Mirrors/cyber_threat_intelligence
6
0
Fork 0
mirror of https://github.com/vuldb/cyber_threat_intelligence synced 2024-06-29 02:12:51 +00:00
Code Issues Packages Projects Releases Wiki Activity
a4924b8159
cyber_threat_intelligence/actors/BitRAT
History
Marc Ruef a4924b8159 Update August 2023
2023-08-01 08:06:09 +02:00
..
README.md Update August 2023 2023-08-01 08:06:09 +02:00

README.md

BitRAT - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as BitRAT. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.bitrat

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with BitRAT:

There are 19 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of BitRAT.

ID IP address Hostname Campaign Confidence
1 2.56.59.48 - - High
2 2.56.59.72 - - High
3 2.56.59.82 - - High
4 2.56.59.146 - - High
5 2.56.59.239 - - High
6 2.58.149.245 - - High
7 3.21.21.95 ec2-3-21-21-95.us-east-2.compute.amazonaws.com - Medium
8 3.91.91.127 ec2-3-91-91-127.compute-1.amazonaws.com - Medium
9 4.236.162.205 - - High
10 5.181.234.150 - - High
11 5.189.188.138 vmi536257.contaboserver.net - High
12 5.206.224.224 metin2toplist - High
13 5.230.84.38 - - High
14 5.253.84.122 - - High
15 8.208.27.150 - - High
16 8.208.102.114 - - High
17 8.209.67.224 - - High
18 20.12.20.153 - - High
19 20.80.15.232 - - High
20 20.80.30.45 - - High
21 20.80.31.89 - - High
22 20.80.51.178 - - High
23 20.84.45.190 - - High
24 20.88.45.202 - - High
25 20.88.54.36 - - High
26 20.98.18.253 - - High
27 20.98.138.214 - - High
28 20.106.72.179 - - High
29 20.106.79.78 - - High
30 20.112.83.244 - - High
31 20.114.21.181 - - High
32 20.114.61.232 - - High
33 20.115.149.198 - - High
34 20.124.111.166 - - High
35 20.150.203.158 - - High
36 20.151.200.9 - - High
37 20.169.8.10 - - High
38 20.171.84.250 - - High
39 20.194.35.6 - - High
40 23.19.58.166 i58.166.lofame.net - High
41 23.19.227.243 - - High
42 23.84.180.96 023-084-180-096.res.spectrum.com - High
43 23.94.54.231 23-94-54-231-host.colocrossing.com - High
44 23.105.131.195 mail195.nessfist.com - High
45 23.105.171.80 desiignplaza.world - High
46 23.146.242.85 - - High
47 31.7.63.14 rack223ch.idfnv.ne - High
48 31.210.20.187 - - High
49 31.210.20.236 - - High
50 31.210.21.21 lilut.top - High
51 31.210.21.114 larul.top - High
52 31.220.44.253 - - High
53 34.121.150.14 14.150.121.34.bc.googleusercontent.com - Medium
54 37.0.8.108 lloydfox.capitolreservations.com - High
55 37.0.10.6 - - High
56 37.0.10.19 - - High
57 37.0.10.62 - - High
58 37.0.10.63 - - High
59 37.0.10.252 - - High
60 37.0.11.99 - - High
61 37.0.11.164 - - High
62 37.0.11.177 - - High
63 37.0.11.183 - - High
64 37.0.11.212 - - High
65 37.0.11.221 - - High
66 37.0.14.212 - - High
67 37.120.152.157 - - High
68 37.120.234.40 no-rdns.m247.com - High
69 40.82.152.253 - - High
70 40.88.44.226 - - High
71 41.36.83.211 host-41.36.83.211.tedata.net - High
72 41.102.8.156 - - High
73 ... ... ... ...

There are 290 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by BitRAT. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1006 CWE-21, CWE-22 Pathname Traversal High
2 T1040 CWE-294, CWE-319 Authentication Bypass by Capture-replay High
3 T1055 CWE-74 Injection High
4 T1059 CWE-88, CWE-94 Cross Site Scripting High
5 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
6 ... ... ... ...

There are 18 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by BitRAT. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File //WEB-INF Medium
2 File /about.php Medium
3 File /admin.php/update/getFile.html High
4 File /admin/cashadvance_row.php High
5 File /admin/index2.html High
6 File /admin/maintenance/view_designation.php High
7 File /admin/userprofile.php High
8 File /adms/admin/?page=vehicles/sell_vehicle High
9 File /adms/admin/?page=vehicles/view_transaction High
10 File /api/baskets/{name} High
11 File /APR/login.php High
12 File /bin/httpd Medium
13 File /cgi-bin/wapopen High
14 File /cgi-bin/wlogin.cgi High
15 File /classes/master.php?f=delete_order High
16 File /College/admin/teacher.php High
17 File /Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx High
18 File /dcim/rack-roles/ High
19 File /DXR.axd Medium
20 File /feeds/post/publish High
21 File /forum/away.php High
22 File /goform/aspForm High
23 File /h/ Low
24 File /home/masterConsole High
25 File /home/sendBroadcast High
26 File /inc/jquery/uploadify/uploadify.php High
27 File /inc/topBarNav.php High
28 File /index.php Medium
29 File /index.php?app=main&func=passport&action=login High
30 File /index.php?page=category_list High
31 File /jobinfo/ Medium
32 File /kelas/data Medium
33 File /librarian/bookdetails.php High
34 File /Moosikay/order.php High
35 File /mygym/admin/index.php?view_exercises High
36 File /opac/Actions.php?a=login High
37 File /owa/auth/logon.aspx High
38 File /php-opos/index.php High
39 File /PreviewHandler.ashx High
40 File /public/launchNewWindow.jsp High
41 File /reservation/add_message.php High
42 File /student/bookdetails.php High
43 File /uncpath/ Medium
44 File /uploads/exam_question/ High
45 File /user/profile High
46 File /user/updatePwd High
47 File /var/lib/docker/<remapping> High
48 File /wireless/security.asp High
49 File /wp-admin/admin-ajax.php High
50 File /zm/index.php High
51 File a-forms.php Medium
52 File acloudCosAction.php.SQL High
53 File activenews_view.asp High
54 File ActiveServices.java High
55 File adclick.php Medium
56 File admin.a6mambocredits.php High
57 ... ... ...

There are 496 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2023 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!