{ "type": "Domain", "indicator": "aquaexplo.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/aquaexplo.com", "alexa": "http://www.alexa.com/siteinfo/aquaexplo.com", "indicator": "aquaexplo.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3968436991, "indicator": "aquaexplo.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 12, "pulses": [ { "id": "68e2bb5d9ee8577ab5519f2c", "name": "Meritshealth with DoD links? ", "description": "", "modified": "2026-01-13T00:05:56.401000", "created": "2025-10-05T18:39:25.286000", "tags": [ "gtmk5nxqc6", "utc amazon", "utc na", "acceptencoding", "gmt contenttype", "connection", "true pragma", "gmt setcookie", "httponly", "gmt vary", "nc000000 up", "html document", "unicode text", "utf8 text", "oc0006 http", "http traffic", "https http", "mitre att", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "number", "ja3s", "algorithm", "azure rsa", "tls issuing", "cus subject", "stwa lredmond", "cnmicrosoft ecc", "update secure", "server ca", "omicrosoft cus", "get http", "dns resolutions", "registrar", "markmonitor inc", "country", "resolver domain", "type name", "html", "apnic", "apnic whois", "please", "rirs", "cidr", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "development att", "name tactics", "binary file", "ck matrix", "wheelchair", "iamrobert", "pattern match", "ascii text", "href", "united", "general", "local", "path", "encrypt", "click", "passive dns", "urls", "files", "reverse dns", "netherlands", "present aug", "a domains", "moved", "first pqc", "ip address", "unknown ns", "unknown aaaa", "title", "body", "meta", "window", "accept", "body doctype", "welcome", "ok server", "gmt content", "present jul", "present sep", "aaaa", "hostname", "error", "defense evasion", "windows nt", "response", "vary", "strings", "core", "t1027.013 encrypted/encoded", "michelin lazy k", "prefetch8", "flag", "date", "starfield", "hybrid", "mobility cr", "extraction", "data upload", "include", "o url", "url url", "included i0", "review ioc", "excluded ic", "suggested", "find sugi", "failed", "cre pul", "enter", "enter sc", "type", "enric", "extra", "type opaste", "data u", "included", "copy md5", "copy sha1", "copy sha256", "null", "refresh", "tools", "look", "verify", "restart", "t1480 execution", "expiration", "url https", "no expiration", "iocs", "ipv4", "text drag", "drop or", "browse to", "select file", "redacted for", "server", "privacy tech", "privacy admin", "postal code", "stateprovince", "organization", "email", "code", "quantum rooms", "sam somalia", "emp", "porn", "media defense", "gov porn", "suck my nips", "reimer suspect", "jeffrey reimer", "dod", "department of defense", "show", "date checked", "url hostname", "server response", "google safe", "results may", "entries http", "scans record", "value status", "sabey type", "merits fake", "y.a.s.", "pornography", "ramsom" ], "references": [ "https://www.meritshealth.com/ Defense.Gov Mobility Co? ", "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67", "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf", "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf", "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html", "https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com", "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/", "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp", "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg", "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)", "https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members", "https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210", "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex", "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf", "https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo", "https://meumundogay-com.sexogratis.page/locker", "https://es.pornhat.com/models/the-sex-creator/", "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA", "Can the DoD no questions asked target a SA victim", "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.", "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise", "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov", "There is fear in silence or speaking out", "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.", "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?", "If someone is believed to be a threat they have right to due process.", "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.", "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.", "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.", "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.", "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot", "iamrobert.com Y.A.S.", "1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam", "Target agreed and complied with all lie detector measures.", "Is the family allowed to have a funeral for Tsara or print an obituary", "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.", "I am very upset. Whoever is doing this is sick." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "TA0042", "name": "Resource Development", "display_name": "TA0042 - Resource Development" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1591", "name": "Gather Victim Org Information", "display_name": "T1591 - Gather Victim Org Information" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "display_name": "T1562.004 - Disable or Modify System Firewall" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1562.008", "name": "Disable Cloud Logs", "display_name": "T1562.008 - Disable Cloud Logs" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1056.003", "name": "Web Portal Capture", "display_name": "T1056.003 - Web Portal Capture" }, { "id": "T1512", "name": "Capture Camera", "display_name": "T1512 - Capture Camera" }, { "id": "T1180", "name": "Screensaver", "display_name": "T1180 - Screensaver" } ], "industries": [], "TLP": "white", "cloned_from": "68e2b14d83bb63502feac65e", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1365, "URL": 11172, "hostname": 2780, "FileHash-MD5": 381, "FileHash-SHA256": 4420, "FileHash-SHA1": 338, "CIDR": 4, "SSLCertFingerprint": 24, "CVE": 1, "email": 1 }, "indicator_count": 20486, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "138 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68e2b14d83bb63502feac65e", "name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.", "description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech needed. Later denies ever being a mobility technician. They killed a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?", "modified": "2026-01-07T00:00:30.717000", "created": "2025-10-05T17:56:29.109000", "tags": [ "gtmk5nxqc6", "utc amazon", "utc na", "acceptencoding", "gmt contenttype", "connection", "true pragma", "gmt setcookie", "httponly", "gmt vary", "nc000000 up", "html document", "unicode text", "utf8 text", "oc0006 http", "http traffic", "https http", "mitre att", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "number", "ja3s", "algorithm", "azure rsa", "tls issuing", "cus subject", "stwa lredmond", "cnmicrosoft ecc", "update secure", "server ca", "omicrosoft cus", "get http", "dns resolutions", "registrar", "markmonitor inc", "country", "resolver domain", "type name", "html", "apnic", "apnic whois", "please", "rirs", "cidr", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "development att", "name tactics", "binary file", "ck matrix", "wheelchair", "iamrobert", "pattern match", "ascii text", "href", "united", "general", "local", "path", "encrypt", "click", "passive dns", "urls", "files", "reverse dns", "netherlands", "present aug", "a domains", "moved", "first pqc", "ip address", "unknown ns", "unknown aaaa", "title", "body", "meta", "window", "accept", "body doctype", "welcome", "ok server", "gmt content", "present jul", "present sep", "aaaa", "hostname", "error", "defense evasion", "windows nt", "response", "vary", "strings", "core", "t1027.013 encrypted/encoded", "michelin lazy k", "prefetch8", "flag", "date", "starfield", "hybrid", "mobility cr", "extraction", "data upload", "include", "o url", "url url", "included i0", "review ioc", "excluded ic", "suggested", "find sugi", "failed", "cre pul", "enter", "enter sc", "type", "enric", "extra", "type opaste", "data u", "included", "copy md5", "copy sha1", "copy sha256", "null", "refresh", "tools", "look", "verify", "restart", "t1480 execution", "expiration", "url https", "no expiration", "iocs", "ipv4", "text drag", "drop or", "browse to", "select file", "redacted for", "server", "privacy tech", "privacy admin", "postal code", "stateprovince", "organization", "email", "code", "quantum rooms", "sam somalia", "emp", "porn", "media defense", "gov porn", "suck my nips", "reimer suspect", "jeffrey reimer", "dod", "department of defense", "show", "date checked", "url hostname", "server response", "google safe", "results may", "entries http", "scans record", "value status", "sabey type", "merits fake", "y.a.s.", "pornography", "ramsom" ], "references": [ "https://www.meritshealth.com/ Defense.Gov Mobility Co? ", "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67", "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf", "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf", "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html", "https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com", "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/", "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp", "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg", "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)", "https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members", "https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210", "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex", "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf", "https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo", "https://meumundogay-com.sexogratis.page/locker", "https://es.pornhat.com/models/the-sex-creator/", "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA", "Can the DoD no questions asked target a SA victim", "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.", "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise", "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov", "There is fear in silence or speaking out", "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.", "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?", "If someone is believed to be a threat they have right to due process.", "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.", "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.", "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.", "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.", "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot", "iamrobert.com Y.A.S.", "1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam", "Target agreed and complied with all lie detector measures.", "Is the family allowed to have a funeral for Tsara or print an obituary", "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.", "I am very upset. Whoever is doing this is sick." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "TA0042", "name": "Resource Development", "display_name": "TA0042 - Resource Development" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1591", "name": "Gather Victim Org Information", "display_name": "T1591 - Gather Victim Org Information" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "display_name": "T1562.004 - Disable or Modify System Firewall" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1562.008", "name": "Disable Cloud Logs", "display_name": "T1562.008 - Disable Cloud Logs" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1056.003", "name": "Web Portal Capture", "display_name": "T1056.003 - Web Portal Capture" }, { "id": "T1512", "name": "Capture Camera", "display_name": "T1512 - Capture Camera" }, { "id": "T1180", "name": "Screensaver", "display_name": "T1180 - Screensaver" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1328, "URL": 9931, "hostname": 2621, "FileHash-MD5": 381, "FileHash-SHA256": 4360, "FileHash-SHA1": 338, "CIDR": 4, "SSLCertFingerprint": 24, "CVE": 1, "email": 1 }, "indicator_count": 18989, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "144 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68d877d6231fc1cbe1792ee1", "name": "PolyRansom attack through malicious actor on threat platforms", "description": "Virlock , PolyRansom and multiple other attacks through malicious actor using social engineering tactics. Has a rigged platform. Goal -\n to gain complete command and control of users in great platforms. Has infected at least a single device.\n#domainrobot #socialengineeeing #Tofsee\n#Trojan:Win32/Vflooder\n#Unix.Dropper.Mirai-7135870-0\n#Virus.Virlock/Nabucur\n#Win.Packer.pkr_ce1a-9980177-0\n#Win.Virus.PolyRansom", "modified": "2025-10-27T22:02:25.163000", "created": "2025-09-27T23:48:38.895000", "tags": [ "iocs", "indicator role", "write c", "intel", "ms windows", "medium", "pe32", "delete", "ids detections", "yara detections", "write", "malware", "delete c", "windows", "high", "port", "encrypt", "tofsee", "stream", "passive dns", "http", "ip address", "related nids", "files location", "united states", "united", "win32", "trojan", "mtb may", "twitter", "hellspawn", "worm", "title", "emails", "servers", "get http", "dns resolutions", "http traffic", "command", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "request", "windows nt", "win64", "khtml", "gecko", "response", "present sep", "aaaa", "resolved ips", "ip traffic", "displayname", "yara rule", "loaderid", "name servers", "urls", "domain robot", "mail", "moved", "media gmbh", "info file", "network dropped", "duration cuckoo", "version file", "machine label", "manager", "shutdown", "host", "generic http", "exe upload", "inbound", "outbound", "markus", "certificate", "record value", "object", "path", "server", "registrar abuse", "contact email", "contact phone", "registrar iana", "registrar url", "diablo", "gandi sas", "gandi", "diablo attacks", "bluemind", "alberta", "domain add", "asn as16625", "akamai", "less whois", "registrar", "metrobytmobile", "t mobile", "metro", "present jul", "present jun", "present aug", "germany unknown", "germany", "invalid url", "ipv4 add", "frankfurt", "main", "no entries", "entrust", "hostname add", "files loading", "mimic", "first address", "medium attempts", "process", "explorer", "windows startup", "kuwiqsma", "match medium", "medium installs", "installs", "t regdword", "user", "ntcreatefile", "filehandle", "createfilew", "getfilesize", "blpdqe", "jjqcpluanwwhg", "u0012", "desiredaccess", "keyhandle", "ntopenkeyex", "u001aw", "u0018", "read", "next", "tags none", "file type", "date september", "am size", "imphash pehash", "richhash", "south korea", "taiwan as3462", "as21928", "china as4134", "as4766 korea", "china as4837", "as9318 sk", "as701 verizon", "verizon", "tcp syn", "infectednight", "resolverror", "tref neutral", "ck technique", "technique id", "tofsee high", "overview whois", "pulses", "tags", "related tags", "more external", "resources whois", "urlvoid", "tavao.exe", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "defense evasion", "spawns", "access att", "ascii text", "pattern match", "mitre att", "size", "meta", "null", "error", "click", "roboto", "hybrid", "general", "local", "starfield", "strings", "refresh", "tools", "onload", "span", "iframe", "found", "t1480 execution", "backdoor", "a domains", "russia", "next associated", "link", "windir", "interesting", "show technique", "ck matrix", "network traffic", "t1071", "t1057", "lowfi", "gameforprofits", "game att", "night got", "job done infected" ], "references": [ "DiabloFans ClapBack: Google. Com", "Crowdsourced IDS: ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check Rule Match", "CS\u2019d IDS: ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com) Rule Match", "Crowdsourced IDS: Matches rule SURICATA HTTP missing Host header", "Crowdsourced IDS: Unique rule identifier: This rule belongs to a private collection", "MetrobyT-mobile", "UA Alberta | Somehow I don\u2019t think this is part of a match but rather an attack. Mimic", "Unix.Dropper.Mirai inc. 100.181.126.203 \u2022 United States\tAS21928 t-mobile usa inc.", "Unix.Dropper.Mirai inc. 1 Korea Telecom 1.107.218.24 \u2022 South Korea\tAS4766", "Unix.Dropper.Mirai inc. 1 Telstra Corporation Ltd 1.125.165.62 \u2022 Australia AS1221 Telstra", "Unix.Dropper.Mirai inc. 1 Verizon : 100.10.95.119 United States \u2022 AS701 Verizon", "Sigma: Matches rule System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win.Packer.pkr_ce1a-9980177-0", "display_name": "Win.Packer.pkr_ce1a-9980177-0", "target": null }, { "id": "Trojan:Win32/Vflooder", "display_name": "Trojan:Win32/Vflooder", "target": "/malware/Trojan:Win32/Vflooder" }, { "id": "Virus.Virlock/Nabucur", "display_name": "Virus.Virlock/Nabucur", "target": null }, { "id": "Win.Virus.PolyRansom-5704625-0", "display_name": "Win.Virus.PolyRansom-5704625-0", "target": null }, { "id": "Unix.Dropper.Mirai-7135870-0", "display_name": "Unix.Dropper.Mirai-7135870-0", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 450, "FileHash-SHA1": 435, "FileHash-SHA256": 2092, "URL": 646, "domain": 593, "SSLCertFingerprint": 9, "hostname": 657, "email": 13 }, "indicator_count": 4895, "is_author": false, "is_subscribing": null, "subscriber_count": 146, "modified_text": "216 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68d877e28416d81633bae1ad", "name": "PolyRansom attack through malicious actor on threat platforms", "description": "Virlock , PolyRansom and multiple other attacks through malicious actor using social engineering tactics. Has a rigged platform. Goal -\n to gain complete command and control of users in great platforms. Has infected at least a single device.\n#domainrobot #socialengineeeing #Tofsee\n#Trojan:Win32/Vflooder\n#Unix.Dropper.Mirai-7135870-0\n#Virus.Virlock/Nabucur\n#Win.Packer.pkr_ce1a-9980177-0\n#Win.Virus.PolyRansom", "modified": "2025-10-27T22:02:25.163000", "created": "2025-09-27T23:48:50.976000", "tags": [ "iocs", "indicator role", "write c", "intel", "ms windows", "medium", "pe32", "delete", "ids detections", "yara detections", "write", "malware", "delete c", "windows", "high", "port", "encrypt", "tofsee", "stream", "passive dns", "http", "ip address", "related nids", "files location", "united states", "united", "win32", "trojan", "mtb may", "twitter", "hellspawn", "worm", "title", "emails", "servers", "get http", "dns resolutions", "http traffic", "command", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "request", "windows nt", "win64", "khtml", "gecko", "response", "present sep", "aaaa", "resolved ips", "ip traffic", "displayname", "yara rule", "loaderid", "name servers", "urls", "domain robot", "mail", "moved", "media gmbh", "info file", "network dropped", "duration cuckoo", "version file", "machine label", "manager", "shutdown", "host", "generic http", "exe upload", "inbound", "outbound", "markus", "certificate", "record value", "object", "path", "server", "registrar abuse", "contact email", "contact phone", "registrar iana", "registrar url", "diablo", "gandi sas", "gandi", "diablo attacks", "bluemind", "alberta", "domain add", "asn as16625", "akamai", "less whois", "registrar", "metrobytmobile", "t mobile", "metro", "present jul", "present jun", "present aug", "germany unknown", "germany", "invalid url", "ipv4 add", "frankfurt", "main", "no entries", "entrust", "hostname add", "files loading", "mimic", "first address", "medium attempts", "process", "explorer", "windows startup", "kuwiqsma", "match medium", "medium installs", "installs", "t regdword", "user", "ntcreatefile", "filehandle", "createfilew", "getfilesize", "blpdqe", "jjqcpluanwwhg", "u0012", "desiredaccess", "keyhandle", "ntopenkeyex", "u001aw", "u0018", "read", "next", "tags none", "file type", "date september", "am size", "imphash pehash", "richhash", "south korea", "taiwan as3462", "as21928", "china as4134", "as4766 korea", "china as4837", "as9318 sk", "as701 verizon", "verizon", "tcp syn", "infectednight", "resolverror", "tref neutral", "ck technique", "technique id", "tofsee high", "overview whois", "pulses", "tags", "related tags", "more external", "resources whois", "urlvoid", "tavao.exe", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "defense evasion", "spawns", "access att", "ascii text", "pattern match", "mitre att", "size", "meta", "null", "error", "click", "roboto", "hybrid", "general", "local", "starfield", "strings", "refresh", "tools", "onload", "span", "iframe", "found", "t1480 execution", "backdoor", "a domains", "russia", "next associated", "link", "windir", "interesting", "show technique", "ck matrix", "network traffic", "t1071", "t1057", "lowfi", "gameforprofits", "game att", "night got", "job done infected" ], "references": [ "DiabloFans ClapBack: Google. Com", "Crowdsourced IDS: ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check Rule Match", "CS\u2019d IDS: ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com) Rule Match", "Crowdsourced IDS: Matches rule SURICATA HTTP missing Host header", "Crowdsourced IDS: Unique rule identifier: This rule belongs to a private collection", "MetrobyT-mobile", "UA Alberta | Somehow I don\u2019t think this is part of a match but rather an attack. Mimic", "Unix.Dropper.Mirai inc. 100.181.126.203 \u2022 United States\tAS21928 t-mobile usa inc.", "Unix.Dropper.Mirai inc. 1 Korea Telecom 1.107.218.24 \u2022 South Korea\tAS4766", "Unix.Dropper.Mirai inc. 1 Telstra Corporation Ltd 1.125.165.62 \u2022 Australia AS1221 Telstra", "Unix.Dropper.Mirai inc. 1 Verizon : 100.10.95.119 United States \u2022 AS701 Verizon", "Sigma: Matches rule System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win.Packer.pkr_ce1a-9980177-0", "display_name": "Win.Packer.pkr_ce1a-9980177-0", "target": null }, { "id": "Trojan:Win32/Vflooder", "display_name": "Trojan:Win32/Vflooder", "target": "/malware/Trojan:Win32/Vflooder" }, { "id": "Virus.Virlock/Nabucur", "display_name": "Virus.Virlock/Nabucur", "target": null }, { "id": "Win.Virus.PolyRansom-5704625-0", "display_name": "Win.Virus.PolyRansom-5704625-0", "target": null }, { "id": "Unix.Dropper.Mirai-7135870-0", "display_name": "Unix.Dropper.Mirai-7135870-0", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 450, "FileHash-SHA1": 435, "FileHash-SHA256": 2092, "URL": 646, "domain": 593, "SSLCertFingerprint": 9, "hostname": 657, "email": 13 }, "indicator_count": 4895, "is_author": false, "is_subscribing": null, "subscriber_count": 146, "modified_text": "216 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68c1a8b3b2144ae9455191c4", "name": "VT Graph (miniuser) - 09.10.25", "description": "all-seeing-eye-sauron-powershell-tool-data-collection-threat-hunting_578. pdf - 09.10.25", "modified": "2025-10-10T16:03:06.210000", "created": "2025-09-10T16:34:59.269000", "tags": [], "references": [ "https://www.virustotal.com/graph/embed/g25090dbc8e9e49cc805b123e936987a5022d66ee7e2b457193bf6cf242952800?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 40, "FileHash-SHA1": 40, "FileHash-SHA256": 1281, "URL": 618, "domain": 461, "hostname": 455 }, "indicator_count": 2895, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "233 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "687605f986433ebf2673f0b8", "name": "Win.Malware.Downloadguide-6803841-0 | Patient Monitoring", "description": "Part of an elaborate, unrelenting espionage campaign , multiple compromises, targeting.\n> alf:PUA:Win32/DownloadGuide \nLink below found in previous Pulse -[http://s0.patient.media/res/f91b97f6b547405cb4370cbb003dfea2-jquery-1.11.1.min.js.gzip]\n\u2022 Win.Malware.Downloadguide-6803841-0\nYara:\nresearch_pe_signed_outside_timestamp\n\u2022\nkernel32_dll_xor_exe_key_51_key_byte_encoded \u2022\nxor_0x33_kernel32_dll \u2022 \nConcerning: {Domain\tAddress\tRegistrar\tCountry\ns0.patient.media\n-\tGoDaddy.com, LLC\nOrganization: Egton Medical Information Systems Limited\nName Server: ns34.domaincontrol.com\nCreation Date: 2015-01-12T16:20:56}\n\n{https://www.anyxxxtube.net/search-porn/tsara-brashears/}\n{https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net}\n{wallpapers-nature.com}\n{https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian}", "modified": "2025-08-14T07:05:00.239000", "created": "2025-07-15T07:40:41.180000", "tags": [ "url http", "url https", "indicator role", "title added", "active related", "pulses hostname", "entries", "gmt etag", "server", "ecacc", "serving ip", "address", "dom dom", "data upload", "extraction", "pdf report", "enter", "failed", "extraction data", "enter sc", "type", "extra data", "extri please", "review data", "excluded tous", "tui sugges", "find", "show", "at filer", "iocs", "levelbluelabs", "please", "included iocs", "excluded io", "find suggested", "types", "domain data", "search", "o please", "manually add", "c data", "o suggesteo", "include data", "review uus", "u exclude", "find s", "indicaok data", "dom doman", "filehash", "md5 add", "pulse pulses", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "file score", "copy", "push", "copy md5", "copy sha1", "copy sha256", "sha1", "sha256", "pattern match", "ascii text", "size", "mitre att", "utf8", "null", "refresh", "body", "span", "hybrid", "general", "local", "path", "click", "date", "strings", "error", "tools", "look", "verify", "restart", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "spawns", "evasion att", "t1480 execution", "discovery att" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3597, "FileHash-MD5": 343, "domain": 547, "hostname": 1222, "FileHash-SHA1": 343, "FileHash-SHA256": 4464, "CVE": 1, "email": 1 }, "indicator_count": 10518, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "290 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6875e98438889e51b3fdd18f", "name": "Critical \u2022 Schedule system process - Mirai | Foundry Overwatch", "description": "", "modified": "2025-08-14T05:04:16.839000", "created": "2025-07-15T05:39:16.652000", "tags": [ "win32 exe", "country", "include review", "exclude", "defense evasion", "access ta0006", "command", "control ta0011", "impact ta0040", "impact ob0008", "file system", "system oc0008", "match unknown", "adversaries", "match info", "info", "execution flow", "t1574 dll", "tries", "registry", "modify system", "process t1543", "unknown", "window", "ob0009 install", "ob0012 install", "insecure", "b0047 modify", "registry e1112", "hidden files", "registry run", "keys", "startup folder", "f0012 file", "critical", "united", "as15169", "delete c", "as16509", "show", "search", "intel", "ms windows", "entries", "medium", "worm", "copy", "write", "explorer", "malware", "next", "present jul", "status", "date", "ip address", "domain", "servers", "showing", "unknown ns", "related pulses", "pulses", "tags", "related tags", "more file", "type", "date april", "am size", "sha1 sha256", "as14618", "united kingdom", "as54113", "as15133 verizon", "top source", "top destination", "status domain", "ip whitelisted", "whitelisted", "tcp include", "source source", "oamazon", "cnamazon rsa", "odigicert inc", "sweden as20940", "as20940", "entries tls", "ip destination", "encrypt", "aaaa", "found", "certificate", "next associated", "urls show", "date checked", "error", "windows", "high", "yara detections", "installs", "checks", "filehash", "sha256 add", "themida", "data upload", "extraction", "md5 add", "av detections", "ids detections", "alerts", "analysis date", "file score", "win32", "ddos", "passive dns", "activity", "checkin", "win64", "mtb jan", "lowfi", "trojan", "ransom", "trojandropper", "yara", "nsis", "nss bv", "su data", "windo alerts", "andariel", "malware traffic", "nids", "icmp traffic", "dns query", "id deadhost", "connects", "andariel high", "richhash", "external", "virustotal api", "screenshots", "failed", "auurtonany data", "themida andarie", "present may", "japan unknown", "unknown cname", "domain add", "urls", "files", "http headers", "msie", "windows nt", "tcp syn", "resolverror", "externalport", "internalport", "wget command", "devices home", "execution", "foundry", "home networks", "mirai", "x.com", "porn", "monitored target", "d link", "targets" ], "references": [ "TJprojMain.exe {79c7303a1a49b85569245a8ca1c1a26be720387845af9391fa1e4677308bd6b6}", "Crowdsourced Signa: Schedule system process by Joe Security", "Sigma \u2022 Suspicious Process Masquerading As SvcHost.EXE by Swachchhanda Shrawan Poudel", "Sigma \u2022 System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)", "Yara \u2022 NSIS from ruleset NSIS by kevoreilly", "Yara \u2022 rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)", "Yara \u2022 Windows_Generic_Threat_7526f106 from ruleset Windows_Generic_Threat by Elastic Security", "Alerts: persistence_autorun \u2022 persistence_autorun_tasks stealth_hiddenreg \u2022 suspicious_command", "IDS : Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI", "Mirai - ]1.0.0.0 - Unix.Trojan.Mirai-6981169-0", "*Themida_2xx. Oreans,Technologies", "*Andariel Backdoor Activity (Checkin)", "Alert: dead_host nids_malware_alert network_icmp nolookup_communication", "IDS: WGET Command Specifying Output in HTTP Headers", "IDS: D-Link Devices Home Network Administration Protocol Command Execution", "foundry2-lbl.dvr.dn2.n-helix.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://foundry2sdbl", "https://xn--72c9abh1f8ad1lzc.com/video_tag/pornthai/ \u2022 https://ro.theskinnyfoodco.com/en-fr/blogs/recipes/pornstar-martini-recipe \u2022 m.pornsexer.xxx.3.1.adiosfil.roksit.net", "x.com \u2022 nr-data.net \u2022 apple.k8s.joewa.com", "http://apple.cc.lvlid.com/ \u2022 http://apple.cc.lvlid.com/ios/ \u2022 http://www.apple.cc.lvlid.com/ios", "Devices remotely connected, tracked , monitored" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Worm:Win32/Mofksys.RND!MTB", "display_name": "Worm:Win32/Mofksys.RND!MTB", "target": "/malware/Worm:Win32/Mofksys.RND!MTB" }, { "id": "Unix.Trojan.Mirai-6981169-0", "display_name": "Unix.Trojan.Mirai-6981169-0", "target": null }, { "id": "Win.Malware.Ursu-9856871-0", "display_name": "Win.Malware.Ursu-9856871-0", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null } ], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1512", "name": "Capture Camera", "display_name": "T1512 - Capture Camera" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [ "Healthcare", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 448, "FileHash-SHA1": 435, "FileHash-SHA256": 5851, "hostname": 2580, "domain": 1176, "URL": 7133, "SSLCertFingerprint": 30, "email": 3, "CVE": 3 }, "indicator_count": 17659, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "290 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "670ff437ec341e3af30865f6", "name": "VirusTotal Graph - medicine[.]stmatthews[.]edu - 10.16.24", "description": "A quick look at another connected Medical School\nmedicine[.]stmatthews[.]edu - 10.16.24\n\nNeed to add Malcore ECFMG IOCs: https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665292fee4c5ec0b4d5 (02.22.25) - for those of you wondering why this is related to a lot of hospitals and such.", "modified": "2025-02-11T12:21:41.307000", "created": "2024-10-16T17:13:27.447000", "tags": [ "entity", "Medicine" ], "references": [ "https://www.virustotal.com/graph/embed/ge74cb43ed64b456f85c6328dd750f6005716708de6f04068bcbbf3c498541992?theme=dark", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665292fee4c5ec0b4d5" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Healthcare", "Technology", "Education" ], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 3, "FileHash-SHA256": 76, "domain": 106, "hostname": 202, "URL": 179 }, "indicator_count": 569, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "474 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66d0a996b288ca46ab7e63ae", "name": "CEIDG (www.pitprojekt.pl , pitprojekt.pl) jak otworzy\u0107 firm\u0119, jak rozpocz\u0105\u0107 biznes, dzia\u0142alno\u015b\u0107 gospodarcza zak\u0142adanie, jak rozpocz\u0105\u0107 dzia\u0142alno\u015b\u0107 gospodarcz\u0105", "description": "Zawarte zasoby wed\u0142ug j\u0119zyka \u00c2\u00a31.1bn, a total of 7.4bn euros ($9.6bn; \u00a36.3bn)", "modified": "2024-12-05T21:16:06.820000", "created": "2024-08-29T17:02:13.392000", "tags": [ "admin", "asset", "dufur", "jnswj", "3px center", "saxla", "zjloj", "whasz htm", "oszczdno", "png ikona", "rt angielski", "angielski usa", "wersja rt", "narzuta chi2", "plik", "whasz", "bogaty hash", "sha256", "ssdeep", "schema", "strings", "guid", "blob", "sha256 file", "type type", "vhash", "imphash", "bvgquf", "cblrxf", "coqbmf", "efq78c", "gkrikb", "hdvrde", "hlo3ef", "izt63", "jnoxi", "kg2exe", "pejzasz", "rticon english", "english us", "chi2", "png rticon", "ico rtgroupicon", "code signing", "algorithm", "serial number", "sectigo public", "thumbprint", "rsa time", "valid from", "name sectigo", "valid", "valid usage", "ascii text", "neutral", "data rtcursor", "data rtdialog", "default", "rticon maori", "ceidg", "informacja o", "usugi", "z wniosek", "sprawd", "zarejestruj spk", "centralna", "ewidencja", "strona gwna", "formularze i", "sha1", "pehash", "richhash", "authentihash", "skrt", "system", "podaj", "windows z", "kreator", "dostawca", "wifi", "nazwa typ", "md5 nazwa", "imphasz", "kropelka", "smyczki", "zasb manifestu", "neutralny", "ikona rt", "zawarte zasoby", "md5 chi2", "ikonagrupyrt", "rtmanifest", "zawarte", "sha256 typ" ], "references": [ "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 4501, "URL": 4559, "hostname": 1957, "domain": 729, "FileHash-MD5": 903, "FileHash-SHA1": 849, "IPv4": 180, "email": 3, "IPv6": 2, "CVE": 1 }, "indicator_count": 13684, "is_author": false, "is_subscribing": null, "subscriber_count": 125, "modified_text": "542 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67127cfd194972b2b7a01965", "name": "Discord", "description": "Discord W11 Sample Device\nC:\\ProgramData*\\Discord", "modified": "2024-11-17T15:01:49.122000", "created": "2024-10-18T15:21:33.350000", "tags": [ "Discord" ], "references": [ "https://www.virustotal.com/gui/collection/ab283165c61c702e1aed28375718dd2674179c61c517d93baabc2219becf081a/community", "https://www.virustotal.com/gui/collection/ab283165c61c702e1aed28375718dd2674179c61c517d93baabc2219becf081a/iocs", "https://www.virustotal.com/gui/collection/ab283165c61c702e1aed28375718dd2674179c61c517d93baabc2219becf081a/summary", "https://www.virustotal.com/gui/collection/ab283165c61c702e1aed28375718dd2674179c61c517d93baabc2219becf081a/graph" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 80, "FileHash-SHA1": 80, "FileHash-SHA256": 357, "URL": 472, "domain": 413, "hostname": 153 }, "indicator_count": 1555, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "560 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6701b43f94e3d2861dcab94d", "name": "Root literally running this process right now! com.apple.cfprefsd", "description": "The full text of the text above the words \"probable\" and \"enormous\" \u00c2\u00a31.2bn, as compiled by the BBC's Panorama programme, has been published.", "modified": "2024-11-04T21:05:42.693000", "created": "2024-10-05T21:48:47.072000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "MarceeS26", "id": "133143", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 63, "FileHash-SHA1": 63, "FileHash-SHA256": 1653, "domain": 230, "hostname": 76, "URL": 283 }, "indicator_count": 2368, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "573 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "670c5ff728e6e5b891e26e45", "name": "IOC", "description": "", "modified": "2024-10-14T00:04:07.913000", "created": "2024-10-14T00:04:07.913000", "tags": [ "admin", "asset", "dufur", "jnswj", "3px center", "saxla", "zjloj", "whasz htm", "oszczdno", "png ikona", "rt angielski", "angielski usa", "wersja rt", "narzuta chi2", "plik", "whasz", "bogaty hash", "sha256", "ssdeep", "schema", "strings", "guid", "blob", "sha256 file", "type type", "vhash", "imphash", "bvgquf", "cblrxf", "coqbmf", "efq78c", "gkrikb", "hdvrde", "hlo3ef", "izt63", "jnoxi", "kg2exe", "pejzasz", "rticon english", "english us", "chi2", "png rticon", "ico rtgroupicon", "code signing", "algorithm", "serial number", "sectigo public", "thumbprint", "rsa time", "valid from", "name sectigo", "valid", "valid usage", "ascii text", "neutral", "data rtcursor", "data rtdialog", "default", "rticon maori", "ceidg", "informacja o", "usugi", "z wniosek", "sprawd", "zarejestruj spk", "centralna", "ewidencja", "strona gwna", "formularze i", "sha1", "pehash", "richhash", "authentihash", "skrt", "system", "podaj", "windows z", "kreator", "dostawca", "wifi", "nazwa typ", "md5 nazwa", "imphasz", "kropelka", "smyczki", "zasb manifestu", "neutralny", "ikona rt", "zawarte zasoby", "md5 chi2", "ikonagrupyrt", "rtmanifest", "zawarte", "sha256 typ" ], "references": [ "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": "66d0a996b288ca46ab7e63ae", "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "WayneState", "id": "296756", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 4243, "URL": 4550, "hostname": 1957, "domain": 729, "FileHash-MD5": 801, "FileHash-SHA1": 747, "IPv4": 180, "email": 3, "IPv6": 2 }, "indicator_count": 13212, "is_author": false, "is_subscribing": null, "subscriber_count": 4, "modified_text": "594 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.", "http://apple.cc.lvlid.com/ \u2022 http://apple.cc.lvlid.com/ios/ \u2022 http://www.apple.cc.lvlid.com/ios", "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot", "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.", "https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com", "iamrobert.com Y.A.S.", "https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo", "Unix.Dropper.Mirai inc. 1 Telstra Corporation Ltd 1.125.165.62 \u2022 Australia AS1221 Telstra", "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex", "Yara \u2022 rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)", "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html", "CS\u2019d IDS: ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com) Rule Match", "Unix.Dropper.Mirai inc. 1 Korea Telecom 1.107.218.24 \u2022 South Korea\tAS4766", "https://www.virustotal.com/gui/collection/ab283165c61c702e1aed28375718dd2674179c61c517d93baabc2219becf081a/graph", "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665292fee4c5ec0b4d5", "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf", "https://www.virustotal.com/gui/collection/ab283165c61c702e1aed28375718dd2674179c61c517d93baabc2219becf081a/iocs", "1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam", "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67", "Crowdsourced IDS: Unique rule identifier: This rule belongs to a private collection", "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp", "https://www.virustotal.com/graph/embed/ge74cb43ed64b456f85c6328dd750f6005716708de6f04068bcbbf3c498541992?theme=dark", "Can the DoD no questions asked target a SA victim", "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.", "Devices remotely connected, tracked , monitored", "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise", "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.", "TJprojMain.exe {79c7303a1a49b85569245a8ca1c1a26be720387845af9391fa1e4677308bd6b6}", "Yara \u2022 NSIS from ruleset NSIS by kevoreilly", "IDS: D-Link Devices Home Network Administration Protocol Command Execution", "Crowdsourced Signa: Schedule system process by Joe Security", "I am very upset. Whoever is doing this is sick.", "Mirai - ]1.0.0.0 - Unix.Trojan.Mirai-6981169-0", "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov", "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?", "https://meumundogay-com.sexogratis.page/locker", "There is fear in silence or speaking out", "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf", "https://www.virustotal.com/gui/collection/ab283165c61c702e1aed28375718dd2674179c61c517d93baabc2219becf081a/community", "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/", "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA", "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg", "Yara \u2022 Windows_Generic_Threat_7526f106 from ruleset Windows_Generic_Threat by Elastic Security", "Sigma \u2022 Suspicious Process Masquerading As SvcHost.EXE by Swachchhanda Shrawan Poudel", "IDS : Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI", "Crowdsourced IDS: Matches rule SURICATA HTTP missing Host header", "IDS: WGET Command Specifying Output in HTTP Headers", "https://www.virustotal.com/gui/collection/ab283165c61c702e1aed28375718dd2674179c61c517d93baabc2219becf081a/summary", "Unix.Dropper.Mirai inc. 100.181.126.203 \u2022 United States\tAS21928 t-mobile usa inc.", "Sigma: Matches rule System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)", "MetrobyT-mobile", "Target agreed and complied with all lie detector measures.", "Alerts: persistence_autorun \u2022 persistence_autorun_tasks stealth_hiddenreg \u2022 suspicious_command", "https://www.meritshealth.com/ Defense.Gov Mobility Co? ", "*Themida_2xx. Oreans,Technologies", "Is the family allowed to have a funeral for Tsara or print an obituary", "Sigma \u2022 System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)", "https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members", "UA Alberta | Somehow I don\u2019t think this is part of a match but rather an attack. Mimic", "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf", "https://es.pornhat.com/models/the-sex-creator/", "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.", "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)", "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.", "x.com \u2022 nr-data.net \u2022 apple.k8s.joewa.com", "*Andariel Backdoor Activity (Checkin)", "DiabloFans ClapBack: Google. Com", "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.", "foundry2-lbl.dvr.dn2.n-helix.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://foundry2sdbl", "https://xn--72c9abh1f8ad1lzc.com/video_tag/pornthai/ \u2022 https://ro.theskinnyfoodco.com/en-fr/blogs/recipes/pornstar-martini-recipe \u2022 m.pornsexer.xxx.3.1.adiosfil.roksit.net", "Alert: dead_host nids_malware_alert network_icmp nolookup_communication", "If someone is believed to be a threat they have right to due process.", "Crowdsourced IDS: ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check Rule Match", "Unix.Dropper.Mirai inc. 1 Verizon : 100.10.95.119 United States \u2022 AS701 Verizon", "https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210", "https://www.virustotal.com/graph/embed/g25090dbc8e9e49cc805b123e936987a5022d66ee7e2b457193bf6cf242952800?theme=dark" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Trojan:win32/vflooder", "Apnic", "Win.packer.pkr_ce1a-9980177-0", "Virus.virlock/nabucur", "Win.malware.ursu-9856871-0", "Unix.trojan.mirai-6981169-0", "Tofsee", "Unix.dropper.mirai-7135870-0", "Worm:win32/mofksys.rnd!mtb", "Malware", "Elf:ddos-y\\ [trj]", "Win.virus.polyransom-5704625-0" ], "industries": [ "Technology", "Healthcare", "Education", "Telecommunications" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 12, "pulses": [ { "id": "68e2bb5d9ee8577ab5519f2c", "name": "Meritshealth with DoD links? ", "description": "", "modified": "2026-01-13T00:05:56.401000", "created": "2025-10-05T18:39:25.286000", "tags": [ "gtmk5nxqc6", "utc amazon", "utc na", "acceptencoding", "gmt contenttype", "connection", "true pragma", "gmt setcookie", "httponly", "gmt vary", "nc000000 up", "html document", "unicode text", "utf8 text", "oc0006 http", "http traffic", "https http", "mitre att", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "number", "ja3s", "algorithm", "azure rsa", "tls issuing", "cus subject", "stwa lredmond", "cnmicrosoft ecc", "update secure", "server ca", "omicrosoft cus", "get http", "dns resolutions", "registrar", "markmonitor inc", "country", "resolver domain", "type name", "html", "apnic", "apnic whois", "please", "rirs", "cidr", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "development att", "name tactics", "binary file", "ck matrix", "wheelchair", "iamrobert", "pattern match", "ascii text", "href", "united", "general", "local", "path", "encrypt", "click", "passive dns", "urls", "files", "reverse dns", "netherlands", "present aug", "a domains", "moved", "first pqc", "ip address", "unknown ns", "unknown aaaa", "title", "body", "meta", "window", "accept", "body doctype", "welcome", "ok server", "gmt content", "present jul", "present sep", "aaaa", "hostname", "error", "defense evasion", "windows nt", "response", "vary", "strings", "core", "t1027.013 encrypted/encoded", "michelin lazy k", "prefetch8", "flag", "date", "starfield", "hybrid", "mobility cr", "extraction", "data upload", "include", "o url", "url url", "included i0", "review ioc", "excluded ic", "suggested", "find sugi", "failed", "cre pul", "enter", "enter sc", "type", "enric", "extra", "type opaste", "data u", "included", "copy md5", "copy sha1", "copy sha256", "null", "refresh", "tools", "look", "verify", "restart", "t1480 execution", "expiration", "url https", "no expiration", "iocs", "ipv4", "text drag", "drop or", "browse to", "select file", "redacted for", "server", "privacy tech", "privacy admin", "postal code", "stateprovince", "organization", "email", "code", "quantum rooms", "sam somalia", "emp", "porn", "media defense", "gov porn", "suck my nips", "reimer suspect", "jeffrey reimer", "dod", "department of defense", "show", "date checked", "url hostname", "server response", "google safe", "results may", "entries http", "scans record", "value status", "sabey type", "merits fake", "y.a.s.", "pornography", "ramsom" ], "references": [ "https://www.meritshealth.com/ Defense.Gov Mobility Co? ", "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67", "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf", "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf", "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html", "https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com", "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/", "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp", "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg", "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)", "https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members", "https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210", "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex", "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf", "https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo", "https://meumundogay-com.sexogratis.page/locker", "https://es.pornhat.com/models/the-sex-creator/", "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA", "Can the DoD no questions asked target a SA victim", "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.", "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise", "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov", "There is fear in silence or speaking out", "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.", "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?", "If someone is believed to be a threat they have right to due process.", "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.", "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.", "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.", "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.", "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot", "iamrobert.com Y.A.S.", "1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam", "Target agreed and complied with all lie detector measures.", "Is the family allowed to have a funeral for Tsara or print an obituary", "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.", "I am very upset. Whoever is doing this is sick." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "TA0042", "name": "Resource Development", "display_name": "TA0042 - Resource Development" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1591", "name": "Gather Victim Org Information", "display_name": "T1591 - Gather Victim Org Information" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "display_name": "T1562.004 - Disable or Modify System Firewall" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1562.008", "name": "Disable Cloud Logs", "display_name": "T1562.008 - Disable Cloud Logs" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1056.003", "name": "Web Portal Capture", "display_name": "T1056.003 - Web Portal Capture" }, { "id": "T1512", "name": "Capture Camera", "display_name": "T1512 - Capture Camera" }, { "id": "T1180", "name": "Screensaver", "display_name": "T1180 - Screensaver" } ], "industries": [], "TLP": "white", "cloned_from": "68e2b14d83bb63502feac65e", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1365, "URL": 11172, "hostname": 2780, "FileHash-MD5": 381, "FileHash-SHA256": 4420, "FileHash-SHA1": 338, "CIDR": 4, "SSLCertFingerprint": 24, "CVE": 1, "email": 1 }, "indicator_count": 20486, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "138 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68e2b14d83bb63502feac65e", "name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.", "description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech needed. Later denies ever being a mobility technician. They killed a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?", "modified": "2026-01-07T00:00:30.717000", "created": "2025-10-05T17:56:29.109000", "tags": [ "gtmk5nxqc6", "utc amazon", "utc na", "acceptencoding", "gmt contenttype", "connection", "true pragma", "gmt setcookie", "httponly", "gmt vary", "nc000000 up", "html document", "unicode text", "utf8 text", "oc0006 http", "http traffic", "https http", "mitre att", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "number", "ja3s", "algorithm", "azure rsa", "tls issuing", "cus subject", "stwa lredmond", "cnmicrosoft ecc", "update secure", "server ca", "omicrosoft cus", "get http", "dns resolutions", "registrar", "markmonitor inc", "country", "resolver domain", "type name", "html", "apnic", "apnic whois", "please", "rirs", "cidr", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "development att", "name tactics", "binary file", "ck matrix", "wheelchair", "iamrobert", "pattern match", "ascii text", "href", "united", "general", "local", "path", "encrypt", "click", "passive dns", "urls", "files", "reverse dns", "netherlands", "present aug", "a domains", "moved", "first pqc", "ip address", "unknown ns", "unknown aaaa", "title", "body", "meta", "window", "accept", "body doctype", "welcome", "ok server", "gmt content", "present jul", "present sep", "aaaa", "hostname", "error", "defense evasion", "windows nt", "response", "vary", "strings", "core", "t1027.013 encrypted/encoded", "michelin lazy k", "prefetch8", "flag", "date", "starfield", "hybrid", "mobility cr", "extraction", "data upload", "include", "o url", "url url", "included i0", "review ioc", "excluded ic", "suggested", "find sugi", "failed", "cre pul", "enter", "enter sc", "type", "enric", "extra", "type opaste", "data u", "included", "copy md5", "copy sha1", "copy sha256", "null", "refresh", "tools", "look", "verify", "restart", "t1480 execution", "expiration", "url https", "no expiration", "iocs", "ipv4", "text drag", "drop or", "browse to", "select file", "redacted for", "server", "privacy tech", "privacy admin", "postal code", "stateprovince", "organization", "email", "code", "quantum rooms", "sam somalia", "emp", "porn", "media defense", "gov porn", "suck my nips", "reimer suspect", "jeffrey reimer", "dod", "department of defense", "show", "date checked", "url hostname", "server response", "google safe", "results may", "entries http", "scans record", "value status", "sabey type", "merits fake", "y.a.s.", "pornography", "ramsom" ], "references": [ "https://www.meritshealth.com/ Defense.Gov Mobility Co? ", "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67", "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf", "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf", "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html", "https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com", "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/", "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp", "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg", "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)", "https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members", "https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210", "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex", "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf", "https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo", "https://meumundogay-com.sexogratis.page/locker", "https://es.pornhat.com/models/the-sex-creator/", "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA", "Can the DoD no questions asked target a SA victim", "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.", "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise", "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov", "There is fear in silence or speaking out", "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.", "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?", "If someone is believed to be a threat they have right to due process.", "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.", "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.", "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.", "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.", "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot", "iamrobert.com Y.A.S.", "1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam", "Target agreed and complied with all lie detector measures.", "Is the family allowed to have a funeral for Tsara or print an obituary", "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.", "I am very upset. Whoever is doing this is sick." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "TA0042", "name": "Resource Development", "display_name": "TA0042 - Resource Development" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1591", "name": "Gather Victim Org Information", "display_name": "T1591 - Gather Victim Org Information" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "display_name": "T1562.004 - Disable or Modify System Firewall" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1562.008", "name": "Disable Cloud Logs", "display_name": "T1562.008 - Disable Cloud Logs" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1056.003", "name": "Web Portal Capture", "display_name": "T1056.003 - Web Portal Capture" }, { "id": "T1512", "name": "Capture Camera", "display_name": "T1512 - Capture Camera" }, { "id": "T1180", "name": "Screensaver", "display_name": "T1180 - Screensaver" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1328, "URL": 9931, "hostname": 2621, "FileHash-MD5": 381, "FileHash-SHA256": 4360, "FileHash-SHA1": 338, "CIDR": 4, "SSLCertFingerprint": 24, "CVE": 1, "email": 1 }, "indicator_count": 18989, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "144 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68d877d6231fc1cbe1792ee1", "name": "PolyRansom attack through malicious actor on threat platforms", "description": "Virlock , PolyRansom and multiple other attacks through malicious actor using social engineering tactics. Has a rigged platform. Goal -\n to gain complete command and control of users in great platforms. Has infected at least a single device.\n#domainrobot #socialengineeeing #Tofsee\n#Trojan:Win32/Vflooder\n#Unix.Dropper.Mirai-7135870-0\n#Virus.Virlock/Nabucur\n#Win.Packer.pkr_ce1a-9980177-0\n#Win.Virus.PolyRansom", "modified": "2025-10-27T22:02:25.163000", "created": "2025-09-27T23:48:38.895000", "tags": [ "iocs", "indicator role", "write c", "intel", "ms windows", "medium", "pe32", "delete", "ids detections", "yara detections", "write", "malware", "delete c", "windows", "high", "port", "encrypt", "tofsee", "stream", "passive dns", "http", "ip address", "related nids", "files location", "united states", "united", "win32", "trojan", "mtb may", "twitter", "hellspawn", "worm", "title", "emails", "servers", "get http", "dns resolutions", "http traffic", "command", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "request", "windows nt", "win64", "khtml", "gecko", "response", "present sep", "aaaa", "resolved ips", "ip traffic", "displayname", "yara rule", "loaderid", "name servers", "urls", "domain robot", "mail", "moved", "media gmbh", "info file", "network dropped", "duration cuckoo", "version file", "machine label", "manager", "shutdown", "host", "generic http", "exe upload", "inbound", "outbound", "markus", "certificate", "record value", "object", "path", "server", "registrar abuse", "contact email", "contact phone", "registrar iana", "registrar url", "diablo", "gandi sas", "gandi", "diablo attacks", "bluemind", "alberta", "domain add", "asn as16625", "akamai", "less whois", "registrar", "metrobytmobile", "t mobile", "metro", "present jul", "present jun", "present aug", "germany unknown", "germany", "invalid url", "ipv4 add", "frankfurt", "main", "no entries", "entrust", "hostname add", "files loading", "mimic", "first address", "medium attempts", "process", "explorer", "windows startup", "kuwiqsma", "match medium", "medium installs", "installs", "t regdword", "user", "ntcreatefile", "filehandle", "createfilew", "getfilesize", "blpdqe", "jjqcpluanwwhg", "u0012", "desiredaccess", "keyhandle", "ntopenkeyex", "u001aw", "u0018", "read", "next", "tags none", "file type", "date september", "am size", "imphash pehash", "richhash", "south korea", "taiwan as3462", "as21928", "china as4134", "as4766 korea", "china as4837", "as9318 sk", "as701 verizon", "verizon", "tcp syn", "infectednight", "resolverror", "tref neutral", "ck technique", "technique id", "tofsee high", "overview whois", "pulses", "tags", "related tags", "more external", "resources whois", "urlvoid", "tavao.exe", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "defense evasion", "spawns", "access att", "ascii text", "pattern match", "mitre att", "size", "meta", "null", "error", "click", "roboto", "hybrid", "general", "local", "starfield", "strings", "refresh", "tools", "onload", "span", "iframe", "found", "t1480 execution", "backdoor", "a domains", "russia", "next associated", "link", "windir", "interesting", "show technique", "ck matrix", "network traffic", "t1071", "t1057", "lowfi", "gameforprofits", "game att", "night got", "job done infected" ], "references": [ "DiabloFans ClapBack: Google. Com", "Crowdsourced IDS: ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check Rule Match", "CS\u2019d IDS: ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com) Rule Match", "Crowdsourced IDS: Matches rule SURICATA HTTP missing Host header", "Crowdsourced IDS: Unique rule identifier: This rule belongs to a private collection", "MetrobyT-mobile", "UA Alberta | Somehow I don\u2019t think this is part of a match but rather an attack. Mimic", "Unix.Dropper.Mirai inc. 100.181.126.203 \u2022 United States\tAS21928 t-mobile usa inc.", "Unix.Dropper.Mirai inc. 1 Korea Telecom 1.107.218.24 \u2022 South Korea\tAS4766", "Unix.Dropper.Mirai inc. 1 Telstra Corporation Ltd 1.125.165.62 \u2022 Australia AS1221 Telstra", "Unix.Dropper.Mirai inc. 1 Verizon : 100.10.95.119 United States \u2022 AS701 Verizon", "Sigma: Matches rule System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win.Packer.pkr_ce1a-9980177-0", "display_name": "Win.Packer.pkr_ce1a-9980177-0", "target": null }, { "id": "Trojan:Win32/Vflooder", "display_name": "Trojan:Win32/Vflooder", "target": "/malware/Trojan:Win32/Vflooder" }, { "id": "Virus.Virlock/Nabucur", "display_name": "Virus.Virlock/Nabucur", "target": null }, { "id": "Win.Virus.PolyRansom-5704625-0", "display_name": "Win.Virus.PolyRansom-5704625-0", "target": null }, { "id": "Unix.Dropper.Mirai-7135870-0", "display_name": "Unix.Dropper.Mirai-7135870-0", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 450, "FileHash-SHA1": 435, "FileHash-SHA256": 2092, "URL": 646, "domain": 593, "SSLCertFingerprint": 9, "hostname": 657, "email": 13 }, "indicator_count": 4895, "is_author": false, "is_subscribing": null, "subscriber_count": 146, "modified_text": "216 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68d877e28416d81633bae1ad", "name": "PolyRansom attack through malicious actor on threat platforms", "description": "Virlock , PolyRansom and multiple other attacks through malicious actor using social engineering tactics. Has a rigged platform. Goal -\n to gain complete command and control of users in great platforms. Has infected at least a single device.\n#domainrobot #socialengineeeing #Tofsee\n#Trojan:Win32/Vflooder\n#Unix.Dropper.Mirai-7135870-0\n#Virus.Virlock/Nabucur\n#Win.Packer.pkr_ce1a-9980177-0\n#Win.Virus.PolyRansom", "modified": "2025-10-27T22:02:25.163000", "created": "2025-09-27T23:48:50.976000", "tags": [ "iocs", "indicator role", "write c", "intel", "ms windows", "medium", "pe32", "delete", "ids detections", "yara detections", "write", "malware", "delete c", "windows", "high", "port", "encrypt", "tofsee", "stream", "passive dns", "http", "ip address", "related nids", "files location", "united states", "united", "win32", "trojan", "mtb may", "twitter", "hellspawn", "worm", "title", "emails", "servers", "get http", "dns resolutions", "http traffic", "command", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "request", "windows nt", "win64", "khtml", "gecko", "response", "present sep", "aaaa", "resolved ips", "ip traffic", "displayname", "yara rule", "loaderid", "name servers", "urls", "domain robot", "mail", "moved", "media gmbh", "info file", "network dropped", "duration cuckoo", "version file", "machine label", "manager", "shutdown", "host", "generic http", "exe upload", "inbound", "outbound", "markus", "certificate", "record value", "object", "path", "server", "registrar abuse", "contact email", "contact phone", "registrar iana", "registrar url", "diablo", "gandi sas", "gandi", "diablo attacks", "bluemind", "alberta", "domain add", "asn as16625", "akamai", "less whois", "registrar", "metrobytmobile", "t mobile", "metro", "present jul", "present jun", "present aug", "germany unknown", "germany", "invalid url", "ipv4 add", "frankfurt", "main", "no entries", "entrust", "hostname add", "files loading", "mimic", "first address", "medium attempts", "process", "explorer", "windows startup", "kuwiqsma", "match medium", "medium installs", "installs", "t regdword", "user", "ntcreatefile", "filehandle", "createfilew", "getfilesize", "blpdqe", "jjqcpluanwwhg", "u0012", "desiredaccess", "keyhandle", "ntopenkeyex", "u001aw", "u0018", "read", "next", "tags none", "file type", "date september", "am size", "imphash pehash", "richhash", "south korea", "taiwan as3462", "as21928", "china as4134", "as4766 korea", "china as4837", "as9318 sk", "as701 verizon", "verizon", "tcp syn", "infectednight", "resolverror", "tref neutral", "ck technique", "technique id", "tofsee high", "overview whois", "pulses", "tags", "related tags", "more external", "resources whois", "urlvoid", "tavao.exe", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "defense evasion", "spawns", "access att", "ascii text", "pattern match", "mitre att", "size", "meta", "null", "error", "click", "roboto", "hybrid", "general", "local", "starfield", "strings", "refresh", "tools", "onload", "span", "iframe", "found", "t1480 execution", "backdoor", "a domains", "russia", "next associated", "link", "windir", "interesting", "show technique", "ck matrix", "network traffic", "t1071", "t1057", "lowfi", "gameforprofits", "game att", "night got", "job done infected" ], "references": [ "DiabloFans ClapBack: Google. Com", "Crowdsourced IDS: ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check Rule Match", "CS\u2019d IDS: ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com) Rule Match", "Crowdsourced IDS: Matches rule SURICATA HTTP missing Host header", "Crowdsourced IDS: Unique rule identifier: This rule belongs to a private collection", "MetrobyT-mobile", "UA Alberta | Somehow I don\u2019t think this is part of a match but rather an attack. Mimic", "Unix.Dropper.Mirai inc. 100.181.126.203 \u2022 United States\tAS21928 t-mobile usa inc.", "Unix.Dropper.Mirai inc. 1 Korea Telecom 1.107.218.24 \u2022 South Korea\tAS4766", "Unix.Dropper.Mirai inc. 1 Telstra Corporation Ltd 1.125.165.62 \u2022 Australia AS1221 Telstra", "Unix.Dropper.Mirai inc. 1 Verizon : 100.10.95.119 United States \u2022 AS701 Verizon", "Sigma: Matches rule System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win.Packer.pkr_ce1a-9980177-0", "display_name": "Win.Packer.pkr_ce1a-9980177-0", "target": null }, { "id": "Trojan:Win32/Vflooder", "display_name": "Trojan:Win32/Vflooder", "target": "/malware/Trojan:Win32/Vflooder" }, { "id": "Virus.Virlock/Nabucur", "display_name": "Virus.Virlock/Nabucur", "target": null }, { "id": "Win.Virus.PolyRansom-5704625-0", "display_name": "Win.Virus.PolyRansom-5704625-0", "target": null }, { "id": "Unix.Dropper.Mirai-7135870-0", "display_name": "Unix.Dropper.Mirai-7135870-0", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 450, "FileHash-SHA1": 435, "FileHash-SHA256": 2092, "URL": 646, "domain": 593, "SSLCertFingerprint": 9, "hostname": 657, "email": 13 }, "indicator_count": 4895, "is_author": false, "is_subscribing": null, "subscriber_count": 146, "modified_text": "216 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68c1a8b3b2144ae9455191c4", "name": "VT Graph (miniuser) - 09.10.25", "description": "all-seeing-eye-sauron-powershell-tool-data-collection-threat-hunting_578. pdf - 09.10.25", "modified": "2025-10-10T16:03:06.210000", "created": "2025-09-10T16:34:59.269000", "tags": [], "references": [ "https://www.virustotal.com/graph/embed/g25090dbc8e9e49cc805b123e936987a5022d66ee7e2b457193bf6cf242952800?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 40, "FileHash-SHA1": 40, "FileHash-SHA256": 1281, "URL": 618, "domain": 461, "hostname": 455 }, "indicator_count": 2895, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "233 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "687605f986433ebf2673f0b8", "name": "Win.Malware.Downloadguide-6803841-0 | Patient Monitoring", "description": "Part of an elaborate, unrelenting espionage campaign , multiple compromises, targeting.\n> alf:PUA:Win32/DownloadGuide \nLink below found in previous Pulse -[http://s0.patient.media/res/f91b97f6b547405cb4370cbb003dfea2-jquery-1.11.1.min.js.gzip]\n\u2022 Win.Malware.Downloadguide-6803841-0\nYara:\nresearch_pe_signed_outside_timestamp\n\u2022\nkernel32_dll_xor_exe_key_51_key_byte_encoded \u2022\nxor_0x33_kernel32_dll \u2022 \nConcerning: {Domain\tAddress\tRegistrar\tCountry\ns0.patient.media\n-\tGoDaddy.com, LLC\nOrganization: Egton Medical Information Systems Limited\nName Server: ns34.domaincontrol.com\nCreation Date: 2015-01-12T16:20:56}\n\n{https://www.anyxxxtube.net/search-porn/tsara-brashears/}\n{https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net}\n{wallpapers-nature.com}\n{https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian}", "modified": "2025-08-14T07:05:00.239000", "created": "2025-07-15T07:40:41.180000", "tags": [ "url http", "url https", "indicator role", "title added", "active related", "pulses hostname", "entries", "gmt etag", "server", "ecacc", "serving ip", "address", "dom dom", "data upload", "extraction", "pdf report", "enter", "failed", "extraction data", "enter sc", "type", "extra data", "extri please", "review data", "excluded tous", "tui sugges", "find", "show", "at filer", "iocs", "levelbluelabs", "please", "included iocs", "excluded io", "find suggested", "types", "domain data", "search", "o please", "manually add", "c data", "o suggesteo", "include data", "review uus", "u exclude", "find s", "indicaok data", "dom doman", "filehash", "md5 add", "pulse pulses", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "file score", "copy", "push", "copy md5", "copy sha1", "copy sha256", "sha1", "sha256", "pattern match", "ascii text", "size", "mitre att", "utf8", "null", "refresh", "body", "span", "hybrid", "general", "local", "path", "click", "date", "strings", "error", "tools", "look", "verify", "restart", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "spawns", "evasion att", "t1480 execution", "discovery att" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3597, "FileHash-MD5": 343, "domain": 547, "hostname": 1222, "FileHash-SHA1": 343, "FileHash-SHA256": 4464, "CVE": 1, "email": 1 }, "indicator_count": 10518, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "290 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6875e98438889e51b3fdd18f", "name": "Critical \u2022 Schedule system process - Mirai | Foundry Overwatch", "description": "", "modified": "2025-08-14T05:04:16.839000", "created": "2025-07-15T05:39:16.652000", "tags": [ "win32 exe", "country", "include review", "exclude", "defense evasion", "access ta0006", "command", "control ta0011", "impact ta0040", "impact ob0008", "file system", "system oc0008", "match unknown", "adversaries", "match info", "info", "execution flow", "t1574 dll", "tries", "registry", "modify system", "process t1543", "unknown", "window", "ob0009 install", "ob0012 install", "insecure", "b0047 modify", "registry e1112", "hidden files", "registry run", "keys", "startup folder", "f0012 file", "critical", "united", "as15169", "delete c", "as16509", "show", "search", "intel", "ms windows", "entries", "medium", "worm", "copy", "write", "explorer", "malware", "next", "present jul", "status", "date", "ip address", "domain", "servers", "showing", "unknown ns", "related pulses", "pulses", "tags", "related tags", "more file", "type", "date april", "am size", "sha1 sha256", "as14618", "united kingdom", "as54113", "as15133 verizon", "top source", "top destination", "status domain", "ip whitelisted", "whitelisted", "tcp include", "source source", "oamazon", "cnamazon rsa", "odigicert inc", "sweden as20940", "as20940", "entries tls", "ip destination", "encrypt", "aaaa", "found", "certificate", "next associated", "urls show", "date checked", "error", "windows", "high", "yara detections", "installs", "checks", "filehash", "sha256 add", "themida", "data upload", "extraction", "md5 add", "av detections", "ids detections", "alerts", "analysis date", "file score", "win32", "ddos", "passive dns", "activity", "checkin", "win64", "mtb jan", "lowfi", "trojan", "ransom", "trojandropper", "yara", "nsis", "nss bv", "su data", "windo alerts", "andariel", "malware traffic", "nids", "icmp traffic", "dns query", "id deadhost", "connects", "andariel high", "richhash", "external", "virustotal api", "screenshots", "failed", "auurtonany data", "themida andarie", "present may", "japan unknown", "unknown cname", "domain add", "urls", "files", "http headers", "msie", "windows nt", "tcp syn", "resolverror", "externalport", "internalport", "wget command", "devices home", "execution", "foundry", "home networks", "mirai", "x.com", "porn", "monitored target", "d link", "targets" ], "references": [ "TJprojMain.exe {79c7303a1a49b85569245a8ca1c1a26be720387845af9391fa1e4677308bd6b6}", "Crowdsourced Signa: Schedule system process by Joe Security", "Sigma \u2022 Suspicious Process Masquerading As SvcHost.EXE by Swachchhanda Shrawan Poudel", "Sigma \u2022 System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)", "Yara \u2022 NSIS from ruleset NSIS by kevoreilly", "Yara \u2022 rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)", "Yara \u2022 Windows_Generic_Threat_7526f106 from ruleset Windows_Generic_Threat by Elastic Security", "Alerts: persistence_autorun \u2022 persistence_autorun_tasks stealth_hiddenreg \u2022 suspicious_command", "IDS : Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI", "Mirai - ]1.0.0.0 - Unix.Trojan.Mirai-6981169-0", "*Themida_2xx. Oreans,Technologies", "*Andariel Backdoor Activity (Checkin)", "Alert: dead_host nids_malware_alert network_icmp nolookup_communication", "IDS: WGET Command Specifying Output in HTTP Headers", "IDS: D-Link Devices Home Network Administration Protocol Command Execution", "foundry2-lbl.dvr.dn2.n-helix.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://foundry2sdbl", "https://xn--72c9abh1f8ad1lzc.com/video_tag/pornthai/ \u2022 https://ro.theskinnyfoodco.com/en-fr/blogs/recipes/pornstar-martini-recipe \u2022 m.pornsexer.xxx.3.1.adiosfil.roksit.net", "x.com \u2022 nr-data.net \u2022 apple.k8s.joewa.com", "http://apple.cc.lvlid.com/ \u2022 http://apple.cc.lvlid.com/ios/ \u2022 http://www.apple.cc.lvlid.com/ios", "Devices remotely connected, tracked , monitored" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Worm:Win32/Mofksys.RND!MTB", "display_name": "Worm:Win32/Mofksys.RND!MTB", "target": "/malware/Worm:Win32/Mofksys.RND!MTB" }, { "id": "Unix.Trojan.Mirai-6981169-0", "display_name": "Unix.Trojan.Mirai-6981169-0", "target": null }, { "id": "Win.Malware.Ursu-9856871-0", "display_name": "Win.Malware.Ursu-9856871-0", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null } ], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1512", "name": "Capture Camera", "display_name": "T1512 - Capture Camera" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [ "Healthcare", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 448, "FileHash-SHA1": 435, "FileHash-SHA256": 5851, "hostname": 2580, "domain": 1176, "URL": 7133, "SSLCertFingerprint": 30, "email": 3, "CVE": 3 }, "indicator_count": 17659, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "290 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "670ff437ec341e3af30865f6", "name": "VirusTotal Graph - medicine[.]stmatthews[.]edu - 10.16.24", "description": "A quick look at another connected Medical School\nmedicine[.]stmatthews[.]edu - 10.16.24\n\nNeed to add Malcore ECFMG IOCs: https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665292fee4c5ec0b4d5 (02.22.25) - for those of you wondering why this is related to a lot of hospitals and such.", "modified": "2025-02-11T12:21:41.307000", "created": "2024-10-16T17:13:27.447000", "tags": [ "entity", "Medicine" ], "references": [ "https://www.virustotal.com/graph/embed/ge74cb43ed64b456f85c6328dd750f6005716708de6f04068bcbbf3c498541992?theme=dark", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665292fee4c5ec0b4d5" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Healthcare", "Technology", "Education" ], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 3, "FileHash-SHA256": 76, "domain": 106, "hostname": 202, "URL": 179 }, "indicator_count": 569, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "474 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66d0a996b288ca46ab7e63ae", "name": "CEIDG (www.pitprojekt.pl , pitprojekt.pl) jak otworzy\u0107 firm\u0119, jak rozpocz\u0105\u0107 biznes, dzia\u0142alno\u015b\u0107 gospodarcza zak\u0142adanie, jak rozpocz\u0105\u0107 dzia\u0142alno\u015b\u0107 gospodarcz\u0105", "description": "Zawarte zasoby wed\u0142ug j\u0119zyka \u00c2\u00a31.1bn, a total of 7.4bn euros ($9.6bn; \u00a36.3bn)", "modified": "2024-12-05T21:16:06.820000", "created": "2024-08-29T17:02:13.392000", "tags": [ "admin", "asset", "dufur", "jnswj", "3px center", "saxla", "zjloj", "whasz htm", "oszczdno", "png ikona", "rt angielski", "angielski usa", "wersja rt", "narzuta chi2", "plik", "whasz", "bogaty hash", "sha256", "ssdeep", "schema", "strings", "guid", "blob", "sha256 file", "type type", "vhash", "imphash", "bvgquf", "cblrxf", "coqbmf", "efq78c", "gkrikb", "hdvrde", "hlo3ef", "izt63", "jnoxi", "kg2exe", "pejzasz", "rticon english", "english us", "chi2", "png rticon", "ico rtgroupicon", "code signing", "algorithm", "serial number", "sectigo public", "thumbprint", "rsa time", "valid from", "name sectigo", "valid", "valid usage", "ascii text", "neutral", "data rtcursor", "data rtdialog", "default", "rticon maori", "ceidg", "informacja o", "usugi", "z wniosek", "sprawd", "zarejestruj spk", "centralna", "ewidencja", "strona gwna", "formularze i", "sha1", "pehash", "richhash", "authentihash", "skrt", "system", "podaj", "windows z", "kreator", "dostawca", "wifi", "nazwa typ", "md5 nazwa", "imphasz", "kropelka", "smyczki", "zasb manifestu", "neutralny", "ikona rt", "zawarte zasoby", "md5 chi2", "ikonagrupyrt", "rtmanifest", "zawarte", "sha256 typ" ], "references": [ "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 4501, "URL": 4559, "hostname": 1957, "domain": 729, "FileHash-MD5": 903, "FileHash-SHA1": 849, "IPv4": 180, "email": 3, "IPv6": 2, "CVE": 1 }, "indicator_count": 13684, "is_author": false, "is_subscribing": null, "subscriber_count": 125, "modified_text": "542 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67127cfd194972b2b7a01965", "name": "Discord", "description": "Discord W11 Sample Device\nC:\\ProgramData*\\Discord", "modified": "2024-11-17T15:01:49.122000", "created": "2024-10-18T15:21:33.350000", "tags": [ "Discord" ], "references": [ "https://www.virustotal.com/gui/collection/ab283165c61c702e1aed28375718dd2674179c61c517d93baabc2219becf081a/community", "https://www.virustotal.com/gui/collection/ab283165c61c702e1aed28375718dd2674179c61c517d93baabc2219becf081a/iocs", "https://www.virustotal.com/gui/collection/ab283165c61c702e1aed28375718dd2674179c61c517d93baabc2219becf081a/summary", "https://www.virustotal.com/gui/collection/ab283165c61c702e1aed28375718dd2674179c61c517d93baabc2219becf081a/graph" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 80, "FileHash-SHA1": 80, "FileHash-SHA256": 357, "URL": 472, "domain": 413, "hostname": 153 }, "indicator_count": 1555, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "560 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "aquaexplo.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "aquaexplo.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780266590.0188856 }