BlackNET RAT Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (118)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	78
ru	16
fr	12
es	4
sv	2

Country

us	64
ru	10
tt	10
de	4
nl	4

Actors

BlackNET RAT	6
Mirai	5
RedLine Stealer	4
Cobalt Strike	3
AsyncRAT	3

Activities

Interest

Timeline

Type

Not Defined	32
Operating System	8
Chip Software	6
Forum Software	4
WordPress Plugin	4

Vendor

Not Defined	28
Qualcomm	6
Microsoft	4
Omron	4
Google	4

Product

Qualcomm Snapdragon Compute	6
Qualcomm Snapdragon Consumer IOT	6
Qualcomm Snapdragon Industrial IOT	6
Qualcomm Snapdragon Mobile	6
Qualcomm Snapdragon Wired Infrastructure	6

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.02016	0.02	CVE-2007-1192
2	LS Electric PLC/XG5000 inadequate encryption	5.4	5.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00144	0.00	CVE-2022-2758
3	Omron PLC CJ/PLC CS authentication replay	6.8	6.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00133	0.04	CVE-2019-13533
4	Omron CX-Position Project File use after free	7.0	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00099	0.00	CVE-2022-26417
5	Microsoft Windows Remote Procedure Call Runtime Remote Code Execution	9.8	8.9	$100k and more	$5k-$25k	Unproven	Official Fix	0.01558	0.00	CVE-2022-26809
6	Turuncu Portal h_goster.asp sql injection	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00354	0.04	CVE-2007-1022
7	Microsoft Windows IKE Protocol Extension Remote Code Execution	9.8	8.9	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.01093	0.04	CVE-2022-34721
8	RoundCube Webmail Email Message rcube_string_replacer.php linkref_addindex cross site scripting	3.5	3.4	$0-$5k	$0-$5k	High	Official Fix	0.00612	0.00	CVE-2020-35730
9	jforum User input validation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00289	0.04	CVE-2019-7550
10	KoschtIT KoschtIT Image Gallery ki_makepic.php path traversal	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01118	0.03	CVE-2009-1510
11	SourceCodester Library Management System bookdetails.php sql injection	7.1	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00322	0.14	CVE-2022-2214
12	D-Link DIR-816 A2 Web Interface setDeviceSettings os command injection	6.4	6.3	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00067	0.46	CVE-2024-0921
13	Nsasoft Network Sleuth Registration denial of service	4.0	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00042	0.17	CVE-2024-1184
14	Turbotraffictrader Php ttt-webmaster.php cross site scripting	4.3	4.2	$0-$5k	$0-$5k	High	Unavailable	0.00923	0.00	CVE-2004-2191
15	Webfroot ShoutBox CGI Suite code injection	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.02
16	Siemens SICAM PQ Analyzer Registry unquoted search path	3.5	3.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00081	0.00	CVE-2021-45460
17	Astaro Security Gateway pfilter-reporter.pl denial of service	7.5	6.5	$0-$5k	$0-$5k	Unproven	Official Fix	0.10844	0.00	CVE-2007-4243
18	Dell Rugged Control Center Service Endpoint input validation	7.8	7.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2022-34443
19	Minecraft Servers List install.php unrestricted upload	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00639	0.00	CVE-2018-5749
20	Epic Games Psyonix Rocket League UPK Object stack-based overflow	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00300	0.00	CVE-2021-32238

IOC - Indicator of Compromise (12)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	2.57.19.173		BlackNET RAT	10/17/2023	verified	High
2	20.163.158.142		BlackNET RAT	11/06/2023	verified	High
3	34.172.89.75	75.89.172.34.bc.googleusercontent.com	BlackNET RAT	03/04/2024	verified	Medium
4	XX.XXX.X.XX		Xxxxxxxx Xxx	03/25/2021	verified	High
5	XX.XX.XXX.XX	xx.xxx	Xxxxxxxx Xxx	12/30/2022	verified	High
6	XX.XX.XXX.XXX		Xxxxxxxx Xxx	02/27/2024	verified	High
7	XXX.XX.XXX.XXX		Xxxxxxxx Xxx	12/28/2023	verified	High
8	XXX.XX.XXX.XXX		Xxxxxxxx Xxx	10/17/2023	verified	High
9	XXX.XX.XXX.XXX	xxxx-xxxxxxx.xxx	Xxxxxxxx Xxx	04/16/2023	verified	High
10	XXX.XXX.XX.XXX		Xxxxxxxx Xxx	02/07/2024	verified	High
11	XXX.XXX.XX.XXX		Xxxxxxxx Xxx	01/27/2024	verified	High
12	XXX.XXX.XX.XXX		Xxxxxxxx Xxx	01/26/2024	verified	High

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1040	CAPEC-102	CWE-294, CWE-319	Authentication Bypass by Capture-replay	predictive	High
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
4	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-19	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
7	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
8	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
9	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
10	TXXXX.XXX	CAPEC-	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	High
11	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
12	TXXXX	CAPEC-112	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
13	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (47)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/goform/setDeviceSettings	predictive	High
2	File	/it-IT/splunkd/__raw/services/get_snapshot	predictive	High
3	File	/librarian/bookdetails.php	predictive	High
4	File	/phpwcms/setup/setup.php	predictive	High
5	File	/usr/bin/at	predictive	Medium
6	File	/vendor/htmlawed/htmlawed/htmLawedTest.php	predictive	High
7	File	/xxxx/?xxxx=xxxxxx_xxxxxxx	predictive	High
8	File	xxxxxxx.xxx	predictive	Medium
9	File	xxx:.xxx	predictive	Medium
10	File	xxxxxxxx.xxx	predictive	Medium
11	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
12	File	x_xxxxxx.xxx	predictive	Medium
13	File	xxxxxxx.xxx	predictive	Medium
14	File	xxxxxx/xxxxxxxxxx.x	predictive	High
15	File	xx_xxxxxxx.xxx	predictive	High
16	File	xxxxxxx-xxxxxxxx.xx	predictive	High
17	File	xxxxx_xxxxxx_xxx.xxx	predictive	High
18	File	xxxxx_xxxxxx_xxxxxxxx.xxx	predictive	High
19	File	xxxxxxxxxx.xxx	predictive	High
20	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	High
21	File	xxxxxx.xxx	predictive	Medium
22	File	xxx-xxxxxxxxx.xxx	predictive	High
23	File	xxxxxxx.xxx	predictive	Medium
24	File	xxxxxx.xxx	predictive	Medium
25	File	xx-xxxxxxxxxxx.xxx	predictive	High
26	Library	xxxxxxx/xxxxxxxx/	predictive	High
27	Argument	xxx	predictive	Low
28	Argument	xxx	predictive	Low
29	Argument	xxxxxxxx_xxxxxx/xxxxxxxx_xxxx/xxxxxxxx_xxxxxxxx/xxxxxxxx_xxxx	predictive	High
30	Argument	xxxx	predictive	Low
31	Argument	xxxx	predictive	Low
32	Argument	xx	predictive	Low
33	Argument	xx	predictive	Low
34	Argument	xxxxxxxxx	predictive	Medium
35	Argument	xxxxxx xxxxxxxxxxx	predictive	High
36	Argument	xxxxx	predictive	Low
37	Argument	xxxxxx	predictive	Low
38	Argument	xxxxxx/xxxxxx_xxxxxx	predictive	High
39	Argument	xxxx_xxxx	predictive	Medium
40	Argument	xxxxxxxxxxxxxxxxxxxx	predictive	High
41	Argument	xxxxx	predictive	Low
42	Argument	x_xxxx_xx	predictive	Medium
43	Argument	xxx	predictive	Low
44	Argument	xxx	predictive	Low
45	Argument	xxx	predictive	Low
46	Input Value	' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)-- xxxx	predictive	High
47	Input Value	-x	predictive	Low

References (13)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!