Amadey Bot Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (134)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	118
es	4
ru	4
ar	2
de	2

Country

ru	56
us	16
de	2
it	2
fr	2

Actors

Amadey Bot	2
RedLine Stealer	2
Rhadamanthys	2
Amadey	2
Aurora Stealer	1

Activities

Interest

Timeline

Type

Not Defined	82
File Compression Software	6
Content Management System	6
Enterprise Resource Planning Software	6
Log Management Software	4

Vendor

Not Defined	42
D-Link	8
SourceCodester	8
Dolibarr	6
LF-Edge	4

Product

Dolibarr ERP CRM	6
Croc	6
D-Link DI-7200GV2.E1	4
7-zip	4
D-Link DWL-6610	4

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	openSUSE welcome Local Privilege Escalation	4.5	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00055	0.02	CVE-2023-32184
2	SourceCodester Medical Certificate Generator App action.php sql injection	8.1	7.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00116	0.00	CVE-2023-0774
3	Microsoft Exchange Server Remote Code Execution	7.6	7.1	$25k-$100k	$0-$5k	Functional	Official Fix	0.23441	0.06	CVE-2021-31206
4	nginx request smuggling	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	2.66	CVE-2020-12440
5	JetBrains TeamCity authentication bypass	8.5	8.4	$0-$5k	$0-$5k	High	Official Fix	0.97104	0.00	CVE-2023-42793
6	Nagios XI POST Request banner_message-ajaxhelper.php sql injection	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00085	0.04	CVE-2023-40931
7	Openupload Stable compress-inc.php unrestricted upload	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00097	0.00	CVE-2023-36319
8	Dolibarr ERP CRM unrestricted upload	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00097	0.03	CVE-2023-38887
9	NVIDIA DGX H100 BMC Host KVM Daemon memory corruption	7.8	7.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00042	0.05	CVE-2023-25527
10	NVIDIA Cumulus Linux VxLAN-encapsulated IPv6 Packet information disclosure	5.9	5.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00087	0.00	CVE-2023-25525
11	Mitsubishi Electric GX Works3 Incomplete Fix CVE-2020-14496 default permission	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00042	0.00	CVE-2023-4088
12	NVIDIA DGX H100 BMC Web Server Plugin stack-based overflow	9.1	9.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00119	0.00	CVE-2023-25528
13	Dolibarr ERP CRM Command Privilege Escalation	6.7	6.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00160	0.00	CVE-2023-38886
14	Dolibarr ERP CRM REST API Module testSqlAndScriptject cross site scripting	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00178	0.02	CVE-2023-38888
15	IOBit Malware Fighter ImfHpRegFilter.sys denial of service	4.4	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00042	0.00	CVE-2020-24089
16	ISL ARP Guard cross site scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00044	0.02	CVE-2023-39575
17	Nagios XI Custom Logo cross site scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00053	0.05	CVE-2023-40932
18	graphql Query Parser OverlappingFieldsCanBeMergedRule denial of service	4.5	4.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00053	0.00	CVE-2023-26144
19	Linux Kernel BPF verifier.c backtrack_insn calculation	9.5	9.4	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00043	0.00	CVE-2023-2163
20	Croc Custom Shared Secret Privilege Escalation	5.4	5.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00052	0.03	CVE-2023-43617

Campaigns (2)

These are the campaigns that can be associated with the actor:

Azorult
Xxxxxxxxxxx

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	2.59.42.63	vds-cw08597.timeweb.ru	Amadey Bot	Azorult	03/04/2022	verified	High
2	XX.XXX.XX.XXX		Xxxxxx Xxx		04/02/2024	verified	High
3	XXX.XX.X.XX	xxxxxxxxxxxx.xxxx.xxxxxxx	Xxxxxx Xxx	Xxxxxxxxxxx	08/02/2022	verified	High
4	XXX.XX.X.XX	xxxxxxxxxx.xxxx.xxxxxxx	Xxxxxx Xxx	Xxxxxxxxxxx	08/02/2022	verified	High

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1040	CAPEC-102	CWE-319	Authentication Bypass by Capture-replay	predictive	High
3	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
4	TXXXX	CAPEC-242	CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	High
5	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
6	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
7	TXXXX	CAPEC-	CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	predictive	High
8	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
9	TXXXX	CAPEC-	CWE-XXXX	Xxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxx Xxxxxxxx Xxxx Xx X Xxxxxxxx Xxxxxx	predictive	High
10	TXXXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
11	TXXXX	CAPEC-108	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	High
12	TXXXX	CAPEC-102	CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
13	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
14	TXXXX	CAPEC-157	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
15	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (101)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	.ssh/authorized_keys	predictive	High
2	File	/admin/api/theme-edit/	predictive	High
3	File	/face-recognition-php/facepay-master/camera.php	predictive	High
4	File	/forum/PostPrivateMessage	predictive	High
5	File	/home/masterConsole	predictive	High
6	File	/hrm/employeeadd.php	predictive	High
7	File	/hrm/employeeview.php	predictive	High
8	File	/m4pdf/pdf.php	predictive	High
9	File	/nagiosxi/admin/banner_message-ajaxhelper.php	predictive	High
10	File	action.php	predictive	Medium
11	File	admin.php&r=article/AdminContent/edit	predictive	High
12	File	admin.xml	predictive	Medium
13	File	xxxxx/?xxxx=xxxxx	predictive	High
14	File	xxxx/xx_*.xxx	predictive	High
15	File	xxx.xxx	predictive	Low
16	File	xxxxxxxxxxx/xxxxxxxxxxx/xxxxxxxxx.xxx	predictive	High
17	File	xxxxxx/xxxxx/xxxxx.xxx	predictive	High
18	File	xxxxxxxx-xxx.xxx	predictive	High
19	File	xxxx/xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxx/xxx/xxxxxx.xxxxxxxxx.xxx	predictive	High
20	File	xxxxxx.xxxx	predictive	Medium
21	File	xxxxx_xxxx.x	predictive	Medium
22	File	xxxx_xxxxxx.xxx	predictive	High
23	File	xxxx_xxxxxxxxx.xxxxx	predictive	High
24	File	xx/xxxxx.xxx	predictive	Medium
25	File	xxx/xxxxx.xxxxxxxxxxx.xxx	predictive	High
26	File	xxx/xxxxxx.xxx	predictive	High
27	File	xxxxx.xxx	predictive	Medium
28	File	xxxxx.xxx?xxxx=xxxxx	predictive	High
29	File	xxxx_xxxx.xxx	predictive	High
30	File	xxxxxx.xxxxxxxxxx.xx	predictive	High
31	File	xxxxxx/xxx/xxxxxxxx.x	predictive	High
32	File	xxx/xxxxxxx/xxxxxx.xx	predictive	High
33	File	xxx/xxxxxx.xx	predictive	High
34	File	xxxxx.xxx	predictive	Medium
35	File	xxxxx.xxx	predictive	Medium
36	File	xxxx/xxx/xxxx/xxxx/xxx/xxxxxxx/xxxxxx/xxxxxxxxxxxxxxxxxxxx/xxxx/xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	High
37	File	xxxx/xxx/xxxx/xxxxxx/xxxxx/xxxxxxxx/xxxxxxxxxx/xxxxxxxxx.xxx	predictive	High
38	File	xxxxxxxxxx.xx	predictive	High
39	File	xxxx_xxxxxxxx.xxx	predictive	High
40	File	xxxxxxxx.xxx	predictive	Medium
41	File	xxxxx_xxxxxx.xxx	predictive	High
42	File	xxxxx.x	predictive	Low
43	File	xxxxxxx_xxxxx.xxx	predictive	High
44	File	xxxxxxx/xxxxxxxxxx.xx	predictive	High
45	File	xxx_xxx.xxx	predictive	Medium
46	File	xxxxxx-xxxxxxxx.xxx	predictive	High
47	File	xxxxxxxxx/xxxx/xxxxxxxx+xxxxxxxxx.x	predictive	High
48	File	xxxx_xxxxx.xxxx	predictive	High
49	File	xxx/xxxx/xxxx/xxxxxx/xxx/xxxxxxxxxxxxxxxx.xxxx	predictive	High
50	File	xxx/xxxx/xxxx/xxx/xxxxxx/xxxxxx/xxx/xxxxxxxxxxxxxxxxxx.xxxx	predictive	High
51	File	xxx/xxxxxxxxx.x	predictive	High
52	File	xxxxx_xxxxx.xxx	predictive	High
53	File	xxxxxx-xxxxxx.xxx	predictive	High
54	File	xxx/xxx.xxxxx.xxx	predictive	High
55	File	xxxxxxxx.xxx	predictive	Medium
56	File	xxxx_xxxxxxxx.xxx	predictive	High
57	File	xxxxxxx.xxxx.xxx	predictive	High
58	Library	xxxxxx[xxxxxx_xxxx	predictive	High
59	Library	xxxxxxxxxxxxxx.xxx	predictive	High
60	Library	xxxxxx.xxx	predictive	Medium
61	Library	xxxxx.xxx	predictive	Medium
62	Argument	xxxxxx	predictive	Low
63	Argument	xxxxx	predictive	Low
64	Argument	xxxxxxxx	predictive	Medium
65	Argument	xxxxxxxxxxxx	predictive	Medium
66	Argument	xx	predictive	Low
67	Argument	xxxx_xx	predictive	Low
68	Argument	xxxxxxx	predictive	Low
69	Argument	xxxxxxxxxxxxx	predictive	High
70	Argument	xxxxxx[xxxxxx_xxxx]	predictive	High
71	Argument	xxxxxxx	predictive	Low
72	Argument	xxxxx	predictive	Low
73	Argument	xxxxxxxx	predictive	Medium
74	Argument	xxxx_xx	predictive	Low
75	Argument	xx_xx	predictive	Low
76	Argument	xx	predictive	Low
77	Argument	xx	predictive	Low
78	Argument	xx_xxxxx	predictive	Medium
79	Argument	xxxxxxxx	predictive	Medium
80	Argument	xxxxx/xxxxxx	predictive	Medium
81	Argument	xxxx	predictive	Low
82	Argument	xxxx	predictive	Low
83	Argument	xxxxx	predictive	Low
84	Argument	xxx_xxxx	predictive	Medium
85	Argument	xxxx	predictive	Low
86	Argument	xxxx_xxxxxxxxxx	predictive	High
87	Argument	xxxxx	predictive	Low
88	Argument	xxxx_xxxx	predictive	Medium
89	Argument	xxxxxxxx	predictive	Medium
90	Argument	xxxx	predictive	Low
91	Argument	xxxxxx	predictive	Low
92	Argument	xxxxxxxxxxxxx	predictive	High
93	Argument	xxxxxx_xxxxxxxx	predictive	High
94	Argument	xxxxxxx/xxxxxxx	predictive	High
95	Argument	xxxx/xxxxxx xxxx	predictive	High
96	Argument	xxxx_xxx	predictive	Medium
97	Argument	xxx	predictive	Low
98	Argument	xxx_xxx	predictive	Low
99	Argument	xxxxxx	predictive	Low
100	Argument	xxxxxxxx	predictive	Medium
101	Argument	xxxxx	predictive	Low

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you need the next level of professionalism?

Upgrade your account now!