RunForestRunMalware
- Blackhole
- sutra
Active around 2012-2013, this family deployed small JavaScript snippets on infected websites to load exploit kit scripts from DGA-generated domains. It commonly used the Blackhole exploit kit and the Sutra Traffic Distribution System (TDS), which caused it to sometimes be misnamed as Blackhole or Sutra.From MISP Galaxy
Last reported 22 days ago, by Rapid71 report
ATT&CK techniques
6 of 34 · each with the sentence it comes from- T1005Data from Local System
“T1005 Data from Local System”
- T1008Fallback Channels
“T1008 Fallback Channels”
- T1016System Network Configuration Discovery
“T1016 System Network Configuration Discovery”
- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
- T1027.013Encrypted/Encoded File
“T1027.013 Encrypted/Encoded File”
- T1030Data Transfer Size Limits
“T1030 Data Transfer Size Limits”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
SMTP is the key: BPFDoor and AVERAT hitting the network edge“Rblsmtpd is a standard daemon used by mail servers (like qmail) to block mail from IPs listed in Real-time Blackhole Lists (RBLs).”
Indicators in its reports
named in the reports above- spamsniper[.]pidin 1 report
- a37ea9897221d449…ee58931adbf3in 1 report
- 7e667ba5f9df912e…18ebd925b1b5in 1 report
- a6f3b7f932761fb1…65da195bfa7ain 1 report
- 4435fcd686292109…13ee8e226ef9in 1 report
- 652508a9cf40bee8…c21f73b4963fin 1 report
- 2bedc26d4b29b435…4fb1656d7b15in 1 report
- 59.125.211[.]65in 1 report
- 122.116.138[.]33in 1 report
- 1.34.200[.]85in 1 report
- bf8135f46ecedfe5…8e6597f49e47in 1 report
- 4925bcca085ec504…336c697b4de8in 1 report
- a4379e115d3c4420…d47de68e6a6ain 1 report
- 925c041807d4fb9d…44478ffc2cf2in 1 report
- 2fe2dd402ee6f9c5…ca80feb60150in 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.