cybermaterial.com
Open in
urlscan Pro
35.244.172.81
Public Scan
URL:
https://cybermaterial.com/androxgh0st-malware-targets-laravel-apps/
Submission: On March 23 via api from US — Scanned from US
Submission: On March 23 via api from US — Scanned from US
Form analysis 8 forms found in the DOM
GET https://cybermaterial.com/
<form action="https://cybermaterial.com/" method="get" class="jeg_search_form" target="_top">
<input name="s" class="jeg_search_input" placeholder="Search..." type="text" value="" autocomplete="off">
<button aria-label="Search Button" type="submit" class="jeg_search_button btn"><i class="fa fa-search"></i></button>
</form>GET https://cybermaterial.com/
<form action="https://cybermaterial.com/" method="get" class="jeg_search_form" target="_top">
<input name="s" class="jeg_search_input" placeholder="Search..." type="text" value="" autocomplete="off">
<button aria-label="Search Button" type="submit" class="jeg_search_button btn"><i class="fa fa-search"></i></button>
</form>GET https://cybermaterial.com/
<form action="https://cybermaterial.com/" method="get" class="jeg_search_form" target="_top">
<input name="s" class="jeg_search_input" placeholder="Search..." type="text" value="" autocomplete="off">
<button aria-label="Search Button" type="submit" class="jeg_search_button btn"><i class="fa fa-search"></i></button>
</form>POST /androxgh0st-malware-targets-laravel-apps/#wpcf7-f101133-p121902-o1
<form action="/androxgh0st-malware-targets-laravel-apps/#wpcf7-f101133-p121902-o1" method="post" class="wpcf7-form init" aria-label="Contact form" novalidate="novalidate" data-status="init">
<div style="display: none;">
<input type="hidden" name="_wpcf7" value="101133">
<input type="hidden" name="_wpcf7_version" value="5.9.2">
<input type="hidden" name="_wpcf7_locale" value="en_US">
<input type="hidden" name="_wpcf7_unit_tag" value="wpcf7-f101133-p121902-o1">
<input type="hidden" name="_wpcf7_container_post" value="121902">
<input type="hidden" name="_wpcf7_posted_data_hash" value="">
<input type="hidden" name="_wpcf7_recaptcha_response"
value="03AFcWeA70DPU5EaGyPqaQGE7D217qK_s9-5xkaMPU2zgLQKhzAaY26GW_YbstWAYcrrfbPRMGKKvYTCVeQjEghb1YrRHzmMtbmpzCuHfvC86f1zymMJYLghS8m75mSGPe-cyyy2z55np91QWtafo88hqDNavIOsONZqmLSrPUjHsPo4TOrDdqz9JbNU9umpHFt0OT81Gq4XPwqODYkStwbbPLLIcABlAdLUDLTseoTZPfAcRY9LURHqy8ttgCKBO0UT0QJcSJPL6XR8DcNYCYTGGU71yUU502KOiUztL3dykOW7O84092I-HzPDlkscVLuKn8UvLoC8-IJd4NtHkBywIUVvzhypSE7EIuvr66wjJbXJz3WTSpNPa08h77HL94rKyPskQ_hdsJ-AOTjTnUE2pSLaKAsexuzT8yMKYOAMVLaK5fDh_PCGrVr8mh5CdX1KxOI9WDLbq403rhnq8c0z2cYxR-LGeY8ecLyargbStz_E0AV7FUhvoZA9bfgE55hlYcwsW4r-H5vZgUQSmo9Ylklw9aNkyEGLk06zfyZcKygv6J0VaQ2H2uzGUlKz18JOujenfGq3L9kWIyHUMHpc8kPFwXTGDtFhy97xNBQhTRHwB0jreg1gRY0MRQNZ80fKaQnce2X6NNSbvzWQz2KL-y64OfQITjb1wCNPKoGzkf6a99QT2w8VLLYOle3lUPSkp3doKS2c3hSh93WW3p79NRf9zB_wABAXC1mWYsG_DWb3T1cbNAgP4-HOBGWXonxJ7dWafUduzWmNHKYAKtoAOByWrMA49-LS2yYvJDXP6fIZ8p75ZUf8wj_MmqEOFEKAL5alrlY45lwQI_7Nm8jvD7RZyLDmR8YCUbJtnM8qZ_DM-rTYZKtBCQRFP3jbsS6RfX_RcShLU5S7YoFKOYWJW56NZr4Mq-8Yp376IaoPyxaArQoU4Kfzi_oVIHqI4sr8--Gd0hZqHh-kQOXGCrZWMHSmVAiI0vcvGEO2SkBF1fg5N8LyaNmTdeLv1WeCTfT4JW9KN42SlgcEwb8aLER0HnDci4B5JS6_cGBRpuATK_HSmjOxj4-1hiE5VAJjA8SJ9igDacVNGPN1lShgL1v-NYaOLv0BeyIo7lDtH4kvodRzNMlhkhmVYVfpwRAX4V8UY7HvaO4eKX2R2FLCx2PRj50rFNCGwvWYgPRks1of_fdGk3ekDFBBtTvyPAwj-blVryj38BS85ju4Jpozsj-W6SbwXJ0l-1hzmC8lmAYcAt0q0JjptWkvDNj6gNhxmGiBi7u-31ErzgE2H24_Tsyo5iSRi7aOxQH_6WE6TVZiPqlwVktE6FYwdOil3ukCxsZsNClgIHh_3C9JUkV4Rs9ba06g5V5BeRDPqjGLM7jBowAO3ut2UkPuW5zafE2bDKPPqi1F5cjyufnJ6TrX2Wa5aSYdRG65Nb6DLxx3pma4piLs-UfTk6gF9cjllAb3Lpxq5XxsDGt_G_jK9IqiiMb262ouDYYjLWuaMpqUgTAQnwcwhn6MtY5bWeUOX_q__KwEEgDsKvj3pmwZd718EhzLTBARhNQxeYofIQLc_V5Y-FnqTuvMXCEfQoCas3qAJUBVTbG1hDzaSchNi0OA6xCq3VPXOGX5CO7vBStuqfdl0lJ54C6dT6RnpBeO2N6GoSZ7NKIsai_hQdX-MEouXcgEGYdBsK6dYU8ZFYJLPk3towxz82E23UFilcm5sG1UWK2VcyTN9WaQfhrWGbL3QXZpJKMBsIr5u4L3DLXPXtdcsKv1THXOIx46k">
</div>
<p><label><br>
<span class="wpcf7-form-control-wrap" data-name="your-email"><input size="40" class="wpcf7-form-control wpcf7-email wpcf7-validates-as-required wpcf7-text wpcf7-validates-as-email" autocomplete="email" aria-required="true" aria-invalid="false"
placeholder="Your email" value="" type="email" name="your-email"></span> </label>
</p>
<p><label><span class="wpcf7-form-control-wrap" data-name="TermsConditions"><span class="wpcf7-form-control wpcf7-acceptance"><span class="wpcf7-list-item"><label><input type="checkbox" name="TermsConditions" value="1" aria-invalid="false"><span
class="wpcf7-list-item-label">I accept the <a href="https://cybermaterial.com/legal-and-privacy-policy/"> Terms & Conditions* </a></span></label></span></span></span> </label>
</p>
<p><input class="wpcf7-form-control wpcf7-submit has-spinner" type="submit" value="Subscribe" disabled=""><span class="wpcf7-spinner"></span>
</p>
<div class="wpcf7-response-output" aria-hidden="true"></div>
</form>GET https://cybermaterial.com/
<form action="https://cybermaterial.com/" method="get" class="jeg_search_form" target="_top">
<input name="s" class="jeg_search_input" placeholder="Search..." type="text" value="" autocomplete="off">
<button aria-label="Search Button" type="submit" class="jeg_search_button btn"><i class="fa fa-search"></i></button>
</form>POST #
<form action="#" data-type="login" method="post" accept-charset="utf-8">
<h3>Welcome Back!</h3>
<p>Login to your account below</p>
<!-- Form Messages -->
<div class="form-message"></div>
<p class="input_field">
<input type="text" name="username" placeholder="Username" value="">
</p>
<p class="input_field">
<input type="password" name="password" placeholder="Password" value="">
</p>
<p class="input_field remember_me">
<input type="checkbox" id="remember_me" name="remember_me" value="true">
<label for="remember_me">Remember Me</label>
</p>
<p class="submit">
<input type="hidden" name="action" value="login_handler">
<input type="hidden" name="jnews_nonce" value="df2aeb1642">
<input type="submit" name="jeg_login_button" class="button" value="Log In" data-process="Processing . . ." data-string="Log In">
</p>
<div class="bottom_links clearfix">
<a href="#jeg_forgotform" class="jeg_popuplink forgot">Forgotten Password?</a>
</div>
</form>POST #
<form action="#" data-type="forgot" method="post" accept-charset="utf-8">
<h3>Retrieve your password</h3>
<p>Please enter your username or email address to reset your password.</p>
<!-- Form Messages -->
<div class="form-message"></div>
<p class="input_field">
<input type="text" name="user_login" placeholder="Your email or username" value="">
</p>
<div class="g-recaptcha" data-sitekey=""></div>
<p class="submit">
<input type="hidden" name="action" value="forget_password_handler">
<input type="hidden" name="jnews_nonce" value="df2aeb1642">
<input type="submit" name="jeg_login_button" class="button" value="Reset Password" data-process="Processing . . ." data-string="Reset Password">
</p>
<div class="bottom_links clearfix">
<a href="#jeg_loginform" class="jeg_popuplink"><i class="fa fa-lock"></i> Log In</a>
</div>
</form>POST #
<form action="#" method="post" accept-charset="utf-8">
<h3>Add New Playlist</h3>
<!-- Form Messages -->
<div class="form-message"></div>
<div class="form-group">
<p class="input_field">
<input type="text" name="title" placeholder="Playlist Name" value="">
</p>
<p class="input_field">
<select name="visibility">
<option disabled="" selected="selected" value="">- Select Visibility -</option>
<option value="public">Public</option>
<option value="private">Private</option>
</select>
</p>
<!-- submit button -->
<div class="submit">
<input type="hidden" name="type" value="create_playlist">
<input type="hidden" name="action" value="playlist_handler">
<input type="hidden" name="post_id" value="">
<input type="hidden" name="jnews-playlist-nonce" value="249238f760">
<input type="submit" name="jeg_save_button" class="button" value="Save" data-process="Processing . . ." data-string="Save">
</div>
</div>
</form>Text Content
We value your privacy We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies. Customize Reject All Accept All Customize Consent Preferences We use cookies to help you navigate efficiently and perform certain functions. You will find detailed information about all cookies under each consent category below. The cookies that are categorized as "Necessary" are stored on your browser as they are essential for enabling the basic functionalities of the site. ... Show more NecessaryAlways Active These cookies are strictly necessary for your website to properly function, and therefore cannot be disabled by your users. * Cookie _GRECAPTCHA * Duration 90 days * Description Stores a value used to verify that the user is not a bot * Cookie rc::f * Duration 180 days * Description Used to track and analyze user behavior to distinguish humans from bots or automated software. * Cookie rc::a * Duration 180 days * Description Used to track and analyze user behavior to distinguish humans from bots or automated software * Cookie _grecaptcha * Duration 180 days * Description Stores a value used to verify that the user is not a bot Functional Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features. * Cookie yt-remote-device-id * Duration 180 days * Description Stores a unique ID for the user's device for YouTube * Cookie yt-remote-connected-devices * Duration 180 days * Description Stores a list of connected devices for YouTube * Cookie ytidb::LAST_RESULT_ENTRY_KEY * Duration 180 days * Description Stores the last result entry key used by YouTube Analytics Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc. * Cookie _ga_# * Duration 180 days * Description Used to distinguish individual users by means of designation of a randomly generated number as client identifier, which allows calculation of visits and sessions * Cookie _ga * Duration 180 days * Description Records a particular ID used to come up with data about website usage by the user * Cookie _clck * Duration 180 days * Description Persists the Clarity User ID and preferences, unique to that site is attributed to the same user ID * Cookie _clsk * Duration 180 days * Description Connects multiple page views by a user into a single Clarity session recording * Cookie CLID * Duration 180 days * Description Identifies the first-time Clarity saw this user on any site using Clarity * Cookie MUID * Duration 3 years * Description Sets a unique user id for tracking how the user uses the site. Persistent cookie that is saved for 3 years Performance Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors. * Cookie MR * Duration 180 days * Description This cookie is used by Microsoft to reset or refresh the MUID cookie. * Cookie yt-remote-device-id * Duration 180 days * Description Stores a unique ID for the user's device for YouTube * Cookie yt-remote-connected-devices * Duration 180 days * Description Stores a list of connected devices for YouTube * Cookie ytidb::LAST_RESULT_ENTRY_KEY * Duration 180 days * Description Stores the last result entry key used by YouTube * Cookie SM * Duration 180 days * Description Session cookie used to collect anonymous information on how visitors use a site to help improve their experience and for better target ads. Advertisement Advertisement cookies are used to provide visitors with customized advertisements based on the pages you visited previously and to analyze the effectiveness of the ad campaigns. * Cookie SRM_B * Duration 180 days * Description Atlast Adserver used in conjunction with Bing services. * Cookie ANONCHK * Duration 180 days * Description Used by Bing as a unique user identifier for users seeing bing ads * Cookie VISITOR_INFO1_LIVE * Duration 180 days * Description YouTube is a Google-owned platform for hosting and sharing videos. YouTube collects user data through videos embedded in websites, which is aggregated with profile data from other Google services in order to display targeted advertising to web visitors across a broad range of their own and other websites. Used by Google in combination with SID to verify Google user account and most recent login time. Reject All Save My Preferences Accept All MENU * Alerts * Incidents * News * APTs * Cyber Decoded * Cyber Hygiene * Cyber Review * Cyber Tips * Definitions * Malware * Threat Actors * Tutorials USEFUL TOOLS * Password Generator * Report an incident No Result View All Result * Education * Cyber Decoded * Definitions * Information * Alerts * Incidents * News * Insights * Cyber Hygiene * Cyber Review * Tips * Tutorials * Support * Contact Us * Report an incident * About * About Us * Advertise with us Get Help * Education * Cyber Decoded * Definitions * Information * Alerts * Incidents * News * Insights * Cyber Hygiene * Cyber Review * Tips * Tutorials * Support * Contact Us * Report an incident * About * About Us * Advertise with us Get Help No Result View All Result No Result View All Result Home Alerts ANDROXGH0ST MALWARE TARGETS LARAVEL APPS March 21, 2024 Reading Time: 2 mins read in Alerts AndroxGh0st is a potent malware designed to infiltrate Laravel applications, with a specific focus on extracting sensitive data such as AWS and Twilio login credentials from .env files. Initially categorized as an SMTP cracker, it exploits various strategies including SMTP vulnerabilities, web shell deployment, and credential exploitation. Despite its adaptive nature and diverse capabilities, the primary objective remains compromising hosts and extracting crucial information from Laravel applications. Juniper’s reports shed light on the malware’s menu-driven interface, showcasing its multifunctional features. With options like “awslimitcheck,” “sendgridcheck,” and “twilio_sender,” it offers diverse functionalities tailored for specific tasks. These options enable users to assess AWS account limits, verify SendGrid API keys, and send SMS messages via the Twilio API, among other capabilities. Moreover, the malware exploits critical vulnerabilities associated with Laravel web applications, including CVE-2017-9841, CVE-2018-15133, and CVE-2021-41773. The attack chain initiates with CVE-2021-41773, exploiting Apache weaknesses to gain entry into vulnerable systems. Subsequently, CVE-2017-9841 and CVE-2018-15133 are leveraged to execute arbitrary code and establish persistent control, amplifying the malware’s impact and potency. REFERENCE: * AndroxGh0st Malware Targets Laravel Applications to Extract Critical Data Tags: AndroxGh0stAWSCyber AlertCyber Alerts 2024Cyber RiskCyber threatCybersecurityMarch 2024Twilio ADVERTISEMENT RELATED POSTS EUROPE HIT BY ACECRYPTOR SURGE March 21, 2024 IVANTI URGES IMMEDIATE PATCHING March 21, 2024 SMOKE LOADER HITS FINANCIAL INSTITUTIONS March 21, 2024 ATLASSIAN FIXES CRITICAL VULNERABILITIES March 21, 2024 WORDPRESS PLUGIN PUTS 40K SITES AT RISK March 20, 2024 FTC WARNS OF RISING IMPERSONATION SCAMS March 20, 2024 LATEST ALERTS ANDROXGH0ST MALWARE TARGETS LARAVEL APPS EUROPE HIT BY ACECRYPTOR SURGE IVANTI URGES IMMEDIATE PATCHING SMOKE LOADER HITS FINANCIAL INSTITUTIONS ATLASSIAN FIXES CRITICAL VULNERABILITIES WORDPRESS PLUGIN PUTS 40K SITES AT RISK SUBSCRIBE TO OUR NEWSLETTER I accept the Terms & Conditions* LATEST INCIDENTS HEALTHCARE RETAILER GOED CYBERATTACK CHINA’S SCAA SUFFERS CYBERATTACK GREGGS BAKERIES HIT BY POS OUTAGES JACKSONVILLE BEACH CYBERATTACK ALERT RADIANT LOGISTICS CYBERATTACK HALTS OPS POKEMON RESETS PASSWORDS AFTER HACKING Next Post RADIANT LOGISTICS CYBERATTACK HALTS OPS * About Us * Contact Us * Legal and Privacy Policy * Site Map © 2024 | CyberMaterial | All rights reserved No Result View All Result * Alerts * Incidents * News * Cyber Decoded * Cyber Hygiene * Cyber Review * Definitions * Malware * Cyber Tips * Tutorials * Advanced Persistent Threats * Threat Actors * Report an incident * Password Generator * About Us * Contact Us * Advertise with us Copyright © 2023 CyberMaterial WELCOME BACK! Login to your account below Remember Me Forgotten Password? RETRIEVE YOUR PASSWORD Please enter your username or email address to reset your password. Log In ADD NEW PLAYLIST - Select Visibility -PublicPrivate