BlackByte Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (377)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Language

en	350
ru	20
de	4
fr	4

Country

US: USA	76
CN: China	22
ES: Spain	6
RU: Russia	6
FR: France	4

Actors

RedLine Stealer	3
Cobalt Strike	3
Bashlite	2
BlackByte	2
AsyncRAT	2

Activities

Interest

Timeline

Type

Not Defined	156
Operating System	22
WordPress Plugin	16
Programming Language Software	14
Firewall Software	8

Vendor

Not Defined	86
Apple	16
mooSocial	10
PHP Jabbers	10
Google	8

Product

Apple macOS	10
mooSocial mooDating	10
Google Chrome	6
Perl	4
Cisco Firepower Threat Defense	4

Vulnerabilities

These are the vulnerabilities that we have identified as researched, approached, or attacked.

#	Vulnerability	Base	Temp	0day	Today	Exp	Cou	KEV	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	possible	0.02956	0.00	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official fix		0.00970	0.00	CVE-2010-0966
3	WoltLab Burning Book addentry.php sql injection	7.3	6.8	$0-$5k	$0-$5k	Functional	Unavailable		0.00957	0.02	CVE-2006-5509
4	Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_base_config.php os command injection	7.5	7.2	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	expected	0.89126	0.21	CVE-2024-7120
5	Netgear WN604 Web Interface downloadFile.php information disclosure	5.3	5.1	$5k-$25k	$0-$5k	Proof-of-Concept	Workaround	expected	0.82270	0.08	CVE-2024-6646
6	ownCloud index.php path traversal	7.3	7.0	$0-$5k	$0-$5k	Not defined	Official fix		0.00798	0.00	CVE-2014-4929
7	Byzoro Smart S210 Management Platform uploadfile.php unrestricted upload	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not defined	possible	0.69532	0.00	CVE-2024-0939
8	TVT DVR TD-2104TS-CL queryDevInfo information disclosure	5.3	5.1	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	possible	0.69275	0.08	CVE-2024-7339
9	osCommerce all-products cross site scripting	4.3	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Not defined		0.14744	0.00	CVE-2024-4348
10	D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection	8.1	8.1	$5k-$25k	$0-$5k	High	Workaround	verified	0.94213	0.07	CVE-2024-3273
11	mooSocial mooDating URL users cross site scripting	4.4	4.3	$0-$5k	$0-$5k	Proof-of-Concept	Not defined		0.01770	0.04	CVE-2023-3847
12	Dahua Smart Park Management devicePoint_addImgIco unrestricted upload	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not defined	expected	0.88656	0.00	CVE-2023-3836
13	PHP Jabbers Bus Reservation System index.php cross site scripting	4.9	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Not defined		0.06057	0.06	CVE-2023-4111
14	PHP Jabbers Taxi Booking index.php cross site scripting	4.9	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Not defined		0.05194	0.08	CVE-2023-4116
15	DedeCMS select_templets.php path traversal	4.6	4.5	$0-$5k	$0-$5k	Proof-of-Concept	Not defined		0.03428	0.00	CVE-2023-2059
16	PHP Jabbers Availability Booking Calendar index.php cross site scripting	4.4	4.3	$0-$5k	$0-$5k	Proof-of-Concept	Not defined		0.01603	0.00	CVE-2023-4110
17	Ellucian Ethos Identity logout cross site scripting	4.9	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Official fix	possible	0.48791	0.00	CVE-2023-2822
18	PlayTube Redirect information disclosure	5.4	5.2	$0-$5k	$0-$5k	Proof-of-Concept	Not defined	possible	0.63790	0.00	CVE-2023-4714
19	ColumbiaSoft Document Locator WebTools login improper authentication	8.1	8.0	$0-$5k	$0-$5k	Not defined	Official fix	possible	0.69570	0.07	CVE-2023-5830
20	Academy LMS GET Parameter filter sql injection	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not defined	possible	0.54460	0.00	CVE-2023-4974

Campaigns (1)

These are the campaigns that can be associated with the actor:

CVE-2024-37085

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	45.9.148.114		BlackByte		02/15/2022	verified	Low
2	XXX.XX.X.XX	xxxx.xxxxxxx.xxx	Xxxxxxxxx		07/29/2022	verified	Medium
3	XXX.XXX.XX.XXX		Xxxxxxxxx		07/07/2023	verified	High
4	XXX.XX.XXX.XXX		Xxxxxxxxx	Xxx-xxxx-xxxxx	08/28/2024	verified	Very High

TTP - Tactics, Techniques, Procedures (22)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22, CWE-24, CWE-28, CWE-425	Path Traversal	predictive	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
4	T1059.007	CAPEC-209	CWE-79, CWE-80	Basic Cross Site Scripting	predictive	High
5	T1068	CAPEC-122	CWE-264, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	High
6	TXXXX.XXX		CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	High
7	TXXXX	CAPEC-XXX	CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	predictive	High
8	TXXXX	CAPEC-XXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
9	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
10	TXXXX		CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
11	TXXXX	CAPEC-X	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
12	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
13	TXXXX.XXX	CAPEC-X	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
14	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
15	TXXXX	CAPEC-XX	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
16	TXXXX	CAPEC-XX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
17	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
18	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxxxxxx	predictive	High
19	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
20	TXXXX	CAPEC-XX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
21	TXXXX.XXX		CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	High
22	TXXXX.XXX	CAPEC-X	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (177)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/academy/tutor/filter	predictive	High
2	File	/ad-list	predictive	Medium
3	File	/admin/suppliers/view_details.php	predictive	High
4	File	/ajax.php?action=read_msg	predictive	High
5	File	/api/authentication/login	predictive	High
6	File	/api/sys/login	predictive	High
7	File	/api/sys/set_passwd	predictive	High
8	File	/api/v2/open/rowsInfo	predictive	High
9	File	/app/sys1.php	predictive	High
10	File	/building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini	predictive	High
11	File	/cas/logout	predictive	Medium
12	File	/catalog/all-products	predictive	High
13	File	/cgi-bin/adm.cgi	predictive	High
14	File	/cgi-bin/mesh.cgi?page=upgrade	predictive	High
15	File	/cgi-bin/nas_sharing.cgi	predictive	High
16	File	/cgi-bin/nightled.cgi	predictive	High
17	File	/cgi-bin/touchlist_sync.cgi	predictive	High
18	File	/cgi-bin/vitogate.cgi	predictive	High
19	File	/debug/pprof	predictive	Medium
20	File	/desktop_app/file.ajax.php?action=uploadfile	predictive	High
21	File	/xxxxxxxxxxxx.xxx	predictive	High
22	File	/xxxx/xxxxxxxxxxx_xxxxxxxxx?xxxxxxxxxxxx=xxxx	predictive	High
23	File	/xxx	predictive	Low
24	File	/xxxx-x-xxxxx	predictive	High
25	File	/xxx/xxxxx/xxxx.xxx	predictive	High
26	File	/xxxxxxx	predictive	Medium
27	File	/xxxxxxx/xxxx_xxxxxx	predictive	High
28	File	/xxxxxx/xxxxxxxxxxxxxxxxx	predictive	High
29	File	/xxxxxx/xxxxxxxxxxxxxxxxx	predictive	High
30	File	/xxx/xxxxxx/xxxxxxxxx/xxxxxxxxx.xxx	predictive	High
31	File	/xxxxx.xxx	predictive	Medium
32	File	/xxxxx.xxx?xxxx=xxxxxxxx_xxx	predictive	High
33	File	/xxxxxx/xxxxxxx.xxx	predictive	High
34	File	/xxxxxxxxxxxx/xxxxxxxx	predictive	High
35	File	/xxxxxxxxxxx/xxxxxxx.xxx	predictive	High
36	File	/xxxxx	predictive	Low
37	File	/xxx/xxxx.xxx	predictive	High
38	File	/xxxxxxxx/xxxxx.xxx	predictive	High
39	File	/xxxxxxxxxxxx	predictive	High
40	File	/xxxxxx	predictive	Low
41	File	/xxxxxx/xxxxx	predictive	High
42	File	/xxxxxx-xxxxxx	predictive	High
43	File	/xxx/xxxxxxxxxx/xxxxxxxxxx.xxxx	predictive	High
44	File	/xxxx/xxxxxxxxxx.xxx	predictive	High
45	File	/xxxxx	predictive	Low
46	File	/xxxxx/xxxx	predictive	Medium
47	File	xxx-xxxxxx-xxxx.xxx	predictive	High
48	File	xxxxxxxx.xxx	predictive	Medium
49	File	xxxxx/xxxxxxxxxx_xxxxxxxx.xxx	predictive	High
50	File	xxxxx/xxxxx-xxx-xxxxx-xxxxx.xxx	predictive	High
51	File	xxxxx/xxxxxxx/xxxxxxxxxxxx	predictive	High
52	File	xxxxxxxxxxxx/xxxxx/xxxx/	predictive	High
53	File	xxxxx.xxx	predictive	Medium
54	File	xxx_xx_xxx_xxx.xxx	predictive	High
55	File	xxx/xxxxxx/xxxx/xxx_xxxxxx.xxx	predictive	High
56	File	xxx.x	predictive	Low
57	File	xxx	predictive	Low
58	File	xxx/xxxxxxxx/xxxx/xxxxxxxx.xx	predictive	High
59	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
60	File	xxxxxxx/xxxxxxxx/xxx/xxxxxxx-xxxxxx.x	predictive	High
61	File	xxxxxxx/xxx/xxx-xx.x	predictive	High
62	File	xxx_xxxx.x	predictive	Medium
63	File	xxxxx_xxxxxxxx.xxxx	predictive	High
64	File	xxx/xxxxx.xxxxx	predictive	High
65	File	xxxx/xxxxxxxx/xxx&xx=xxxxxxx	predictive	High
66	File	xxxxxxxxxxxxxxxxxxxxxxxxx.xx	predictive	High
67	File	xxxxxxx_xxx.xxxx	predictive	High
68	File	xxxxxx.xxx	predictive	Medium
69	File	xxx/xxxxxx.xxx	predictive	High
70	File	xxxxxxx/xxxxx.xxx.xxx	predictive	High
71	File	xxxxx.xxx	predictive	Medium
72	File	xxxxx.xxx/xxxx/xxxxx/xxxx/xxxx.xxx	predictive	High
73	File	xx_xxxxx.x	predictive	Medium
74	File	xxxxx_xxxxx.x	predictive	High
75	File	xxxxxxxx/xxxxxxxxx	predictive	High
76	File	xxxxxx/xxx/xxxxxxxx.x	predictive	High
77	File	xxxx.xxx	predictive	Medium
78	File	xxxxx.xxx	predictive	Medium
79	File	xxxx_xxxx_xxxxxx.xxx	predictive	High
80	File	xxxxxxxx.xxx	predictive	Medium
81	File	xxxxxxx/xxxxxx/xxxxxx/xxxxxxxxx.xxx#xxx	predictive	High
82	File	xxx_xxxx.xxx	predictive	Medium
83	File	xxxxxxxxxxx-xxxx.xx	predictive	High
84	File	xxxxxxxxx/xxxxx.xxxxx	predictive	High
85	File	xxxxx/xxxxx.xxxxx	predictive	High
86	File	xxxxxxx.x	predictive	Medium
87	File	xxxxxxxx-x.xx	predictive	High
88	File	xxxxxxxxxxxxx.xxx	predictive	High
89	File	xxxxxx-xxxxxxx.xxx	predictive	High
90	File	xxxxxx-xxxxxx.xxx	predictive	High
91	File	xxxxxxxxx.xxx	predictive	High
92	File	xxxxxx/xxxxxxxxxxx/xxx/xxxxxxxxxx/xxxx.xxx	predictive	High
93	File	xxxxxxxx.xxx/xxxxxx.xxx/xxxxxxxx.xxx	predictive	High
94	File	xxx/xxxx/xxxx/xxx/xxxxxxxxxx/xxxxxxxxxx/xxxxxxxxxxxxxxxxxx.xxxx	predictive	High
95	File	xxx/xxxx.x	predictive	Medium
96	File	xxx.x	predictive	Low
97	File	xxxxxxxxxxxxxxxx	predictive	High
98	File	xxxxxxxx_xxxxxx_xxxxx.xxx	predictive	High
99	File	xxx-xxxxxxx-xxx.xx	predictive	High
100	File	xxxxxxx/xxxxxxx/xxxxxx/xxxxxx_xxxxxxxx.xxx	predictive	High
101	File	xxxxxxx.x	predictive	Medium
102	File	xxx.xxx	predictive	Low
103	File	xx-xxxxx-xxxxxx.xxx	predictive	High
104	File	\xxxxxxxxxx\xxxxxxxxx\xxx\xxxxxx.xx	predictive	High
105	File	~/xxxxxxxx/xxxxx-xxx-xxxxxx-xxxxxxxxxxxx.xxx	predictive	High
106	Library	xx.xxxxxxxxxx.xxxxxxxxxxxxxxx.xxx	predictive	High
107	Library	xxx/xxxxxxxxx/xxxxxxxx.xxxxx.xxx	predictive	High
108	Library	xxxxxxx.xxx	predictive	Medium
109	Library	xxxxx.xxx	predictive	Medium
110	Library	xxxxxxxxxxxxx.xxx)	predictive	High
111	Argument	xxxxxx	predictive	Low
112	Argument	xxxxxx	predictive	Low
113	Argument	xxx	predictive	Low
114	Argument	xxxxxxxxxxx	predictive	Medium
115	Argument	xxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxx/xxxxxxxxxx/xxxxxxxxxxxxxxxxxxx	predictive	High
116	Argument	xxxxxx	predictive	Low
117	Argument	xxxxxxxx	predictive	Medium
118	Argument	x:\xxxxxxx\x	predictive	Medium
119	Argument	xxxxx_xxxx	predictive	Medium
120	Argument	xxx	predictive	Low
121	Argument	xxx	predictive	Low
122	Argument	xxxxxxx	predictive	Low
123	Argument	xxxxx_xx	predictive	Medium
124	Argument	xxxxxxxx	predictive	Medium
125	Argument	xxxxxxxxxxxxxxxxx	predictive	High
126	Argument	xxxxxxx	predictive	Low
127	Argument	xxx_xxx	predictive	Low
128	Argument	xxxx	predictive	Low
129	Argument	xxxx	predictive	Low
130	Argument	xxxxxxxx	predictive	Medium
131	Argument	xxxx_xxxxx	predictive	Medium
132	Argument	xxxx_xxxxxx	predictive	Medium
133	Argument	xxxxxx[xxxxxxx]/xxxxxx[xxxxx]	predictive	High
134	Argument	xxxxx	predictive	Low
135	Argument	xxxxxx_xxx	predictive	Medium
136	Argument	xxxx	predictive	Low
137	Argument	xx	predictive	Low
138	Argument	xxxxx	predictive	Low
139	Argument	xxxxx	predictive	Low
140	Argument	xxxxx/xxxxxx_xx	predictive	High
141	Argument	xxxxxxx	predictive	Low
142	Argument	xx	predictive	Low
143	Argument	xxxxxx	predictive	Low
144	Argument	xxxxxxxx[xx]	predictive	Medium
145	Argument	xxx	predictive	Low
146	Argument	xxxx	predictive	Low
147	Argument	xxxx	predictive	Low
148	Argument	xxxxxx	predictive	Low
149	Argument	xxxxx_xxx/xxxxx_xxx	predictive	High
150	Argument	xxxxxxx	predictive	Low
151	Argument	x_xxxx	predictive	Low
152	Argument	xxxxxxxxxxxxx	predictive	High
153	Argument	xxxxxxxxxxx/xxxx	predictive	High
154	Argument	xxxxxx/xxxxxx_xxxxxx	predictive	High
155	Argument	xxxxxxxxxx	predictive	Medium
156	Argument	xxxxxx	predictive	Low
157	Argument	xxxxxxx_xx	predictive	Medium
158	Argument	xxx	predictive	Low
159	Argument	xxxxx	predictive	Low
160	Argument	xxxxx_xxxx	predictive	Medium
161	Argument	xxxxxx	predictive	Low
162	Argument	xxxxx_xxxx	predictive	Medium
163	Argument	xxxxxxxx	predictive	Medium
164	Argument	xxxxxxxxxxx	predictive	Medium
165	Argument	xx	predictive	Low
166	Argument	xxxxxx	predictive	Low
167	Argument	xxx	predictive	Low
168	Argument	xxxxxx	predictive	Low
169	Argument	xxxxxxxx	predictive	Medium
170	Argument	xxxx	predictive	Low
171	Argument	x-xxxxxxxxx-xxxx	predictive	High
172	Input Value	"><xxxxxx>xxxxx(xxxxxxxx.xxxxxx)</xxxxxx>	predictive	High
173	Input Value	/../../../../../../../../../xxxxxxx/xxx.xxx	predictive	High
174	Input Value	//xxx//xxxxxxx.xxx	predictive	High
175	Input Value	xxxxxx	predictive	Low
176	Input Value	xx	predictive	Low
177	Input Value	xxxxxxx -xxx	predictive	Medium

References (5)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!