BlackNET RAT Analiza

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (120)

Język

en	68
ru	24
fr	6
pl	6
es	4

Kraj

us	68
ru	12
de	6
tt	2
sv	2

Aktorzy

BlackNET RAT	6
Mirai	6
RedLine Stealer	4
Cobalt Strike	3
AsyncRAT	3

Wysiłek

Rodzaj

Not Defined	48
Operating System	8
Programming Language Software	6
Virtualization Software	2
SCADA Software	2

Sprzedawca

Not Defined	28
Apple	6
Microsoft	4
Cisco	2
Thomas R. Pasawicz	2

Produkt

Turuncu Portal	2
Cisco Virtualization Experience Media Engine	2
Thomas R. Pasawicz HyperBook Guestbook	2
Tenda M3	2
Webfroot ShoutBox CGI Suite	2

Luki w zabezpieczeniach

#	Słaby punkt	Base	Temp	0day	Dzisiaj	Wyk	Prz	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Obliczenie	High	Workaround	0.02016	0.00	CVE-2007-1192
2	LS Electric PLC/XG5000 weak encryption	5.4	5.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00144	0.00	CVE-2022-2758
3	Omron PLC CJ/PLC CS weak authentication	6.8	6.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00133	0.04	CVE-2019-13533
4	Omron CX-Position Project File memory corruption	7.0	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00102	0.00	CVE-2022-26417
5	Microsoft Windows Remote Procedure Call Runtime Remote Code Execution	9.8	8.9	$100k i więcej	$5k-$25k	Unproven	Official Fix	0.02246	0.06	CVE-2022-26809
6	Turuncu Portal h_goster.asp sql injection	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00249	0.00	CVE-2007-1022
7	Microsoft Windows IKE Protocol Extension Remote Code Execution	9.8	8.9	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.01093	0.04	CVE-2022-34721
8	RoundCube Webmail Email Message rcube_string_replacer.php linkref_addindex cross site scripting	3.5	3.4	$0-$5k	$0-$5k	High	Official Fix	0.00533	0.06	CVE-2020-35730
9	jforum User privilege escalation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00289	0.03	CVE-2019-7550
10	phpx search.php cross site scripting	4.3	4.2	$0-$5k	$0-$5k	High	Unavailable	0.00690	0.00	CVE-2007-1551
11	SourceCodester Online Pizza Ordering System index.php sql injection	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00148	0.10	CVE-2023-0883
12	KoschtIT KoschtIT Image Gallery ki_makepic.php directory traversal	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01118	0.00	CVE-2009-1510
13	SourceCodester Library Management System bookdetails.php sql injection	7.1	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00322	0.05	CVE-2022-2214
14	D-Link DIR-816 A2 Web Interface setDeviceSettings privilege escalation	6.4	6.3	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00067	0.08	CVE-2024-0921
15	Nsasoft Network Sleuth Registration denial of service	4.0	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00042	0.10	CVE-2024-1184
16	Turbotraffictrader Php ttt-webmaster.php cross site scripting	4.3	4.2	$0-$5k	$0-$5k	High	Unavailable	0.00923	0.00	CVE-2004-2191
17	Webfroot ShoutBox CGI Suite privilege escalation	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.00
18	Siemens SICAM PQ Analyzer Registry privilege escalation	3.5	3.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00081	0.00	CVE-2021-45460
19	Astaro Security Gateway pfilter-reporter.pl denial of service	7.5	6.5	$0-$5k	$0-$5k	Unproven	Official Fix	0.10324	0.00	CVE-2007-4243
20	Dell Rugged Control Center Service Endpoint privilege escalation	7.8	7.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2022-34443

IOC - Indicator of Compromise (12)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adres IP	Hostname	Aktor	Identified	Rodzaj	Pewność siebie
1	2.57.19.173		BlackNET RAT	2023-10-17	verified	Wysoki
2	20.163.158.142		BlackNET RAT	2023-11-06	verified	Wysoki
3	34.172.89.75	75.89.172.34.bc.googleusercontent.com	BlackNET RAT	2024-03-04	verified	Medium
4	XX.XXX.X.XX		Xxxxxxxx Xxx	2021-03-25	verified	Wysoki
5	XX.XX.XXX.XX	xx.xxx	Xxxxxxxx Xxx	2022-12-30	verified	Wysoki
6	XX.XX.XXX.XXX		Xxxxxxxx Xxx	2024-02-27	verified	Wysoki
7	XXX.XX.XXX.XXX		Xxxxxxxx Xxx	2023-12-28	verified	Wysoki
8	XXX.XX.XXX.XXX		Xxxxxxxx Xxx	2023-10-17	verified	Wysoki
9	XXX.XX.XXX.XXX	xxxx-xxxxxxx.xxx	Xxxxxxxx Xxx	2023-04-16	verified	Wysoki
10	XXX.XXX.XX.XXX		Xxxxxxxx Xxx	2024-02-07	verified	Wysoki
11	XXX.XXX.XX.XXX		Xxxxxxxx Xxx	2024-01-27	verified	Wysoki
12	XXX.XXX.XX.XXX		Xxxxxxxx Xxx	2024-01-26	verified	Wysoki

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klasa	Luki w zabezpieczeniach	Wektor dostępu	Rodzaj	Pewność siebie
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Wysoki
2	T1040	CAPEC-102	CWE-294, CWE-319	Authentication Bypass by Capture-replay	predictive	Wysoki
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Wysoki
4	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Wysoki
5	TXXXX	CAPEC-19	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
6	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Wysoki
7	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Wysoki
8	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Wysoki
9	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Wysoki
10	TXXXX.XXX	CAPEC-	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	Wysoki
11	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Wysoki
12	TXXXX	CAPEC-112	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Wysoki
13	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Wysoki

IOA - Indicator of Attack (49)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasa	Indicator	Rodzaj	Pewność siebie
1	File	/goform/setDeviceSettings	predictive	Wysoki
2	File	/it-IT/splunkd/__raw/services/get_snapshot	predictive	Wysoki
3	File	/librarian/bookdetails.php	predictive	Wysoki
4	File	/php-opos/index.php	predictive	Wysoki
5	File	/phpwcms/setup/setup.php	predictive	Wysoki
6	File	/usr/bin/at	predictive	Medium
7	File	/xxxxxx/xxxxxxxx/xxxxxxxx/xxxxxxxxxxxx.xxx	predictive	Wysoki
8	File	/xxxx/?xxxx=xxxxxx_xxxxxxx	predictive	Wysoki
9	File	xxxxxxx.xxx	predictive	Medium
10	File	xxx:.xxx	predictive	Medium
11	File	xxxxxxxx.xxx	predictive	Medium
12	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Wysoki
13	File	x_xxxxxx.xxx	predictive	Medium
14	File	xxxxxxx.xxx	predictive	Medium
15	File	xxxxxx/xxxxxxxxxx.x	predictive	Wysoki
16	File	xx_xxxxxxx.xxx	predictive	Wysoki
17	File	xxxxxxx-xxxxxxxx.xx	predictive	Wysoki
18	File	xxxxx_xxxxxx_xxx.xxx	predictive	Wysoki
19	File	xxxxx_xxxxxx_xxxxxxxx.xxx	predictive	Wysoki
20	File	xxxxxxxxxx.xxx	predictive	Wysoki
21	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	Wysoki
22	File	xxxxxx.xxx	predictive	Medium
23	File	xxx-xxxxxxxxx.xxx	predictive	Wysoki
24	File	xxxxxxx.xxx	predictive	Medium
25	File	xxxxxx.xxx	predictive	Medium
26	File	xx-xxxxxxxxxxx.xxx	predictive	Wysoki
27	Library	xxxxxxx/xxxxxxxx/	predictive	Wysoki
28	Argument	xxx	predictive	Niski
29	Argument	xxx	predictive	Niski
30	Argument	xxxxxxxx_xxxxxx/xxxxxxxx_xxxx/xxxxxxxx_xxxxxxxx/xxxxxxxx_xxxx	predictive	Wysoki
31	Argument	xxxx	predictive	Niski
32	Argument	xxxx	predictive	Niski
33	Argument	xx	predictive	Niski
34	Argument	xx	predictive	Niski
35	Argument	xx	predictive	Niski
36	Argument	xxxxxxxxx	predictive	Medium
37	Argument	xxxxxx xxxxxxxxxxx	predictive	Wysoki
38	Argument	xxxxx	predictive	Niski
39	Argument	xxxxxx	predictive	Niski
40	Argument	xxxxxx/xxxxxx_xxxxxx	predictive	Wysoki
41	Argument	xxxx_xxxx	predictive	Medium
42	Argument	xxxxxxxxxxxxxxxxxxxx	predictive	Wysoki
43	Argument	xxxxx	predictive	Niski
44	Argument	x_xxxx_xx	predictive	Medium
45	Argument	xxx	predictive	Niski
46	Argument	xxx	predictive	Niski
47	Argument	xxx	predictive	Niski
48	Input Value	' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)-- xxxx	predictive	Wysoki
49	Input Value	-x	predictive	Niski

Referencje (13)

The following list contains external sources which discuss the actor and the associated activities:

◂ PoprzedniPrzeglądKolejny ▸

Interested in the pricing of exploits?

See the underground prices here!