AdKoob Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (47)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	44
de	2
es	2

Country

us	36
es	4
cn	4
br	2
ua	2

Actors

AdKoob	2

Activities

Interest

Timeline

Type

Not Defined	18
Operating System	6
Hosting Control Software	4
SCADA Software	4
Forum Software	4

Vendor

Not Defined	6
Microsoft	4
Plesk	4
Apache	4
BitDefender	4

Product

Microsoft Windows	4
Bolt	2
Plesk Obsidian	2
Plesk Onyx	2
Check Point SmartConsole	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	LogicBoard CMS away.php redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	3.95
2	Linux Kernel ksmbd smb2pdu.c smb2_tree_disconnect use after free	8.9	8.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00732	0.03	CVE-2022-47939
3	Bolt Filemanager FilesystemManager.php unrestricted upload	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00590	0.02	CVE-2019-9185
4	Schneider Electric Conext Gateway/ InsightHome/InsightFacility HTTP input validation	7.7	7.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00065	0.08	CVE-2023-29410
5	Gravy-media Media Photo Host forcedownload.php path traversal	5.3	4.9	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.02007	0.00	CVE-2009-2184
6	Ben3w 2bgal disp_album.php sql injection	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00268	0.00	CVE-2004-1415
7	Microsoft Windows SMB input validation	7.7	7.5	$25k-$100k	$0-$5k	High	Official Fix	0.97336	0.09	CVE-2017-0143
8	Nordex Control 2 SCADA Wind Farm Portal Application cross site scripting	4.3	4.3	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00277	0.04	CVE-2015-6477
9	Dell SupportAssist Client Consumer Advanced Driver Restore Component unnecessary privileges	8.3	8.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00042	0.03	CVE-2022-34384
10	phpMyDirectory index.php cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00572	0.00	CVE-2006-3138
11	SmartSiteCMS index.php privileges management	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01573	0.00	CVE-2006-3162
12	Pie Cart Pro index.php privileges management	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.37398	0.00	CVE-2006-4969
13	Apache HTTP Server Proxy null pointer dereference	6.7	6.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.30749	0.04	CVE-2021-44224
14	Apache HTTP Server mod_proxy_wstunnel improper authentication	7.3	7.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00280	0.00	CVE-2019-17567
15	ProtonMail Web Client Regular Expression resource consumption	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00117	0.00	CVE-2021-32816
16	Zoho ManageEngine ServiceDesk Plus MSP improper authentication	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00343	0.00	CVE-2021-44675
17	Zoho ManageEngine ServiceDesk Plus Secondary Email cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00502	0.00	CVE-2021-46065
18	Microsoft .NET Framework WinForms access control	5.6	5.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.26598	0.02	CVE-2015-1673
19	Microsoft Windows IIS memory corruption	7.9	7.6	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00182	0.03	CVE-2019-1365
20	Apache Tomcat HTTP/2 Client information disclosure	4.3	4.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00102	0.03	CVE-2020-13943

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	45.32.91.128	45.32.91.128.vultrusercontent.com	AdKoob	08/10/2018	verified	High
2	XXX.XXX.XXX.XXX		Xxxxxx	08/10/2018	verified	High
3	XXX.XXX.XXX.XXX	xxx-xxx-xxx.xxxxxxxxxxxx.xxx	Xxxxxx	08/10/2018	verified	High

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	High
4	TXXXX	CAPEC-104	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX	CAPEC-108	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
6	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
7	TXXXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
8	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
9	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
10	TXXXX	CAPEC-112	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
11	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (27)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/forum/away.php	predictive	High
2	File	/rapi/read_url	predictive	High
3	File	admin/index.php	predictive	High
4	File	airhost.exe	predictive	Medium
5	File	xxxxxxxxxx/xxxxx/xxxxxxxxxxxxxxxxx.xxx	predictive	High
6	File	xx/xxxxx.xxx	predictive	Medium
7	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
8	File	xxxx_xxxxx.xxx	predictive	High
9	File	xxxxx.xxx	predictive	Medium
10	File	xxxxxxxxxxxxx.xxx	predictive	High
11	File	xx/xxxxx/xxxxxxx.x	predictive	High
12	File	xxxxx.xxx	predictive	Medium
13	File	x_xxxxxxxx_xxxxx	predictive	High
14	File	xxxxxxxx.xxx/xxxxx.xxx	predictive	High
15	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	High
16	File	xxxxxx.xxxx	predictive	Medium
17	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	High
18	Argument	xxxx	predictive	Low
19	Argument	xxxx	predictive	Low
20	Argument	xx	predictive	Low
21	Argument	xx_xxxxx	predictive	Medium
22	Argument	xxx_xxx	predictive	Low
23	Argument	xxxxx	predictive	Low
24	Argument	x_xxxxxxxx	predictive	Medium
25	Argument	xxxx	predictive	Low
26	Argument	xxxxxxxx-xxxxxxxx	predictive	High
27	Input Value	xxxxxxxxxxxxxxxx	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!