Avos Analisi

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (66)

Linguaggio

en	46
fr	14
es	4
de	2

Nazione

fr	14
us	4
es	4
de	2

Attori

AvosLocker	1
Tofsee	1
Amadey	1
RedLine Stealer	1
RedLine	1

Interesse

Genere

Not Defined	24
Content Management System	4
Customer Relationship Management System	2

Fornitore

Not Defined	14
HP	4
IW	2
Huawei	2
ORY	2

Prodotto

Hydra	4
HP SAN	4
HP iQ	4
Intern Record System	2
Small CRM	2

Vulnerabilità

#	Vulnerabilità	Base	Temp	0day	Oggi	Sfr	Con	EPSS	CTI	CVE
1	HP SAN/iQ hydra.exe escalazione di privilegi	4.3	3.9	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00277	0.00	CVE-2012-4362
2	Hydra HTTP Header read.c process_header_end denial of service	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00117	0.02	CVE-2019-17502
3	IW Guestbook badwords_edit.asp sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
4	Hydra autenticazione debole	5.6	5.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00099	0.00	CVE-2020-5300
5	OmniSecure AddUrlShield index.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.02
6	ORY Hydra error Reflected cross site scripting	5.2	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00097	0.00	CVE-2019-8400
7	PHPGurukul Hospital Management System dashboard.php escalazione di privilegi	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00661	0.02	CVE-2020-35745
8	HP SAN/iQ Login hydra.exe buffer overflow	10.0	9.5	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.46643	0.00	CVE-2011-4157
9	HP LeftHand Virtual SAN Appliance hydra buffer overflow	10.0	9.5	$25k-$100k	$0-$5k	High	Official Fix	0.77622	0.00	CVE-2013-2343
10	Coinsoft Technologies phpCOIN db.php escalazione di privilegi	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.07606	0.00	CVE-2005-4211
11	Coinsoft Technologies phpCOIN db.php directory traversal	5.3	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.03877	0.02	CVE-2005-4212
12	Ilohamail cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.07
13	Small CRM cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00052	0.00	CVE-2023-44075
14	Intern Record System controller.php cross site scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00087	0.00	CVE-2022-40348
15	Sitekit CMS registration-form.html cross site scripting	3.5	3.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
16	Microsoft Windows Backup Service Privilege Escalation	7.7	7.1	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00389	0.04	CVE-2023-21752
17	SunHater KCFinder upload.php cross site scripting	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00131	0.00	CVE-2019-14315
18	Canto Cumulus login escalazione di privilegi	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00283	0.02	CVE-2022-40305
19	IW Guestbook messages_edit.asp sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
20	CKEditor Clipboard Package escalazione di privilegi	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00163	0.03	CVE-2021-32809

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	indirizzo IP	Hostname	Attore	Campagne	Identified	Genere	Fiducia
1	45.136.230.191		Avos		29/07/2022	verified	Alto
2	XXX.XXX.XXX.XXX		Xxxx		29/07/2022	verified	Alto

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classe	Vulnerabilità	Accesso al vettore	Genere	Fiducia
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Alto
2	T1040	CAPEC-102	CWE-294	Authentication Bypass by Capture-replay	predictive	Alto
3	TXXXX	CAPEC-242	CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	Alto
4	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
5	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
7	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (29)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Genere	Fiducia
1	File	/cwc/login	predictive	Media
2	File	/intern/controller.php	predictive	Alto
3	File	/iwguestbook/admin/badwords_edit.asp	predictive	Alto
4	File	/iwguestbook/admin/messages_edit.asp	predictive	Alto
5	File	xxxxx/xxxxxxxxx.xxx	predictive	Alto
6	File	xxxxx.xxx	predictive	Media
7	File	xxxx_xxxxxxxx/xx.xxx	predictive	Alto
8	File	xxxxx.xxx	predictive	Media
9	File	xxxxx.xxx	predictive	Media
10	File	xxxxx.xxx/xxxxxxxxxxxxx/xxx	predictive	Alto
11	File	xxxxxx/xxxxxxxxx/xxxxx	predictive	Alto
12	File	xxxx.x	predictive	Basso
13	File	xxxxxxxxxxxx-xxxx.xxxx	predictive	Alto
14	File	xxxxxx.xxx	predictive	Media
15	File	xx-xxxxx/xxxxx-xxxxxx.xxx	predictive	Alto
16	Argument	xxxxxxx	predictive	Basso
17	Argument	xxxxxx	predictive	Basso
18	Argument	xxxxxxxxxxxxxxx	predictive	Alto
19	Argument	xxxxxxxxx	predictive	Media
20	Argument	xxxxxxx-xxxxxx	predictive	Alto
21	Argument	xxxxx_xxxx	predictive	Media
22	Argument	xxxxxx$xxxxx	predictive	Media
23	Argument	xx	predictive	Basso
24	Argument	xxxxx	predictive	Basso
25	Argument	xxxx/xxxxx	predictive	Media
26	Argument	xxxx_xx	predictive	Basso
27	Argument	xxxxxx	predictive	Basso
28	Argument	_xxxx[_xxx_xxxx_xxxx	predictive	Alto
29	Input Value	x+xxxxx+xxxxxx+x,xxxxxxx,xxxxxxxxxxx+xxxx+xxxxx#	predictive	Alto

Referenze (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrecedenteVisione D'insiemeIl prossimo ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!