← Back to Pulse Feed
PULSE DETAIL
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Ransom
Tofsee
TEL:CreateScheduledTask
Mirai
Unix.Trojan.Mirai-6981169-0
Backdoor:Win32/Tofsee
Ransom:Win32/Haperlock
Trojan:Win32/Neurevt
DDoS:Linux/Gafgyt.YA!MTB
CVE-2017-17215
CVE-2023-27350
CVE-2014-8361
Trojan:Win32/Zombie.A
NIDS
M1
OneLouder
TrojanSpy
Win.Trojan.Sarwent-10012602-0
Virus:Win32/Sivis.A
Win.Trojan.Installcore-1177
Win.Malware.Oxypumper-6900435-0
Win.Malware.Qshell-9875653-0
Indicators of Compromise (4 / 24907 total)
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| CVE | CVE-2017-17215 | — | 2025-01-21 | |
| CVE | CVE-2023-27350 | — | 2025-01-21 | |
| CVE | CVE-2014-8361 | — | 2025-01-21 | |
| CVE | CVE-2023-4966 | — | 2025-01-21 |
References (32)
↗ DISTINCTIO8.pdf
↗ FileHash - SHA256 001f0ebe975b5f5a7e5272f53455635cc938a5a0129417f7e79c39df6cf65657 | Yara Detections: stack_string
↗ IDS Detections: Win32/Tofsee.AX google.com connectivity check Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 8 through 15 set
↗ Tofsee: 'google.com' | https://www.gov50.icu |
↗ ET TROJAN Win32/DarkWatchman Checkin Activity (POST) ( This is true. They sit around watching, following...)
↗ Alerts: procmem_yara injection_inter_process creates_largekey network_bind persistence_autorun antivm_generic_disk
↗ Alerts: persistence_autorun_tasks spawns_dev_util cape_detected_threat injection_process_hollowing
↗ hubt.pornhub.com | www.pornhub.com | pornative.com
↗ https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian || pin.it || https://pin.it/
↗ www.sweetheartvideo.com || https://www.sweetheartvideo.com/tsara-brashears/
↗ Unix.Trojan.Mirai-6981169-0: FileHash - SHA256 fe00b364b6b8342e3ce0dd146902ac3330ab976e87aca6be666efde39ea485da
↗ IDS Detections: WGET Command Specifying Output in HTTP Headers
↗ IDS Detections: D-Link Devices Home Network Administration Protocol Command Execution
↗ Yara Detections: is__elf , DemonBot
↗ Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication writes_to_stdout
↗ FileHash - SHA256 f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c
↗ IDS Detections: Andariel Backdoor Activity (Checkin)
↗ Alerts: dead_host nids_malware_alert network_icmp nolookup_communication
↗ DDoS:Linux/Gafgyt : FileHash - SHA256 358c2bd5b9e925dc23894dec18ce486c03d743cde766ce298ac1e2f00d86f0b2
↗ IDS Detection: Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound
↗ IDS Detection: Mirai Variant User-Agent (Inbound) WebShell Generic - wget http - POST
↗ IDS Detection: Observed Suspicious UA (Hello-World) Suspicious Activity potential UPnProxy
↗ http://vortex-nlb-http2-fed-us-taut-purple.nr-data.net/
↗ https://tulach.cc/ || tulach.cc || www-temp.metrobyt-mobile.com
↗ apple-reactivate.com | appleweb-aem.apple.com | apple.com | revoked-aprtr1-tr1g1.apple.com | network-framework.apple.com
↗ autodiscover.webcompanion.com || avc-gft-dashboard.apple.com || cac1-wwfde-wave.apple.com || demo27.apple.com
↗ * https://github.com/MSUDenverSystemsEngineering/Salt-Instructional-18/tree/master/AppDeployToolkit
↗ https://tulach.cc/ | tulach.cc |
↗ http://hallrender.com/attorney/brian-sabey | www-temp.metrobyt-mobile.com
↗ google.pl | aplikacja.ceidg.gov.pl | imaginecup.pl | microsoft.pl
↗ 18teen.net | teensnow.com | grannies-porn.net | pornmd.com
↗ www.pornhubselect.com | pornhub.software