevé
2T1078.001CWE-259Use of Hard-coded PasswordpredictiveÉlevé
3TXXXX.XXXCWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveÉlevé
4TXXXXCWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveÉlevé
5TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveÉlevé
6TXXXXCWE-XXXxx XxxxxxxxxpredictiveÉlevé
7TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
8TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveÉlevé
9TXXXX.XXXCWE-XXXXxx Xxxxxxxxxx XxxxxpredictiveÉlevé

IOA - Indicator of Attack (20)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorTaperConfiance
1File/htmlcode/html/indexdefault.asppredictiveÉlevé
2Fileajax_admin_apis.phppredictiveÉlevé
3Fileajax_php_pecl.phppredictiveÉlevé
4Filexxx/xxxxx/xxxxxxxxxx/xxx/xxxxxx.xxxpredictiveÉlevé
5Filexxxxx.xxxpredictiveMoyen
6Filexxxxxxxx.xxxpredictiveMoyen
7Filexxxxxx.xpredictiveMoyen
8Filexx/xxx/xxxxxx/xxxxxxx.xpredictiveÉlevé
9Filexxx/xxxx/xxxx/xxx/xxxxxx/xxxx/xxxxxxxxx.xxxxpredictiveÉlevé
10Filexxxxxxxxxxxxxxxx.xxxxpredictiveÉlevé
11ArgumentxxxxxxpredictiveFaible
12ArgumentxxxpredictiveFaible
13Argumentxxxxxxxx_xxpredictiveMoyen
14ArgumentxxxxpredictiveFaible
15Argumentxxxxxxx.xxx_xxxxxxxxxxpredictiveÉlevé
16ArgumentxxxxxxxxxxpredictiveMoyen
17ArgumentxxpredictiveFaible
18Input Valuexxxx:xxxxxxxxpredictiveÉlevé
19Input ValuexxxxxxxxpredictiveMoyen
20Network Portxxx/xxxxpredictiveMoyen

Références (2)

The following list contains external sources which discuss the actor and the associated activities:

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!