HackTool.Linux.NetSpy.A

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

Arrival Details

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Hacking Tool drops the following files:

• {malware or user path}/alive.txt → list of responsive alive IP addresses and merged CIDR network blocks

Propagation

This Hacking Tool does not have any propagation routine.

Backdoor Routine

This Hacking Tool does not have any backdoor routine.

Rootkit Capabilities

This Hacking Tool does not have rootkit capabilities.

Information Theft

This Hacking Tool does not have any information-stealing capability.

Other Details

This Hacking Tool does the following:

• Automatically enumerates all private `/24` subnets across RFC 1918 address spaces (`10.0.0.0/8`, `172.16.0.0/12`, and `192.168.0.0/16`) when the special intranet mode (`-i`) is enabled.
• Performs sparse IP sampling within each target `/24` subnet by generating probe targets consisting of fixed host ending digits (by default `.1`, `.254`, `.2`, and `.255`) and one randomized ending digit (default: 1) to quickly determine active subnets without exhaustive full-range sweeps.
• Probes target IP addresses using one of five selectable protocol engines:
  • ARP Mode (`arpspy` / `as`)
  • ICMP Mode (`icmpspy` / `is`)
  • Ping Mode (`pingspy` / `ps`)
  • TCP Mode (`tcpspy` / `ts`)
  • UDP Mode (`udpspy` / `us`)
• Distributes network reconnaissance across a configurable pool of concurrent Go goroutine workers
• Consolidates discovered active host addresses and automatically merges adjacent responsive `/24` subnets into unified CIDR supernet blocks.
• It uses the following version of netspy:
  • netspy v0.0.5
• It displays the list of parameters that can be used when executed without parameters in a console:
  

It accepts the following parameters:

• -c {CIDR}, --cidr {CIDR} → used to specify the target CIDR network range to probe (eg, 1721600/12)
• -d, --debug → used to show diagnostic debug information
• -e {Digits}, --end {Digits} → used to specify the ending host digits of the IP addresses to probe (default: "1", "254", "2", "255")
• -f, --force → used to force probing of all generated IP addresses
• -h, --help → used to display help menu
• -i, --special → used to spy special intranet ranges (automatically scans all RFC 1918 private subnets 10000/8, 1721600/12, and 19216800/16)
• -m {Milliseconds}, --timeout {Milliseconds} → used to specify packet sending timeout in milliseconds (default: 500)
• -o {File Path}, --output {File Path} → used to output responsive alive host results to a file in text format (default: "alivetxt")
• -p {Ports}, --port {Ports} → used to specify TCP or UDP destination ports to probe when using tcpspy or udpspy
• -r {Integer}, --random {Integer} → used to specify the number of randomized ending digits in IP addresses to probe (default: 1)
• -s, --silent → used to display only responsive alive CIDRs in output
• -t {Integer}, --thread {Integer} → used to specify the number of concurrent worker threads (default: cpu * 20)
• -x, --rapid → used to enable rapid spy mode
• arpspy, as → used to specify raw Ethernet ARP protocol mode to spy
• help, h → used to display a list of commands or help for a specific command
• icmpspy, is → used to specify raw ICMP protocol mode to spy
• pingspy, ps → used to specify system ping command mode to spy
• tcpspy, ts → used to specify TCP protocol mode to spy
• udpspy, us → used to specify UDP protocol mode to spy
• version, v → used to display version information

It does not exploit any vulnerability.