{ "type": "Domain", "indicator": "abdata-testing.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/abdata-testing.com", "alexa": "http://www.alexa.com/siteinfo/abdata-testing.com", "indicator": "abdata-testing.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3911743153, "indicator": "abdata-testing.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "66c235b05007103d3e3e7038", "name": "HCA - Win32:RansomX-gen affecting HCA (HealthOneCares) + Miscellaneous Attacks", "description": "HCA (Health One Cares) affected by a RansomX and various serious attacks. It's linked back to a neurosurgeon who is likely not responsible for attack of course. It has been the same,e group of attackers using Samuel Tulach engineered malware. I'm unsure if there is collusion between Brian Sabey (consistent attacker) and Samuel Tulach. I just know it relates back to the same threat actors that have been hacking healthcare facilities, government offices, telecommunications, technology at health centers abusing webcams and patients records modification, and distribution. PHI PII issues.", "modified": "2024-09-17T17:01:24.349000", "created": "2024-08-18T17:56:00.485000", "tags": [ "blacklist http", "safe site", "no data", "tag count", "analyzer threat", "url summary", "ip summary", "summary", "sample", "samples", "detection list", "cisco umbrella", "site", "alexa top", "united", "million", "mail spammer", "malicious site", "phishing site", "team phishing", "tofsee", "malware", "bank", "unsafe", "azorult", "cobalt strike", "service", "runescape", "facebook", "download", "zbot", "installcore", "nymaim", "suppobox", "malicious", "cl0p", "inmortal", "domains", "referrer", "historical ssl", "apple stuff", "combined", "hr rtd", "network", "collection", "vt graph", "round", "metro", "execution", "emotet", "startpage", "maltiverse top", "paypal", "blacklist", "passive dns", "related nids", "urls", "flag united", "accept", "acceptencoding", "hit age", "ip asn", "malware site", "adware", "fakealert", "opencandy", "exploit", "raccoon", "metastealer", "redline stealer", "anonymizer", "heur", "outlook", "phishing airbnb", "engineering", "phishing", "filerepmalware", "maltiverse", "div div", "c span", "div section", "span div", "search", "showing", "unknown", "as397240", "moved", "date", "body", "as54113", "github pages", "a domains", "entries", "mtb jul", "class", "sea x", "scan endpoints", "all scoreblue", "alf features", "related pulses", "file samples", "files matching", "show", "date hash", "next", "worm", "dynamicloader", "yara rule", "high", "windows", "grum", "medium", "installs", "windows startup", "application", "stream", "as22612", "ipv4", "pulse pulses", "files", "switch dns", "query", "data", "noname057", "password", "cybercrime", "malicious url", "kuaizip", "team", "downloader", "generic", "crack", "presenoker", "dapato", "riskware", "genkryptik", "fuery", "agent", "wacatac", "union", "shellexecuteexw", "hash", "writeconsolew", "registry", "t1031", "trojan", "copy", "dock", "write", "win32", "file execution", "explorer", "alerts", "checks", "bios", "system restore", "anne", "training", "strings http", "basic telephone", "xsl stylesheets", "apache fop", "createdate", "modifydate", "producer apache", "format", "core", "nxscspu", "zsextbzusbrvsk", "pxnzj", "jwxkrhdlrivprs", "default", "qxrfnjuodik", "mncau", "csqvrkwsqka", "testpath path", "else", "null", "suspicious", "win64", "hotkey", "ransom", "icmp traffic", "packing t1045", "t1045", "pdb path", "pe resource", "push" ], "references": [ "https://www.healthonecares.com/physicians/profile/xxxxxxxxxx-MD | Attacker is tracking & hacking every service target has used.", "Adversary: https://tulach.cc/ - Maware engineer. It's believed his malware is being used by Brian Sabey of Hall Render", "Adversary: https://github.com/SamuelTulach/VirusTotalUploader", "https://work.a-poster.info", "Emotet: FileHash-MD5 9e78accf19de70b1e614c9bd9d9a7928", "Emotet: FileHash-SHA1 2493981a18613a750ac3165199ec030a7c00663f", "Emotet: FileHash-SHA256 0071c6eea86a219777df283cc476ca450df4b04f4c7ed0eb48fbdf3a9cf7888f", "http://feeds.soundcloud.com/users/soundcloud:users:73198681/sounds.rss", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA1 b0b2c74463496c0020faf4655e83449f7e8019ec", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA1 b0b2c74463496c0020faf4655e83449f7e8019ec", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA256 00000ae84c4f1f2332ef155130b4b8d65f1ed972a9cd851fe9e85f236f8cfa32", "pornhero.net| itsyourporn.com | http://cdn.itsyourporn.com | http://cdn.itsyourporn.com/assets/images/logo.jpg. http://cdn2.video.itsyourporn.com | https://cdn.itsyourporn.com | https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | www.pornhub.com", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "Antivirus Detections Other:Malware-gen\\ [Trj] , ALF:TrojanDownloader:PowerShell/Ploprolo.DB Alerts network_icmp nolookup_communication injection_resumethread suspicious_powershell", "IDS Detections: IDS Detections SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)", "IDS Detections: Possible HTA Application Download Dotted Quad Host HTA Request HTTP request for .exe file with no User-Agent", "Alerts: network_icmp nolookup_communication injection_resumethread suspicious_powershell network_cnc_http", "Antivirus Detections: Win.Malware.Moonlight-9919383-0 , Worm:Win32/Lightmoon.H", "Yara Detections: Nrv2x , upx_3 , UPX_OEP_place , UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser , UPX", "Alerts: antidebug_windows infostealer_cookies persistence_autorun antivm_generic_bios deletes_executed_files", "Alerts: disables_system_restore infostealer_mail persistence_ifeo recon_fingerprint stealth_hidden_extension stealth_hiddenreg" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Cl0p", "display_name": "Cl0p", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "ALF:Trojan:Win32/Cassini_f28c33a2", "display_name": "ALF:Trojan:Win32/Cassini_f28c33a2", "target": null }, { "id": "ALF:HeraklezEval:Worm:Win32/Mimail!rfn", "display_name": "ALF:HeraklezEval:Worm:Win32/Mimail!rfn", "target": null }, { "id": "Tulach Malware", "display_name": "Tulach Malware", "target": null }, { "id": "Trojan:Win32/Emotet.YL", "display_name": "Trojan:Win32/Emotet.YL", "target": "/malware/Trojan:Win32/Emotet.YL" }, { "id": "Win32:RansomX-gen\\ [Ransom]", "display_name": "Win32:RansomX-gen\\ [Ransom]", "target": null }, { "id": "Worm:Win32/Lightmoon.H", "display_name": "Worm:Win32/Lightmoon.H", "target": "/malware/Worm:Win32/Lightmoon.H" }, { "id": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "display_name": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [ "Civilian Society", "Technology", "Healthcare", "Telecommunications", "Media" ], "TLP": "green", "cloned_from": null, "export_count": 50, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 891, "FileHash-MD5": 2368, "FileHash-SHA1": 1873, "FileHash-SHA256": 5092, "domain": 648, "hostname": 557, "CVE": 8, "email": 2 }, "indicator_count": 11439, "is_author": false, "is_subscribing": null, "subscriber_count": 230, "modified_text": "620 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "660b176a98b0c92ba5a962bc", "name": "\"No Problems\" - UAlberta TLD (Confirmed TLD - 08.04.24) & Subdomain compromise", "description": "Basically the above\n\n\"No Problems\", \"We are Unhackable\", etc. etc. causing problems.", "modified": "2024-09-04T05:01:56.993000", "created": "2024-04-01T20:22:02.851000", "tags": [ "BEC" ], "references": [ "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary", "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs", "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark", "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark", "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95", "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore", "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/", "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom", "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America", "Netherlands" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 233, "FileHash-SHA1": 230, "FileHash-SHA256": 6703, "URL": 4450, "CIDR": 3, "domain": 6223, "hostname": 2863, "email": 7, "CVE": 53 }, "indicator_count": 20765, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "634 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary", "Antivirus Detections: Win.Malware.Moonlight-9919383-0 , Worm:Win32/Lightmoon.H", "IDS Detections: IDS Detections SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)", "Adversary: https://tulach.cc/ - Maware engineer. It's believed his malware is being used by Brian Sabey of Hall Render", "IDS Detections: Possible HTA Application Download Dotted Quad Host HTA Request HTTP request for .exe file with no User-Agent", "http://feeds.soundcloud.com/users/soundcloud:users:73198681/sounds.rss", "https://work.a-poster.info", "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark", "Adversary: https://github.com/SamuelTulach/VirusTotalUploader", "Antivirus Detections Other:Malware-gen\\ [Trj] , ALF:TrojanDownloader:PowerShell/Ploprolo.DB Alerts network_icmp nolookup_communication injection_resumethread suspicious_powershell", "pornhero.net| itsyourporn.com | http://cdn.itsyourporn.com | http://cdn.itsyourporn.com/assets/images/logo.jpg. http://cdn2.video.itsyourporn.com | https://cdn.itsyourporn.com | https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | www.pornhub.com", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "Alerts: antidebug_windows infostealer_cookies persistence_autorun antivm_generic_bios deletes_executed_files", "Emotet: FileHash-SHA256 0071c6eea86a219777df283cc476ca450df4b04f4c7ed0eb48fbdf3a9cf7888f", "Emotet: FileHash-SHA1 2493981a18613a750ac3165199ec030a7c00663f", "https://www.healthonecares.com/physicians/profile/xxxxxxxxxx-MD | Attacker is tracking & hacking every service target has used.", "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate", "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/", "Alerts: disables_system_restore infostealer_mail persistence_ifeo recon_fingerprint stealth_hidden_extension stealth_hiddenreg", "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA1 b0b2c74463496c0020faf4655e83449f7e8019ec", "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs", "Alerts: network_icmp nolookup_communication injection_resumethread suspicious_powershell network_cnc_http", "Yara Detections: Nrv2x , upx_3 , UPX_OEP_place , UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser , UPX", "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark", "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom", "Emotet: FileHash-MD5 9e78accf19de70b1e614c9bd9d9a7928", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA256 00000ae84c4f1f2332ef155130b4b8d65f1ed972a9cd851fe9e85f236f8cfa32", "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Alf:heraklezeval:worm:win32/mimail!rfn", "Win32:ransomx-gen\\ [ransom]", "Cl0p", "Domains", "Worm:win32/lightmoon.h", "Trojan:win32/emotet.yl", "Alf:trojandownloader:powershell/ploprolo.db", "Tulach malware", "Alf:trojan:win32/cassini_f28c33a2", "Inmortal" ], "industries": [ "Technology", "Healthcare", "Media", "Education", "Government", "Telecommunications", "Civilian society" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "66c235b05007103d3e3e7038", "name": "HCA - Win32:RansomX-gen affecting HCA (HealthOneCares) + Miscellaneous Attacks", "description": "HCA (Health One Cares) affected by a RansomX and various serious attacks. It's linked back to a neurosurgeon who is likely not responsible for attack of course. It has been the same,e group of attackers using Samuel Tulach engineered malware. I'm unsure if there is collusion between Brian Sabey (consistent attacker) and Samuel Tulach. I just know it relates back to the same threat actors that have been hacking healthcare facilities, government offices, telecommunications, technology at health centers abusing webcams and patients records modification, and distribution. PHI PII issues.", "modified": "2024-09-17T17:01:24.349000", "created": "2024-08-18T17:56:00.485000", "tags": [ "blacklist http", "safe site", "no data", "tag count", "analyzer threat", "url summary", "ip summary", "summary", "sample", "samples", "detection list", "cisco umbrella", "site", "alexa top", "united", "million", "mail spammer", "malicious site", "phishing site", "team phishing", "tofsee", "malware", "bank", "unsafe", "azorult", "cobalt strike", "service", "runescape", "facebook", "download", "zbot", "installcore", "nymaim", "suppobox", "malicious", "cl0p", "inmortal", "domains", "referrer", "historical ssl", "apple stuff", "combined", "hr rtd", "network", "collection", "vt graph", "round", "metro", "execution", "emotet", "startpage", "maltiverse top", "paypal", "blacklist", "passive dns", "related nids", "urls", "flag united", "accept", "acceptencoding", "hit age", "ip asn", "malware site", "adware", "fakealert", "opencandy", "exploit", "raccoon", "metastealer", "redline stealer", "anonymizer", "heur", "outlook", "phishing airbnb", "engineering", "phishing", "filerepmalware", "maltiverse", "div div", "c span", "div section", "span div", "search", "showing", "unknown", "as397240", "moved", "date", "body", "as54113", "github pages", "a domains", "entries", "mtb jul", "class", "sea x", "scan endpoints", "all scoreblue", "alf features", "related pulses", "file samples", "files matching", "show", "date hash", "next", "worm", "dynamicloader", "yara rule", "high", "windows", "grum", "medium", "installs", "windows startup", "application", "stream", "as22612", "ipv4", "pulse pulses", "files", "switch dns", "query", "data", "noname057", "password", "cybercrime", "malicious url", "kuaizip", "team", "downloader", "generic", "crack", "presenoker", "dapato", "riskware", "genkryptik", "fuery", "agent", "wacatac", "union", "shellexecuteexw", "hash", "writeconsolew", "registry", "t1031", "trojan", "copy", "dock", "write", "win32", "file execution", "explorer", "alerts", "checks", "bios", "system restore", "anne", "training", "strings http", "basic telephone", "xsl stylesheets", "apache fop", "createdate", "modifydate", "producer apache", "format", "core", "nxscspu", "zsextbzusbrvsk", "pxnzj", "jwxkrhdlrivprs", "default", "qxrfnjuodik", "mncau", "csqvrkwsqka", "testpath path", "else", "null", "suspicious", "win64", "hotkey", "ransom", "icmp traffic", "packing t1045", "t1045", "pdb path", "pe resource", "push" ], "references": [ "https://www.healthonecares.com/physicians/profile/xxxxxxxxxx-MD | Attacker is tracking & hacking every service target has used.", "Adversary: https://tulach.cc/ - Maware engineer. It's believed his malware is being used by Brian Sabey of Hall Render", "Adversary: https://github.com/SamuelTulach/VirusTotalUploader", "https://work.a-poster.info", "Emotet: FileHash-MD5 9e78accf19de70b1e614c9bd9d9a7928", "Emotet: FileHash-SHA1 2493981a18613a750ac3165199ec030a7c00663f", "Emotet: FileHash-SHA256 0071c6eea86a219777df283cc476ca450df4b04f4c7ed0eb48fbdf3a9cf7888f", "http://feeds.soundcloud.com/users/soundcloud:users:73198681/sounds.rss", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA1 b0b2c74463496c0020faf4655e83449f7e8019ec", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA1 b0b2c74463496c0020faf4655e83449f7e8019ec", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA256 00000ae84c4f1f2332ef155130b4b8d65f1ed972a9cd851fe9e85f236f8cfa32", "pornhero.net| itsyourporn.com | http://cdn.itsyourporn.com | http://cdn.itsyourporn.com/assets/images/logo.jpg. http://cdn2.video.itsyourporn.com | https://cdn.itsyourporn.com | https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | www.pornhub.com", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "Antivirus Detections Other:Malware-gen\\ [Trj] , ALF:TrojanDownloader:PowerShell/Ploprolo.DB Alerts network_icmp nolookup_communication injection_resumethread suspicious_powershell", "IDS Detections: IDS Detections SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)", "IDS Detections: Possible HTA Application Download Dotted Quad Host HTA Request HTTP request for .exe file with no User-Agent", "Alerts: network_icmp nolookup_communication injection_resumethread suspicious_powershell network_cnc_http", "Antivirus Detections: Win.Malware.Moonlight-9919383-0 , Worm:Win32/Lightmoon.H", "Yara Detections: Nrv2x , upx_3 , UPX_OEP_place , UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser , UPX", "Alerts: antidebug_windows infostealer_cookies persistence_autorun antivm_generic_bios deletes_executed_files", "Alerts: disables_system_restore infostealer_mail persistence_ifeo recon_fingerprint stealth_hidden_extension stealth_hiddenreg" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Cl0p", "display_name": "Cl0p", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "ALF:Trojan:Win32/Cassini_f28c33a2", "display_name": "ALF:Trojan:Win32/Cassini_f28c33a2", "target": null }, { "id": "ALF:HeraklezEval:Worm:Win32/Mimail!rfn", "display_name": "ALF:HeraklezEval:Worm:Win32/Mimail!rfn", "target": null }, { "id": "Tulach Malware", "display_name": "Tulach Malware", "target": null }, { "id": "Trojan:Win32/Emotet.YL", "display_name": "Trojan:Win32/Emotet.YL", "target": "/malware/Trojan:Win32/Emotet.YL" }, { "id": "Win32:RansomX-gen\\ [Ransom]", "display_name": "Win32:RansomX-gen\\ [Ransom]", "target": null }, { "id": "Worm:Win32/Lightmoon.H", "display_name": "Worm:Win32/Lightmoon.H", "target": "/malware/Worm:Win32/Lightmoon.H" }, { "id": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "display_name": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [ "Civilian Society", "Technology", "Healthcare", "Telecommunications", "Media" ], "TLP": "green", "cloned_from": null, "export_count": 50, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 891, "FileHash-MD5": 2368, "FileHash-SHA1": 1873, "FileHash-SHA256": 5092, "domain": 648, "hostname": 557, "CVE": 8, "email": 2 }, "indicator_count": 11439, "is_author": false, "is_subscribing": null, "subscriber_count": 230, "modified_text": "620 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "660b176a98b0c92ba5a962bc", "name": "\"No Problems\" - UAlberta TLD (Confirmed TLD - 08.04.24) & Subdomain compromise", "description": "Basically the above\n\n\"No Problems\", \"We are Unhackable\", etc. etc. causing problems.", "modified": "2024-09-04T05:01:56.993000", "created": "2024-04-01T20:22:02.851000", "tags": [ "BEC" ], "references": [ "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary", "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs", "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark", "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark", "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95", "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore", "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/", "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom", "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America", "Netherlands" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 233, "FileHash-SHA1": 230, "FileHash-SHA256": 6703, "URL": 4450, "CIDR": 3, "domain": 6223, "hostname": 2863, "email": 7, "CVE": 53 }, "indicator_count": 20765, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "634 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "abdata-testing.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "abdata-testing.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780242809.2611325 }