{ "type": "Domain", "indicator": "algmath.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/algmath.com", "alexa": "http://www.alexa.com/siteinfo/algmath.com", "indicator": "algmath.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3457301735, "indicator": "algmath.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "665c44f012d938d1c7dd591e", "name": "PIT Projekt.exe (www.pitprojekt.pl , pitprojekt.pl) oraz Ceidg.gov.pl - Dane publiczne wpisu", "description": "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4 NIP:6161230754\nhttps://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778 NIP;6112323510\nhttp://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778\n2.16.6.145146f05-9aac-4942-a42d-f2550a19c0c4 NIP:6131434311\nipv4: 2.16.6.14, 2.16.6.6, 2.16.6.1,", "modified": "2025-10-06T11:12:39.639000", "created": "2024-06-02T10:09:52.601000", "tags": [ "ceidg.gov.pl - centralna ewidencja i informacja o dzia\u0142alno\u015bci g", "prosz czeka", "pobierz plik", "wojcieszyce", "urls competing", "ceidg centralna", "gospodarczej", "wyszukiwanie", "przejd", "centrum pomocy", "informacja o", "mapa", "strona gwna", "przegldanie", "ceidg szybki", "uwagi prawne", "deklaracja", "serwer", "returnurl", "idf3ee4c4ee00", "id7a025cc6516", "wctxrm0", "idf3ee4c4", "id35146f059aa", "ideb8f4cf26ef", "id7a025cc", "id35146f0", "publicznywsz3", "id97c275c", "url wiek", "ssdeep", "sha1", "pehasz", "typlibid", "pit projekt", "chcesz", "pity online", "program", "interesuje ci", "pity zapisane", "jeli", "oddajemy w", "twoje rce", "dziki jego" ], "references": [ "http://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4", "https://aplikacja.ceidg.gov.pl/CEIDG/GroupMenu.aspx?key=_group_search", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=35146f05-9aac-4942-a42d-f2550a19c0c4", "http://www.pitprojekt.pl", "http://pitprojekt.pl" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Wojcieszyce", "display_name": "Wojcieszyce", "target": null }, { "id": "Serwer", "display_name": "Serwer", "target": null }, { "id": "Serwer A Przed\u0142u\u017cenie sesji #{text}", "display_name": "Serwer A Przed\u0142u\u017cenie sesji #{text}", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8271, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1259, "URL": 6009, "hostname": 3030, "FileHash-SHA256": 10233, "FileHash-MD5": 2742, "FileHash-SHA1": 2348, "email": 75, "SSLCertFingerprint": 11, "YARA": 2, "CVE": 13, "FileHash-PEHASH": 1, "IPv4": 34, "IPv6": 6 }, "indicator_count": 25763, "is_author": false, "is_subscribing": null, "subscriber_count": 134, "modified_text": "195 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67f6c635cb8c3c8b256b6dba", "name": "sdfzsdf.ele fac1ec40eea5a4fc05f17e019328e287", "description": "SHA1- 33008f85428a83996083c3da92a8f00595071403\nSHA256\ncdab1c3196887d4f749d82f014786a966c87f35a7189f0f3d078558b957847bf\nhttps://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=7b6726e20c513baebf7fd387a3dd1b7d67a4c7c4\nhttps://ti.qianxin.com/v2/search?type=file&value=fac1ec40eea5a4fc05f17e019328e287\nhttps://www.virustotal.com/gui/file/cdab1c3196887d4f749d82f014786a966c87f35a7189f0f3d078558b957847bf/relations", "modified": "2025-09-01T08:05:17.675000", "created": "2025-04-09T19:10:45.337000", "tags": [ "sha1", "rozmiar", "typ pliku", "win32", "numer wersji", "wersja", "nieznany", "sha512", "crc32", "ssd gboki", "win64", "security", "license v2", "f6 d9", "windows nt", "detects", "gecko", "khtml", "msie", "wow64", "stealer", "error", "userprofile", "hunt", "keylogger", "encrypt", "antivm", "span", "main", "grabber", "hello", "android", "dcrat", "kill", "revengerat", "sandbox", "pass", "chat", "first", "asyncrat", "crypto", "injector", "dropper", "infostealer", "lockfile", "worldwind", "stealerium", "toxiceye", "avemaria", "fast", "persistence", "trojan", "restart", "snakekeylogger", "snake", "accept", "cookie", "code", "killproc", "lazarus", "dearcry", "njrat", "cyrus", "powershell", "info", "body", "floodfix", "downloader", "ransomware", "core", "loki", "fpspy", "klogexe", "firebird", "patch", "explorer", "avkiller", "masslogger", "baldr", "modi rat", "helpme", "osno", "import", "keylog", "screencapture", "ransom", "crypted", "silent", "xorddos", "stormkitty", "ordinal", "locker", "hyperbro", "lamepyre", "parallaxrat", "null", "shurk steal", "arkeistealer", "strongpity", "desktop", "myagent", "bypass", "fatduke", "miniduke", "polyglotduke", "guildma", "spyeye", "corebot", "killmbr", "ooops", "lcpdot", "torisma", "codec", "prometheus", "spook", "crypt", "logger", "zegost", "poshkeylogger", "systembc", "hdlocker", "cryptolocker", "fivehands", "kitty", "goldmax", "rents", "maurigo", "done", "hidewindow", "bokbot", "bladabindi", "darktrack", "darksky", "alien", "karkoff", "inject", "windigo", "rest", "softcnapp", "elysiumstealer", "leivion", "banload", "ultrareach", "ultrasurf", "buterat", "tools", "beasty", "shut", "gravityrat", "fatalrat", "discord", "deadwood", "turian", "markirat", "mark", "klingonrat", "path", "reverserat", "grab", "meta", "voidcrypt", "darkvnc", "ryzerlo", "hiddentear", "boxcaon", "stream", "crimsonrat", "delfi", "infinity", "stealthworker", "gasket", "spoolss", "lu0bot", "target", "attack", "cobaltstrike", "bits", "chaos", "bitcoin", "wiper", "delphi", "slackbot", "neshta", "belarus", "apanas", "runner", "darkcomet", "macoute", "iframe", "vanillarat", "sectoprat", "melt", "tomiris", "apostle", "blackbyte", "kutaki", "override", "windealer", "mkdir", "brbbot", "config", "babylon rat", "spynet", "bazarloader", "clipper", "banker", "gh0st", "piratestealer", "witch", "killme", "vulturi", "tofsee", "slow", "owowa", "flagpro", "write", "dazzlespy", "decryptor", "bandit stealer", "bandit", "darkeye", "recordbreaker", "truebot", "svchost", "clipbanker", "service", "koivm", "arrowrat", "ducktail", "confuser", "gobrat", "modiloader", "chilelocker", "noclose", "strelastealer", "comfoo", "babar", "blankgrabber", "solarmarker", "darkgate", "stub", "banned", "globeimposter", "rhysida", "janelarat", "kraken", "recon", "quiterat", "venomrat", "venom rat", "sapphirestealer", "ntospy", "raccoon", "shifu", "mediapi", "poolrat", "cicada3301", "remoteexec", "babylockerkz", "new service", "creation id", "nextron" ], "references": [ "Windows_Trojan_Tofsee.yar", "Suspicious New Service Creation (1).yml" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 353, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 28, "FileHash-SHA1": 27, "FileHash-SHA256": 1077, "domain": 282, "hostname": 316, "URL": 1092, "YARA": 535, "email": 4 }, "indicator_count": 3361, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "230 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "684403ce9b1bb2b126d9f06c", "name": "search.safefinder.com", "description": "https://search.safefinder.com/csp.aspx?barcode=defaultsf|portal_sf_admarket_tiles_sf", "modified": "2025-07-07T08:03:42.325000", "created": "2025-06-07T09:18:06.098000", "tags": [ "united", "facebook", "anycast", "idc hosting", "akamaias", "yun road", "google", "intranet", "chinahongkong", "softlayer", "first", "main", "code window", "thisdocument", "insert menu", "visio", "vba project", "class modules", "your project", "visual basic", "editor", "add procedure", "loop", "click", "microsoft azure", "tls issuing", "please", "javascript", "ssdeep", "win32", "susp", "mtb apr", "as13335", "unknown", "showing", "entries", "next associated", "urls show", "date checked", "url hostname", "server response", "mtb nov", "heur", "b apr" ], "references": [ "https://search.safefinder.com/csp.aspx?barcode=defaultsf|portal_sf_admarket_tiles_sf", "http://search.safefinder.com/csp.aspx?barcode=defaultsf|portal_sf_admarket_tiles_sf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1137", "name": "Office Application Startup", "display_name": "T1137 - Office Application Startup" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 757, "FileHash-SHA256": 572, "domain": 363, "URL": 1952, "FileHash-MD5": 81, "FileHash-SHA1": 84, "CVE": 1 }, "indicator_count": 3810, "is_author": false, "is_subscribing": null, "subscriber_count": 122, "modified_text": "286 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "681408f5116c9434db80284c", "name": "http://ginko.garden.pl 89132cf3bcb21bfe97cedca144415c75", "description": "A sample of a malicious file, compiled by the Threat Intelligence AI Assistant, has been released by Google's artificial intelligence platform, which automatically generates content for use in its threat intelligence services and services.", "modified": "2025-06-03T00:00:34.642000", "created": "2025-05-01T23:51:17.686000", "tags": [ "file type", "file size", "sha256", "sha512", "windows", "html document", "ai assistant", "machineguid", "systembiosdate", "use windows", "warszawa", "garden parki", "google font", "error", "dovecot imapd", "dovecot pop3d", "postfix smtpd" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 6, "FileHash-SHA256": 5, "URL": 12, "domain": 19, "hostname": 9, "SSLCertFingerprint": 10 }, "indicator_count": 64, "is_author": false, "is_subscribing": null, "subscriber_count": 122, "modified_text": "320 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66c235b05007103d3e3e7038", "name": "HCA - Win32:RansomX-gen affecting HCA (HealthOneCares) + Miscellaneous Attacks", "description": "HCA (Health One Cares) affected by a RansomX and various serious attacks. It's linked back to a neurosurgeon who is likely not responsible for attack of course. It has been the same,e group of attackers using Samuel Tulach engineered malware. I'm unsure if there is collusion between Brian Sabey (consistent attacker) and Samuel Tulach. I just know it relates back to the same threat actors that have been hacking healthcare facilities, government offices, telecommunications, technology at health centers abusing webcams and patients records modification, and distribution. PHI PII issues.", "modified": "2024-09-17T17:01:24.349000", "created": "2024-08-18T17:56:00.485000", "tags": [ "blacklist http", "safe site", "no data", "tag count", "analyzer threat", "url summary", "ip summary", "summary", "sample", "samples", "detection list", "cisco umbrella", "site", "alexa top", "united", "million", "mail spammer", "malicious site", "phishing site", "team phishing", "tofsee", "malware", "bank", "unsafe", "azorult", "cobalt strike", "service", "runescape", "facebook", "download", "zbot", "installcore", "nymaim", "suppobox", "malicious", "cl0p", "inmortal", "domains", "referrer", "historical ssl", "apple stuff", "combined", "hr rtd", "network", "collection", "vt graph", "round", "metro", "execution", "emotet", "startpage", "maltiverse top", "paypal", "blacklist", "passive dns", "related nids", "urls", "flag united", "accept", "acceptencoding", "hit age", "ip asn", "malware site", "adware", "fakealert", "opencandy", "exploit", "raccoon", "metastealer", "redline stealer", "anonymizer", "heur", "outlook", "phishing airbnb", "engineering", "phishing", "filerepmalware", "maltiverse", "div div", "c span", "div section", "span div", "search", "showing", "unknown", "as397240", "moved", "date", "body", "as54113", "github pages", "a domains", "entries", "mtb jul", "class", "sea x", "scan endpoints", "all scoreblue", "alf features", "related pulses", "file samples", "files matching", "show", "date hash", "next", "worm", "dynamicloader", "yara rule", "high", "windows", "grum", "medium", "installs", "windows startup", "application", "stream", "as22612", "ipv4", "pulse pulses", "files", "switch dns", "query", "data", "noname057", "password", "cybercrime", "malicious url", "kuaizip", "team", "downloader", "generic", "crack", "presenoker", "dapato", "riskware", "genkryptik", "fuery", "agent", "wacatac", "union", "shellexecuteexw", "hash", "writeconsolew", "registry", "t1031", "trojan", "copy", "dock", "write", "win32", "file execution", "explorer", "alerts", "checks", "bios", "system restore", "anne", "training", "strings http", "basic telephone", "xsl stylesheets", "apache fop", "createdate", "modifydate", "producer apache", "format", "core", "nxscspu", "zsextbzusbrvsk", "pxnzj", "jwxkrhdlrivprs", "default", "qxrfnjuodik", "mncau", "csqvrkwsqka", "testpath path", "else", "null", "suspicious", "win64", "hotkey", "ransom", "icmp traffic", "packing t1045", "t1045", "pdb path", "pe resource", "push" ], "references": [ "https://www.healthonecares.com/physicians/profile/xxxxxxxxxx-MD | Attacker is tracking & hacking every service target has used.", "Adversary: https://tulach.cc/ - Maware engineer. It's believed his malware is being used by Brian Sabey of Hall Render", "Adversary: https://github.com/SamuelTulach/VirusTotalUploader", "https://work.a-poster.info", "Emotet: FileHash-MD5 9e78accf19de70b1e614c9bd9d9a7928", "Emotet: FileHash-SHA1 2493981a18613a750ac3165199ec030a7c00663f", "Emotet: FileHash-SHA256 0071c6eea86a219777df283cc476ca450df4b04f4c7ed0eb48fbdf3a9cf7888f", "http://feeds.soundcloud.com/users/soundcloud:users:73198681/sounds.rss", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA1 b0b2c74463496c0020faf4655e83449f7e8019ec", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA1 b0b2c74463496c0020faf4655e83449f7e8019ec", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA256 00000ae84c4f1f2332ef155130b4b8d65f1ed972a9cd851fe9e85f236f8cfa32", "pornhero.net| itsyourporn.com | http://cdn.itsyourporn.com | http://cdn.itsyourporn.com/assets/images/logo.jpg. http://cdn2.video.itsyourporn.com | https://cdn.itsyourporn.com | https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | www.pornhub.com", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "Antivirus Detections Other:Malware-gen\\ [Trj] , ALF:TrojanDownloader:PowerShell/Ploprolo.DB Alerts network_icmp nolookup_communication injection_resumethread suspicious_powershell", "IDS Detections: IDS Detections SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)", "IDS Detections: Possible HTA Application Download Dotted Quad Host HTA Request HTTP request for .exe file with no User-Agent", "Alerts: network_icmp nolookup_communication injection_resumethread suspicious_powershell network_cnc_http", "Antivirus Detections: Win.Malware.Moonlight-9919383-0 , Worm:Win32/Lightmoon.H", "Yara Detections: Nrv2x , upx_3 , UPX_OEP_place , UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser , UPX", "Alerts: antidebug_windows infostealer_cookies persistence_autorun antivm_generic_bios deletes_executed_files", "Alerts: disables_system_restore infostealer_mail persistence_ifeo recon_fingerprint stealth_hidden_extension stealth_hiddenreg" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Cl0p", "display_name": "Cl0p", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "ALF:Trojan:Win32/Cassini_f28c33a2", "display_name": "ALF:Trojan:Win32/Cassini_f28c33a2", "target": null }, { "id": "ALF:HeraklezEval:Worm:Win32/Mimail!rfn", "display_name": "ALF:HeraklezEval:Worm:Win32/Mimail!rfn", "target": null }, { "id": "Tulach Malware", "display_name": "Tulach Malware", "target": null }, { "id": "Trojan:Win32/Emotet.YL", "display_name": "Trojan:Win32/Emotet.YL", "target": "/malware/Trojan:Win32/Emotet.YL" }, { "id": "Win32:RansomX-gen\\ [Ransom]", "display_name": "Win32:RansomX-gen\\ [Ransom]", "target": null }, { "id": "Worm:Win32/Lightmoon.H", "display_name": "Worm:Win32/Lightmoon.H", "target": "/malware/Worm:Win32/Lightmoon.H" }, { "id": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "display_name": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [ "Civilian Society", "Technology", "Healthcare", "Telecommunications", "Media" ], "TLP": "green", "cloned_from": null, "export_count": 50, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 891, "FileHash-MD5": 2368, "FileHash-SHA1": 1873, "FileHash-SHA256": 5092, "domain": 648, "hostname": 557, "CVE": 8, "email": 2 }, "indicator_count": 11439, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "578 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "628b34b054c9703ba5ce480d", "name": "NewDom-0-20220523", "description": "ICANN-Dom", "modified": "2022-07-07T00:01:42.558000", "created": "2022-05-23T07:16:00.680000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZENDataGELowC", "id": "152785", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 201, "modified_text": "1382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 } ], "references": [ "Alerts: antidebug_windows infostealer_cookies persistence_autorun antivm_generic_bios deletes_executed_files", "http://www.pitprojekt.pl", "Alerts: network_icmp nolookup_communication injection_resumethread suspicious_powershell network_cnc_http", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=35146f05-9aac-4942-a42d-f2550a19c0c4", "Emotet: FileHash-MD5 9e78accf19de70b1e614c9bd9d9a7928", "Alerts: disables_system_restore infostealer_mail persistence_ifeo recon_fingerprint stealth_hidden_extension stealth_hiddenreg", "IDS Detections: IDS Detections SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)", "http://pitprojekt.pl", "Adversary: https://github.com/SamuelTulach/VirusTotalUploader", "Yara Detections: Nrv2x , upx_3 , UPX_OEP_place , UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser , UPX", "http://search.safefinder.com/csp.aspx?barcode=defaultsf|portal_sf_admarket_tiles_sf", "https://work.a-poster.info", "http://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778", "https://search.safefinder.com/csp.aspx?barcode=defaultsf|portal_sf_admarket_tiles_sf", "pornhero.net| itsyourporn.com | http://cdn.itsyourporn.com | http://cdn.itsyourporn.com/assets/images/logo.jpg. http://cdn2.video.itsyourporn.com | https://cdn.itsyourporn.com | https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | www.pornhub.com", "https://www.healthonecares.com/physicians/profile/xxxxxxxxxx-MD | Attacker is tracking & hacking every service target has used.", "Emotet: FileHash-SHA256 0071c6eea86a219777df283cc476ca450df4b04f4c7ed0eb48fbdf3a9cf7888f", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA1 b0b2c74463496c0020faf4655e83449f7e8019ec", "IDS Detections: Possible HTA Application Download Dotted Quad Host HTA Request HTTP request for .exe file with no User-Agent", "Antivirus Detections Other:Malware-gen\\ [Trj] , ALF:TrojanDownloader:PowerShell/Ploprolo.DB Alerts network_icmp nolookup_communication injection_resumethread suspicious_powershell", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA256 00000ae84c4f1f2332ef155130b4b8d65f1ed972a9cd851fe9e85f236f8cfa32", "Windows_Trojan_Tofsee.yar", "http://feeds.soundcloud.com/users/soundcloud:users:73198681/sounds.rss", "Adversary: https://tulach.cc/ - Maware engineer. It's believed his malware is being used by Brian Sabey of Hall Render", "Emotet: FileHash-SHA1 2493981a18613a750ac3165199ec030a7c00663f", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4", "https://aplikacja.ceidg.gov.pl/CEIDG/GroupMenu.aspx?key=_group_search", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "Antivirus Detections: Win.Malware.Moonlight-9919383-0 , Worm:Win32/Lightmoon.H", "Suspicious New Service Creation (1).yml" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Serwer a przed\u0142u\u017cenie sesji #{text}", "Serwer", "Domains", "Trojan:win32/emotet.yl", "Inmortal", "Cl0p", "Alf:heraklezeval:worm:win32/mimail!rfn", "Win32:ransomx-gen\\ [ransom]", "Wojcieszyce", "Alf:trojan:win32/cassini_f28c33a2", "Alf:trojandownloader:powershell/ploprolo.db", "Tulach malware", "Worm:win32/lightmoon.h" ], "industries": [ "Technology", "Telecommunications", "Civilian society", "Media", "Healthcare" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "665c44f012d938d1c7dd591e", "name": "PIT Projekt.exe (www.pitprojekt.pl , pitprojekt.pl) oraz Ceidg.gov.pl - Dane publiczne wpisu", "description": "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4 NIP:6161230754\nhttps://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778 NIP;6112323510\nhttp://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778\n2.16.6.145146f05-9aac-4942-a42d-f2550a19c0c4 NIP:6131434311\nipv4: 2.16.6.14, 2.16.6.6, 2.16.6.1,", "modified": "2025-10-06T11:12:39.639000", "created": "2024-06-02T10:09:52.601000", "tags": [ "ceidg.gov.pl - centralna ewidencja i informacja o dzia\u0142alno\u015bci g", "prosz czeka", "pobierz plik", "wojcieszyce", "urls competing", "ceidg centralna", "gospodarczej", "wyszukiwanie", "przejd", "centrum pomocy", "informacja o", "mapa", "strona gwna", "przegldanie", "ceidg szybki", "uwagi prawne", "deklaracja", "serwer", "returnurl", "idf3ee4c4ee00", "id7a025cc6516", "wctxrm0", "idf3ee4c4", "id35146f059aa", "ideb8f4cf26ef", "id7a025cc", "id35146f0", "publicznywsz3", "id97c275c", "url wiek", "ssdeep", "sha1", "pehasz", "typlibid", "pit projekt", "chcesz", "pity online", "program", "interesuje ci", "pity zapisane", "jeli", "oddajemy w", "twoje rce", "dziki jego" ], "references": [ "http://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4", "https://aplikacja.ceidg.gov.pl/CEIDG/GroupMenu.aspx?key=_group_search", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=35146f05-9aac-4942-a42d-f2550a19c0c4", "http://www.pitprojekt.pl", "http://pitprojekt.pl" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Wojcieszyce", "display_name": "Wojcieszyce", "target": null }, { "id": "Serwer", "display_name": "Serwer", "target": null }, { "id": "Serwer A Przed\u0142u\u017cenie sesji #{text}", "display_name": "Serwer A Przed\u0142u\u017cenie sesji #{text}", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8271, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1259, "URL": 6009, "hostname": 3030, "FileHash-SHA256": 10233, "FileHash-MD5": 2742, "FileHash-SHA1": 2348, "email": 75, "SSLCertFingerprint": 11, "YARA": 2, "CVE": 13, "FileHash-PEHASH": 1, "IPv4": 34, "IPv6": 6 }, "indicator_count": 25763, "is_author": false, "is_subscribing": null, "subscriber_count": 134, "modified_text": "195 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67f6c635cb8c3c8b256b6dba", "name": "sdfzsdf.ele fac1ec40eea5a4fc05f17e019328e287", "description": "SHA1- 33008f85428a83996083c3da92a8f00595071403\nSHA256\ncdab1c3196887d4f749d82f014786a966c87f35a7189f0f3d078558b957847bf\nhttps://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=7b6726e20c513baebf7fd387a3dd1b7d67a4c7c4\nhttps://ti.qianxin.com/v2/search?type=file&value=fac1ec40eea5a4fc05f17e019328e287\nhttps://www.virustotal.com/gui/file/cdab1c3196887d4f749d82f014786a966c87f35a7189f0f3d078558b957847bf/relations", "modified": "2025-09-01T08:05:17.675000", "created": "2025-04-09T19:10:45.337000", "tags": [ "sha1", "rozmiar", "typ pliku", "win32", "numer wersji", "wersja", "nieznany", "sha512", "crc32", "ssd gboki", "win64", "security", "license v2", "f6 d9", "windows nt", "detects", "gecko", "khtml", "msie", "wow64", "stealer", "error", "userprofile", "hunt", "keylogger", "encrypt", "antivm", "span", "main", "grabber", "hello", "android", "dcrat", "kill", "revengerat", "sandbox", "pass", "chat", "first", "asyncrat", "crypto", "injector", "dropper", "infostealer", "lockfile", "worldwind", "stealerium", "toxiceye", "avemaria", "fast", "persistence", "trojan", "restart", "snakekeylogger", "snake", "accept", "cookie", "code", "killproc", "lazarus", "dearcry", "njrat", "cyrus", "powershell", "info", "body", "floodfix", "downloader", "ransomware", "core", "loki", "fpspy", "klogexe", "firebird", "patch", "explorer", "avkiller", "masslogger", "baldr", "modi rat", "helpme", "osno", "import", "keylog", "screencapture", "ransom", "crypted", "silent", "xorddos", "stormkitty", "ordinal", "locker", "hyperbro", "lamepyre", "parallaxrat", "null", "shurk steal", "arkeistealer", "strongpity", "desktop", "myagent", "bypass", "fatduke", "miniduke", "polyglotduke", "guildma", "spyeye", "corebot", "killmbr", "ooops", "lcpdot", "torisma", "codec", "prometheus", "spook", "crypt", "logger", "zegost", "poshkeylogger", "systembc", "hdlocker", "cryptolocker", "fivehands", "kitty", "goldmax", "rents", "maurigo", "done", "hidewindow", "bokbot", "bladabindi", "darktrack", "darksky", "alien", "karkoff", "inject", "windigo", "rest", "softcnapp", "elysiumstealer", "leivion", "banload", "ultrareach", "ultrasurf", "buterat", "tools", "beasty", "shut", "gravityrat", "fatalrat", "discord", "deadwood", "turian", "markirat", "mark", "klingonrat", "path", "reverserat", "grab", "meta", "voidcrypt", "darkvnc", "ryzerlo", "hiddentear", "boxcaon", "stream", "crimsonrat", "delfi", "infinity", "stealthworker", "gasket", "spoolss", "lu0bot", "target", "attack", "cobaltstrike", "bits", "chaos", "bitcoin", "wiper", "delphi", "slackbot", "neshta", "belarus", "apanas", "runner", "darkcomet", "macoute", "iframe", "vanillarat", "sectoprat", "melt", "tomiris", "apostle", "blackbyte", "kutaki", "override", "windealer", "mkdir", "brbbot", "config", "babylon rat", "spynet", "bazarloader", "clipper", "banker", "gh0st", "piratestealer", "witch", "killme", "vulturi", "tofsee", "slow", "owowa", "flagpro", "write", "dazzlespy", "decryptor", "bandit stealer", "bandit", "darkeye", "recordbreaker", "truebot", "svchost", "clipbanker", "service", "koivm", "arrowrat", "ducktail", "confuser", "gobrat", "modiloader", "chilelocker", "noclose", "strelastealer", "comfoo", "babar", "blankgrabber", "solarmarker", "darkgate", "stub", "banned", "globeimposter", "rhysida", "janelarat", "kraken", "recon", "quiterat", "venomrat", "venom rat", "sapphirestealer", "ntospy", "raccoon", "shifu", "mediapi", "poolrat", "cicada3301", "remoteexec", "babylockerkz", "new service", "creation id", "nextron" ], "references": [ "Windows_Trojan_Tofsee.yar", "Suspicious New Service Creation (1).yml" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 353, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 28, "FileHash-SHA1": 27, "FileHash-SHA256": 1077, "domain": 282, "hostname": 316, "URL": 1092, "YARA": 535, "email": 4 }, "indicator_count": 3361, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "230 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "684403ce9b1bb2b126d9f06c", "name": "search.safefinder.com", "description": "https://search.safefinder.com/csp.aspx?barcode=defaultsf|portal_sf_admarket_tiles_sf", "modified": "2025-07-07T08:03:42.325000", "created": "2025-06-07T09:18:06.098000", "tags": [ "united", "facebook", "anycast", "idc hosting", "akamaias", "yun road", "google", "intranet", "chinahongkong", "softlayer", "first", "main", "code window", "thisdocument", "insert menu", "visio", "vba project", "class modules", "your project", "visual basic", "editor", "add procedure", "loop", "click", "microsoft azure", "tls issuing", "please", "javascript", "ssdeep", "win32", "susp", "mtb apr", "as13335", "unknown", "showing", "entries", "next associated", "urls show", "date checked", "url hostname", "server response", "mtb nov", "heur", "b apr" ], "references": [ "https://search.safefinder.com/csp.aspx?barcode=defaultsf|portal_sf_admarket_tiles_sf", "http://search.safefinder.com/csp.aspx?barcode=defaultsf|portal_sf_admarket_tiles_sf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1137", "name": "Office Application Startup", "display_name": "T1137 - Office Application Startup" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 757, "FileHash-SHA256": 572, "domain": 363, "URL": 1952, "FileHash-MD5": 81, "FileHash-SHA1": 84, "CVE": 1 }, "indicator_count": 3810, "is_author": false, "is_subscribing": null, "subscriber_count": 122, "modified_text": "286 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "681408f5116c9434db80284c", "name": "http://ginko.garden.pl 89132cf3bcb21bfe97cedca144415c75", "description": "A sample of a malicious file, compiled by the Threat Intelligence AI Assistant, has been released by Google's artificial intelligence platform, which automatically generates content for use in its threat intelligence services and services.", "modified": "2025-06-03T00:00:34.642000", "created": "2025-05-01T23:51:17.686000", "tags": [ "file type", "file size", "sha256", "sha512", "windows", "html document", "ai assistant", "machineguid", "systembiosdate", "use windows", "warszawa", "garden parki", "google font", "error", "dovecot imapd", "dovecot pop3d", "postfix smtpd" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 6, "FileHash-SHA256": 5, "URL": 12, "domain": 19, "hostname": 9, "SSLCertFingerprint": 10 }, "indicator_count": 64, "is_author": false, "is_subscribing": null, "subscriber_count": 122, "modified_text": "320 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66c235b05007103d3e3e7038", "name": "HCA - Win32:RansomX-gen affecting HCA (HealthOneCares) + Miscellaneous Attacks", "description": "HCA (Health One Cares) affected by a RansomX and various serious attacks. It's linked back to a neurosurgeon who is likely not responsible for attack of course. It has been the same,e group of attackers using Samuel Tulach engineered malware. I'm unsure if there is collusion between Brian Sabey (consistent attacker) and Samuel Tulach. I just know it relates back to the same threat actors that have been hacking healthcare facilities, government offices, telecommunications, technology at health centers abusing webcams and patients records modification, and distribution. PHI PII issues.", "modified": "2024-09-17T17:01:24.349000", "created": "2024-08-18T17:56:00.485000", "tags": [ "blacklist http", "safe site", "no data", "tag count", "analyzer threat", "url summary", "ip summary", "summary", "sample", "samples", "detection list", "cisco umbrella", "site", "alexa top", "united", "million", "mail spammer", "malicious site", "phishing site", "team phishing", "tofsee", "malware", "bank", "unsafe", "azorult", "cobalt strike", "service", "runescape", "facebook", "download", "zbot", "installcore", "nymaim", "suppobox", "malicious", "cl0p", "inmortal", "domains", "referrer", "historical ssl", "apple stuff", "combined", "hr rtd", "network", "collection", "vt graph", "round", "metro", "execution", "emotet", "startpage", "maltiverse top", "paypal", "blacklist", "passive dns", "related nids", "urls", "flag united", "accept", "acceptencoding", "hit age", "ip asn", "malware site", "adware", "fakealert", "opencandy", "exploit", "raccoon", "metastealer", "redline stealer", "anonymizer", "heur", "outlook", "phishing airbnb", "engineering", "phishing", "filerepmalware", "maltiverse", "div div", "c span", "div section", "span div", "search", "showing", "unknown", "as397240", "moved", "date", "body", "as54113", "github pages", "a domains", "entries", "mtb jul", "class", "sea x", "scan endpoints", "all scoreblue", "alf features", "related pulses", "file samples", "files matching", "show", "date hash", "next", "worm", "dynamicloader", "yara rule", "high", "windows", "grum", "medium", "installs", "windows startup", "application", "stream", "as22612", "ipv4", "pulse pulses", "files", "switch dns", "query", "data", "noname057", "password", "cybercrime", "malicious url", "kuaizip", "team", "downloader", "generic", "crack", "presenoker", "dapato", "riskware", "genkryptik", "fuery", "agent", "wacatac", "union", "shellexecuteexw", "hash", "writeconsolew", "registry", "t1031", "trojan", "copy", "dock", "write", "win32", "file execution", "explorer", "alerts", "checks", "bios", "system restore", "anne", "training", "strings http", "basic telephone", "xsl stylesheets", "apache fop", "createdate", "modifydate", "producer apache", "format", "core", "nxscspu", "zsextbzusbrvsk", "pxnzj", "jwxkrhdlrivprs", "default", "qxrfnjuodik", "mncau", "csqvrkwsqka", "testpath path", "else", "null", "suspicious", "win64", "hotkey", "ransom", "icmp traffic", "packing t1045", "t1045", "pdb path", "pe resource", "push" ], "references": [ "https://www.healthonecares.com/physicians/profile/xxxxxxxxxx-MD | Attacker is tracking & hacking every service target has used.", "Adversary: https://tulach.cc/ - Maware engineer. It's believed his malware is being used by Brian Sabey of Hall Render", "Adversary: https://github.com/SamuelTulach/VirusTotalUploader", "https://work.a-poster.info", "Emotet: FileHash-MD5 9e78accf19de70b1e614c9bd9d9a7928", "Emotet: FileHash-SHA1 2493981a18613a750ac3165199ec030a7c00663f", "Emotet: FileHash-SHA256 0071c6eea86a219777df283cc476ca450df4b04f4c7ed0eb48fbdf3a9cf7888f", "http://feeds.soundcloud.com/users/soundcloud:users:73198681/sounds.rss", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA1 b0b2c74463496c0020faf4655e83449f7e8019ec", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA1 b0b2c74463496c0020faf4655e83449f7e8019ec", "Win32:RansomX-gen\\ [Ransom]: FileHash-SHA256 00000ae84c4f1f2332ef155130b4b8d65f1ed972a9cd851fe9e85f236f8cfa32", "pornhero.net| itsyourporn.com | http://cdn.itsyourporn.com | http://cdn.itsyourporn.com/assets/images/logo.jpg. http://cdn2.video.itsyourporn.com | https://cdn.itsyourporn.com | https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | www.pornhub.com", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "Antivirus Detections Other:Malware-gen\\ [Trj] , ALF:TrojanDownloader:PowerShell/Ploprolo.DB Alerts network_icmp nolookup_communication injection_resumethread suspicious_powershell", "IDS Detections: IDS Detections SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)", "IDS Detections: Possible HTA Application Download Dotted Quad Host HTA Request HTTP request for .exe file with no User-Agent", "Alerts: network_icmp nolookup_communication injection_resumethread suspicious_powershell network_cnc_http", "Antivirus Detections: Win.Malware.Moonlight-9919383-0 , Worm:Win32/Lightmoon.H", "Yara Detections: Nrv2x , upx_3 , UPX_OEP_place , UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser , UPX", "Alerts: antidebug_windows infostealer_cookies persistence_autorun antivm_generic_bios deletes_executed_files", "Alerts: disables_system_restore infostealer_mail persistence_ifeo recon_fingerprint stealth_hidden_extension stealth_hiddenreg" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Cl0p", "display_name": "Cl0p", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "ALF:Trojan:Win32/Cassini_f28c33a2", "display_name": "ALF:Trojan:Win32/Cassini_f28c33a2", "target": null }, { "id": "ALF:HeraklezEval:Worm:Win32/Mimail!rfn", "display_name": "ALF:HeraklezEval:Worm:Win32/Mimail!rfn", "target": null }, { "id": "Tulach Malware", "display_name": "Tulach Malware", "target": null }, { "id": "Trojan:Win32/Emotet.YL", "display_name": "Trojan:Win32/Emotet.YL", "target": "/malware/Trojan:Win32/Emotet.YL" }, { "id": "Win32:RansomX-gen\\ [Ransom]", "display_name": "Win32:RansomX-gen\\ [Ransom]", "target": null }, { "id": "Worm:Win32/Lightmoon.H", "display_name": "Worm:Win32/Lightmoon.H", "target": "/malware/Worm:Win32/Lightmoon.H" }, { "id": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "display_name": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [ "Civilian Society", "Technology", "Healthcare", "Telecommunications", "Media" ], "TLP": "green", "cloned_from": null, "export_count": 50, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 891, "FileHash-MD5": 2368, "FileHash-SHA1": 1873, "FileHash-SHA256": 5092, "domain": 648, "hostname": 557, "CVE": 8, "email": 2 }, "indicator_count": 11439, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "578 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "628b34b054c9703ba5ce480d", "name": "NewDom-0-20220523", "description": "ICANN-Dom", "modified": "2022-07-07T00:01:42.558000", "created": "2022-05-23T07:16:00.680000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZENDataGELowC", "id": "152785", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 201, "modified_text": "1382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "algmath.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "algmath.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1776611302.879255 }