Pulse Detail — Threat Intelligence

● 0 online

ANALYZING THREAT INTELLIGENCE

PULSE NAME

Pegasus Ongoing l Cellbrite | Exodus | Brian Sabey | HallRender | Tulach (1.29.24)

WHITE Q.Vashti 2025-12-29 Modified: 2025-12-29

13628

IOCs

HIGH VOLUME

↓ CSV ↓ JSON

ssl certificate network malware whois record contacted pegasus resolutions communicating sa victim assaulter quasar brian sabey go.sabey ioc search new ioc teams api contact threat analyzer threat paste iocs urls https samples united aaaa status susp search passive dns urls domain creation date date next show domain related feeds ioc maltiverse analyze scan endpoints all octoseek url https pulse pulses http ip address related nids files location all search otx octoseek hostname pulse submit url analysis files china unknown as4134 chinanet unknown name servers showing namesilo domain name dynadot llc as8075 script urls netherlands a domains capture asnone united record value expiration date entries cname tulach algorithm v3 serial number key algorithm key identifier subject key identifier x509v3 key usage x509v3 extended info first server available from iana id registrar abuse registrar url registrar whois abuse contact email registry domain code win32 exe ufed iphone cellebrite ufed setup tjprojmain ufed4pc win32 dll detections type name responder exodus android office open xml document cellebrite type name pdf cellebrite ufed release cellbrite privilege https targets sa survivor getprocaddress indicator prefetch8 mitre att ck id show technique ck matrix file pattern match observed email path factory hybrid general model comspec click title page body doctype quoth raven gmt content type vary accept october december copy execution awful referrer april kimsuky malicious crypto startpage hacktool installer tofsee historical ssl threat roundup phishing utc submissions submitters csc corporate domains twitter dropbox incapsula summary iocs graph community registrarsafe gandi sas google llc amazon02 google akamaias facebook service patch namecheapnet cloudflarenet amazonaes gmo internet apple tsara brashears keylogger

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1140 T1027 T1036 T1057 T1059 T1071 T1082 T1083 T1105 T1106 T1114 T1129 T1546 T1588 T1056.001

MALWARE FAMILIES

Exodus Quasar RAT PWS:Win32/Raven Kimsuky VirTool:Win32/Tofsee

Indicators of Compromise (2 / 13628 total)

All URL FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain hostname CVE email SSLCertFingerprint

TYPE	INDICATOR	DESCRIPTION	CREATED
CVE	CVE-2018-8453	—	2025-12-29
CVE	CVE-2017-11882	—	2025-12-29

References (10)

↗ https://tulach.cc/ ↗ cellebrite.com | https://cellebrite.com/en/federal-government/ ↗ https://www.pornhub.com/video/search?search=tsara+brashears ↗ https://twitter.com/PORNO_SEXYBABES ↗ hanmail.net ↗ 114.114.114.114 ↗ work.a-poster.info ↗ www-stage40.pornhub.com ↗ go.sabey.com ↗ sabey.com