AvosLocker Analiza

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (66)

Język

en	56
fr	6
es	2
pl	2

Kraj

fr	6
es	2
ru	2
us	2

Aktorzy

AvosLocker	1
Tofsee	1
Amadey	1
RedLine Stealer	1
RedLine	1

Wysiłek

Rodzaj

Not Defined	20
Content Management System	4
Enterprise Resource Planning Software	2
Router Operating System	2
Customer Relationship Management System	2

Sprzedawca

Not Defined	12
HP	6
Coinsoft Technologies	2
Canto	2
GESIO	2

Produkt

HP SAN	4
HP iQ	4
Hydra	2
Coinsoft Technologies phpCOIN	2
Canto Cumulus	2

Luki w zabezpieczeniach

#	Słaby punkt	Base	Temp	0day	Dzisiaj	Wyk	Prz	EPSS	CTI	CVE
1	HP SAN/iQ hydra.exe privilege escalation	4.3	3.9	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00277	0.00	CVE-2012-4362
2	Hydra HTTP Header read.c process_header_end denial of service	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00117	0.02	CVE-2019-17502
3	IW Guestbook badwords_edit.asp sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
4	Hydra weak authentication	5.6	5.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00099	0.00	CVE-2020-5300
5	OmniSecure AddUrlShield index.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.02
6	ORY Hydra error Reflected cross site scripting	5.2	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00097	0.00	CVE-2019-8400
7	PHPGurukul Hospital Management System dashboard.php privilege escalation	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00661	0.02	CVE-2020-35745
8	HP SAN/iQ Login hydra.exe memory corruption	10.0	9.5	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.46643	0.00	CVE-2011-4157
9	HP LeftHand Virtual SAN Appliance hydra memory corruption	10.0	9.5	$25k-$100k	$0-$5k	High	Official Fix	0.77622	0.00	CVE-2013-2343
10	Coinsoft Technologies phpCOIN db.php privilege escalation	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.07606	0.00	CVE-2005-4211
11	Coinsoft Technologies phpCOIN db.php directory traversal	5.3	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.03877	0.02	CVE-2005-4212
12	Ilohamail cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.09
13	Small CRM cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00052	0.00	CVE-2023-44075
14	Intern Record System controller.php cross site scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00087	0.00	CVE-2022-40348
15	Sitekit CMS registration-form.html cross site scripting	3.5	3.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
16	Microsoft Windows Backup Service Privilege Escalation	7.7	7.1	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00389	0.04	CVE-2023-21752
17	SunHater KCFinder upload.php cross site scripting	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00131	0.04	CVE-2019-14315
18	Canto Cumulus login privilege escalation	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00283	0.02	CVE-2022-40305
19	IW Guestbook messages_edit.asp sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
20	CKEditor Clipboard Package privilege escalation	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00163	0.03	CVE-2021-32809

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adres IP	Hostname	Aktor	Kampanie	Identified	Rodzaj	Pewność siebie
1	45.136.230.191	www.seedbox.vip	AvosLocker		2022-12-21	verified	Wysoki
2	XXX.XXX.XXX.XXX		Xxxxxxxxxx		2022-12-21	verified	Wysoki

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Luki w zabezpieczeniach	Wektor dostępu	Rodzaj	Pewność siebie
1	T1006	CWE-22	Path Traversal	predictive	Wysoki
2	T1040	CWE-294	Authentication Bypass by Capture-replay	predictive	Wysoki
3	TXXXX	CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	Wysoki
4	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Wysoki
5	TXXXX	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
6	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Wysoki
7	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki

IOA - Indicator of Attack (29)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasa	Indicator	Rodzaj	Pewność siebie
1	File	/cwc/login	predictive	Medium
2	File	/intern/controller.php	predictive	Wysoki
3	File	/iwguestbook/admin/badwords_edit.asp	predictive	Wysoki
4	File	/iwguestbook/admin/messages_edit.asp	predictive	Wysoki
5	File	xxxxx/xxxxxxxxx.xxx	predictive	Wysoki
6	File	xxxxx.xxx	predictive	Medium
7	File	xxxx_xxxxxxxx/xx.xxx	predictive	Wysoki
8	File	xxxxx.xxx	predictive	Medium
9	File	xxxxx.xxx	predictive	Medium
10	File	xxxxx.xxx/xxxxxxxxxxxxx/xxx	predictive	Wysoki
11	File	xxxxxx/xxxxxxxxx/xxxxx	predictive	Wysoki
12	File	xxxx.x	predictive	Niski
13	File	xxxxxxxxxxxx-xxxx.xxxx	predictive	Wysoki
14	File	xxxxxx.xxx	predictive	Medium
15	File	xx-xxxxx/xxxxx-xxxxxx.xxx	predictive	Wysoki
16	Argument	xxxxxxx	predictive	Niski
17	Argument	xxxxxx	predictive	Niski
18	Argument	xxxxxxxxxxxxxxx	predictive	Wysoki
19	Argument	xxxxxxxxx	predictive	Medium
20	Argument	xxxxxxx-xxxxxx	predictive	Wysoki
21	Argument	xxxxx_xxxx	predictive	Medium
22	Argument	xxxxxx$xxxxx	predictive	Medium
23	Argument	xx	predictive	Niski
24	Argument	xxxxx	predictive	Niski
25	Argument	xxxx/xxxxx	predictive	Medium
26	Argument	xxxx_xx	predictive	Niski
27	Argument	xxxxxx	predictive	Niski
28	Argument	_xxxx[_xxx_xxxx_xxxx	predictive	Wysoki
29	Input Value	x+xxxxx+xxxxxx+x,xxxxxxx,xxxxxxxxxxx+xxxx+xxxxx#	predictive	Wysoki

Referencje (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PoprzedniPrzeglądKolejny ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!