{ "type": "Domain", "indicator": "ascio.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/ascio.com", "alexa": "http://www.alexa.com/siteinfo/ascio.com", "indicator": "ascio.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2224977146, "indicator": "ascio.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 13, "pulses": [ { "id": "690e47a694d9bc5c12d83bc0", "name": "LimeRAT | Dark Room Dennis | SpyGlassPrism HealthCare", "description": "Invasive, dark , illegal. Malicious. Will sift through malware Spyware systems. Perpetual remote connections. Employed by Tam Legals Christopher P. Ahmann (Colorado government) to spy on, tamper with , annoy, terrorize, out of financial awards. \n\n spyglass-w_1_.png\n\nSize\n362B (362 bytes)\nMD5\n3c0e6546a44bd9a0f2768df07db5c1c9 Copy MD5 to clipboard\nSHA1\neddf26d1da4a140f2f963b8564c4e99cd6f1a677 Copy SHA1 to clipboard\nSHA256\n83eec393865a35363695d6f2416792d0117f551bb3e41d13b141d70e6b35e02c Copy SHA256 to clipboard", "modified": "2025-12-07T18:01:48.980000", "created": "2025-11-07T19:25:26.827000", "tags": [ "germany asn", "as24940 hetzner", "status connect", "associated", "present nov", "germany", "moved", "present oct", "accept", "germany unknown", "web trebuchet", "ms lucida", "grande lucida", "sans unicode", "lucida sans", "tahoma", "passive dns", "title", "error", "gmbh ccp", "germany germany", "asn as197540", "response ip", "address google", "safe browsing", "present jun", "present may", "present mar", "present jan", "urls", "aaaa", "gmt content", "type", "tags", "tag groups", "countries", "add country", "malware att", "ck it1140", "information", "cisco", "umbrella rank", "automatic", "webgl", "please", "november", "typeof function", "topropertykey", "masonry object", "prism function", "cookies", "source level", "reverse dns", "protocol h2", "security tls", "asn24940", "online gmbh", "general full", "url https", "falkenstein", "community forum", "it url", "youtube videos", "twitch kanal", "discord channel", "spenden", "shop url", "google", "hetzneras", "http", "april", "de summary", "ehingen", "march", "google safe", "browsing", "learn", "issues tab", "value", "masonry", "domainpath name", "cgjerrieegagfw", "label", "input", "suchen nach", "suche", "form", "hash", "name value", "main", "flag", "contacted hosts", "ip address", "process details", "windir", "openurl c", "prefetch2", "ck id", "name tactics", "suspicious", "informative", "adversaries", "command", "defense evasion", "spawns", "found", "a domains", "ascio", "china unknown", "record value", "apache", "encrypt", "dns resolutions", "domains top", "level", "unique tlds", "related pulses", "related tags", "certificate", "hostname add", "url analysis", "files", "domain", "files ip", "address", "asn as24940", "less", "raspberry pi", "ubiquiti", "remote", "hostname", "pulse submit", "status", "entries", "x xss", "sameorigin x", "unicode text", "utf8 text", "click", "strings", "mitre att", "ck matrix", "pattern match", "ascii text", "href", "show process", "network traffic", "general", "hybrid", "local", "path", "monitored target", "spyglass", "spyware.", "pegasus systems", "prism", "colorado leg", "christopher p.ahmann", "ahmann", "christopher", "P", "tam legal", "treece", "alfrey", "muscat", "criminal", "jeffrey reimer", "theft", "remote connect", "schroeder dennis" ], "references": [ "Domain Name: schroederdennis.de | Status: connect", "remote.tecbuddy.de | remote.schneider-hv.de | remotedesktop.thedipling", "root-dns.netcup", "device-*******-*****-****-****-*********.remotewd.com", "ai-sandboxes.com", "Why Is this always a problem? Just curious. - http://wyblog.us/blog/rants/strikers-get-unemployment-benefits", "$ is funneled back to government, (quasi) , bonused \u2018doctors\u2019 State \u2018experts\u2019 who\u2026", "\u2026lie about the severity of injuries and do crap like this.", "This money belongs to people who paid insurance to cover on job injuries that happen in the job.", "Premise liability covers premises, employees and premises visitors. Weaponizing is not covered.", "Those attacked are the severely injured, survivors of dead workers, victims of providers.", "These people aren\u2019t in the dark. They are clear of the need to pay benefits.", "There are absolute losers in the dole illegally benefiting from the suffering others.", "https://hybrid-analysis.com/sample/00f5292bbe68d9edc68f9a22a750eafb58e4f8474e15a48e3cc217fbbd0cdef9/690e24bb39c801e6d80a824e", "\u2022 http://demo.ideaboxthemes.com/prism", "https://photoprism.thedipling.dns64.de/ \u2022 synertec-audit-cloud.healthchecks.prismcloud.uk", "photoprism.thedipling.dns64.de \u2022 https://schroederdennis.de/wp-content/plugins/highlighting-code-block/assets/js/prism.js?ver=2.0.1", "\"OC47TWOY.txt\" has type \"ASCII text\"- [targetUID: N/A] \"spyglass-w_1_.png\" has type \"Unknown\"- [targetUID: N/A]", "\"spyglass-w_1_.png\" has type \"Unknown\" and extension \"png\" \"clock-g_1_.png\" has type \"Unknown\" and extension \"png\"", "Domain healthcareshapers.com \u2022 https://www.healthcareshapers.com/", "www.ventoxhealthcare.in \u2022 synertec-audit-cloud.healthchecks.prismcloud.uk", "https://cullenbehavioralhealth.theraplatform.com/ \u2022 amghealthnetwork.com", "3ddruck-celle.de", "wwwwww.publicpublicwww.portal.apple-apple-number3.ipv64.net", "sonarr.app.pineapplegod.co.nz", "http://svc.ghlink.com/svc/Authenticate/Applications", "https://sap.dswd.gov.ph.index.ph \u2022 login.prod.siecm.gov.mg \u2022 nre-362.dev.nre.gss.gov.uk", "sdp-dev-ingest.ci.lineageandprovenance.gss.gov.uk", "http://www.xonitec.com/pornosu/yuotubesex.html", "rowanandbenporn.ssssssssssssshadow.home64.de", "https://pagead2.googlesyndication.com/pagead/ads?ltd_cs=1&client=ca-pub-6165363645315831&output=html&adk=1812271804&adf=3025194257&lmt=1713778114&plat=3%3A16%2C4%3A16%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fschroederdennis.de%2Fubiquiti%2Fubiquiti-unifi-u6-plus-vs-u6-lite-vergleich-access-point-wifi%2F&pra=5&wgl=1&easpi=0&asro=0&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyNC4wLjYzNjcuNjAiLG51bGwsMCx", "https://urlscan.io/result/019a5fbd-e7c6-743a-b9a7-a20e8b2943cd/", "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win.Packed.Rrat-9798963-0", "display_name": "Win.Packed.Rrat-9798963-0", "target": null }, { "id": "Win.Dropper.LimeRAT-9776087-0", "display_name": "Win.Dropper.LimeRAT-9776087-0", "target": null }, { "id": "Malware Packed", "display_name": "Malware Packed", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" } ], "industries": [ "Healthcare", "Legal", "Government", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1258, "hostname": 2018, "URL": 3033, "FileHash-SHA256": 651, "email": 4, "FileHash-MD5": 62, "FileHash-SHA1": 69, "SSLCertFingerprint": 5 }, "indicator_count": 7100, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "176 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65709943cc506763d721edec", "name": ":v3 - and the rest.... - www.tiuli.com/image/a057f08d1d773ab75e116ba4fffc595f.jpg?width=1080'", "description": "", "modified": "2023-12-06T15:54:43.175000", "created": "2023-12-06T15:54:43.175000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 781, "domain": 712, "URL": 4962, "hostname": 1795, "email": 4, "FileHash-MD5": 164, "FileHash-SHA1": 159 }, "indicator_count": 8577, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570914fe73d6efb17198812", "name": "https://areyou1or0.com/ - just like a lucky dip", "description": "", "modified": "2023-12-06T15:20:47.515000", "created": "2023-12-06T15:20:47.515000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "hostname": 496, "FileHash-SHA256": 351, "FileHash-MD5": 56, "FileHash-SHA1": 50, "URL": 2028, "domain": 711, "email": 1 }, "indicator_count": 3695, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708e2d7cb4228401888b63", "name": "possibly a central bank", "description": "", "modified": "2023-12-06T15:07:25.990000", "created": "2023-12-06T15:07:25.990000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 622, "domain": 2558, "URL": 4203, "hostname": 1221, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708a8f3203633312147d1e", "name": "www.virgilio. various Malacious tld's", "description": "", "modified": "2023-12-06T14:51:59.166000", "created": "2023-12-06T14:51:59.166000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 238, "URL": 818, "domain": 177, "hostname": 336, "email": 6, "FileHash-MD5": 79, "FileHash-SHA1": 47 }, "indicator_count": 1702, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "657081811cbd9a5dca05bd3d", "name": "assorted xyz sites for researching.", "description": "", "modified": "2023-12-06T14:13:21.425000", "created": "2023-12-06T14:13:21.425000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1061, "URL": 1128, "FileHash-SHA256": 24, "domain": 1983, "email": 2 }, "indicator_count": 4198, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6430dfed2b3b3f93d5a7cc19", "name": ":v3 - and the rest.... - www.tiuli.com/image/a057f08d1d773ab75e116ba4fffc595f.jpg?width=1080'", "description": "", "modified": "2023-05-08T02:00:47.680000", "created": "2023-04-08T03:30:53.195000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "chromeua", "optout", "runtime data", "ansi", "pcap processing", "drmedgeua", "pcap", "pcap frame", "optin", "edgeua", "date", "suspicious", "hybrid", "close", "click", "hosts", "april", "general", "strings", "qakbot", "united", "https://www.tiuli.com/tracks/21/%D7%9E%D7%92-%D7%A8%D7%A1%D7%94-" ], "references": [ "https://hybrid-analysis.com/sample/9a478e33d2a8fa58780b09519e3f9bbbc9a32595e67b7fead10a9ad4ec17a614/6430cb9896a0a8d5f1092b9d", "https://hybrid-analysis.com/sample/e7d74be84c0b7bd09a96d5932c79d9579a9b2426f8ab43896a77a4b8b11d289a/6430d038f2ba281e660c5ef6", "http://cdn.lineate-33x.net/static/vpaid/vpaid.98dc0711.js?viewable_impression_url=https://lbs-event.gcp.lineate-33x.net/view?event=AAAAAB7wpEhwdgACAq1WS2xcVxmee8cej0dJIVkgVmjkBWrRnPF5P9pFcCPURiZpEocGsbHO0771vLgzdppUlSpL3VggFbOBLFAViU1WyCuwWHkFkUAoy7AiG5C7qbxC3oT_zkxQG7Hkyrpzzq_v_o_v_85_3Prt5dajy60bRDIplMAacyUNI0KoTSq55jKZEFnaZEQKxjVBIeGAeMQOmYAVwoxEil1yIsZNxqwvh-Px5dtFf7T5__X57X_99Xc_a7T__Y9__v1vq9-7UAXYK-I963rx9kUiTJdS0mW0S_BPyuvDB0WvZ1dFF7dfv1sMwvDeuH3jTpvgLn6rDQbJ32p_KPkb7bXRqBfvRrdeTFYFU10m26-vv3vn-g877", "https://www.tiuli.com/tracks/21/%D7%9E%D7%92-%D7%A8%D7%A1%D7%94-%D7%91%D7%A7%D7%A2%D7%AA-%D7%91%D7%99%D7%AA-%D7%A6%D7%99%D7%93%D7%94" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4962, "hostname": 1795, "FileHash-SHA256": 781, "domain": 712, "email": 4, "FileHash-MD5": 164, "FileHash-SHA1": 159 }, "indicator_count": 8577, "is_author": false, "is_subscribing": null, "subscriber_count": 94, "modified_text": "1121 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642eac06b2963a871b0fdd45", "name": "just a bunch of tv's - Oh maybe these tv channels are all neural \ud83e\udd37\u200d\u2640\ufe0f world tv stream infection", "description": "The Falcon Sandbox malware analysis service is available to download, download and use any of the Falcon MalQuery tools or information you may have seen on the website. \u00c2\u00a31.5m", "modified": "2023-05-06T10:00:48.707000", "created": "2023-04-06T11:24:54.313000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "dropped file", "runtime data", "chromeua", "span", "optout", "pcap processing", "pattern match", "script", "click", "date", "middle", "null", "april", "twitter", "body", "error", "jackson", "desktop", "service", "bill", "heat", "webview", "cruise", "blank", "meta", "night", "false", "contact", "suspicious", "facebook", "close", "cannon", "mayberry", "santana", "comment", "flex", "karma", "nightmare", "find", "spacer", "kitty", "mike", "local", "already", "soldier", "wallpaper", "story", "generic", "tiny", "trident", "android", "hybrid", "general", "hosts", "favorite", "homepage", "music", "code", "push", "strings", "malicious", "qakbot", "25px", "60px", "24px", "100px", "1439px", "segoe ui", "roboto", "path", "chat", "form", "embed", "unknown", "live", "network", "unicode", "feed", "5000", "next", "fullscreen", "iframe", "latv", "latino voices", "localappdata", "latino", "noscript", "pragma", "this", "hybrid analysis", "programfiles", "input", "wilstaging02", "potential ip" ], "references": [ "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb", "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd", "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36", "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9", "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1291, "email": 13, "domain": 591, "URL": 3931, "FileHash-SHA256": 431, "FileHash-MD5": 92, "FileHash-SHA1": 89 }, "indicator_count": 6438, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "1122 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62f578d9bd71fef18276273b", "name": "https://areyou1or0.com/ - just like a lucky dip", "description": "", "modified": "2022-09-10T00:03:24.542000", "created": "2022-08-11T21:47:05.669000", "tags": [ "https://areyou1or0.com/", "http://direct.digitallanding.com/javascript/9.5.11.0/en-US/strin" ], "references": [ "g09925ed356e14431a1e64a663b9575c0939804b376704d96b75c2aea4245b05d.json", "http://direct.digitallanding.com/javascript/9.5.11.0/en-US/strings.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2047, "FileHash-SHA256": 351, "hostname": 503, "domain": 724, "CVE": 2, "FileHash-MD5": 56, "FileHash-SHA1": 50, "email": 1 }, "indicator_count": 3734, "is_author": false, "is_subscribing": null, "subscriber_count": 395, "modified_text": "1361 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62c0f67de71e1a7105c84885", "name": "www.firstsportz.com", "description": "", "modified": "2022-08-02T00:03:03.164000", "created": "2022-07-03T01:53:01.448000", "tags": [ "timo" ], "references": [ "https://hybrid-analysis.com/sample/de899c3feee092fe028bc50148544f31b8901675743fc0f97bfce327259dbee3/62c044d92ef9da07aa01321d", "URL www.apache.org/licenses/LICENSE-2.0http://www.apache.org/licenses/LICENSE-2.0Open", "http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL8-@", "https://rtb.da.us.criteo.com/google/auction/notify?profile=14&payload=UPmfDtqCMOgCgAXiIp0XAgAAAPYoFff2TiA6EJ2IymBKkkrxCNowD06JjQAS&wp=YMqInQAE53wKZIjPAA9S9H1IbXvGlF_g6pMG-Q", "https://secure.gravatar.com/avatar/6121f5a38f7526427becf34cc1e7bb2f?d=https://avatar-management--avatars.us-west-2.prod.public.atl-paas.net/default-avatar-2.png];https://5res.atlassian.net/secure/ViewProfile.jspa?accountId=6204fb88f38765006f673bf3;https://p4dx.s3.eu-west-3.amazonaws.com/Mcafee/mcafeech.html;https://p4dx.s3.eu-west-3.amazonaws.com/Mcafee/McAfee.jpg];https://p4dx.s3.eu-west-3.amazonaws.com/Mcafee/mcafeech.html;https://p4dx.s3.eu-west-3.amazonaws.com/Mcafee/mcafeech.html;https://p4dx.s3.eu-wes", "URL http://ert-banner.s3-website-eu-west-1.amazonaws.com/hu-banner.min.js", "URL https://cs.media.net/cksync?cs=1&type=ttd&ovsid=d0e0d23f-e88f-4ddb-868b-66da2a5995fc", "http://d1biim3gqfg2c3.cloudfront.net/installer/2012861567342/10902508", "www-linuxbabe-com.webpkgcache.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 258, "URL": 462, "domain": 106, "FileHash-SHA256": 329, "FileHash-MD5": 73, "CVE": 1, "FileHash-SHA1": 52, "email": 2 }, "indicator_count": 1283, "is_author": false, "is_subscribing": null, "subscriber_count": 393, "modified_text": "1400 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6280aa12040a569d19f6285f", "name": "possibly a central bank", "description": "Tobias Ahlin,", "modified": "2022-06-14T00:00:05.659000", "created": "2022-05-15T07:21:54.499000", "tags": [ "regexp", "typeof e", "function", "typeof t", "width", "error", "object", "pseudo", "child", "form", "class", "null", "date", "this", "void", "accept", "reduceright", "number", "string", "l420", "g8m7ft2s1tv", "copyright", "json", "uint8array", "ssnull", "script", "closure library", "xdfunction", "adfunction", "typeerror", "symbol", "generator", "typeof n", "array", "promise", "weakmap", "typeof f", "natb", "409764", "animation", "suspense", "context", "forwardref", "deleted", "10252", "meta", "facebook", "unknown", "scroll", "backspace", "insert", "typeof symbol", "typeof c", "typeof s", "sprintf", "syntaxerror", "vhyj", "diefg", "bcdiefguxx", "constructor", "param", "rockn", "createclass", "source", "super", "infinity", "false", "contact", "internal", "phonenumber", "middle", "path", "redemption", "pass", "click", "cont", "albania", "armenia", "burma", "belarus", "cuba", "panama", "paraguay", "slovakia", "chad", "uruguay", "prop", "invert", "flip", "close", "small", "green", "union", "indonesia", "lucia", "martin", "mexico", "code", "apache", "blin", "slave", "gondi", "icelandic", "ganda", "zulu", "christmas", "burkina", "czech", "ukraine", "android", "format", "updater", "next", "hooks", "harmony", "trim", "python", "push", "shift", "slice", "shadowsizzle", "domdata", "hexchars", "agent", "launcher", "fail", "bind", "trident", "getclass", "body", "widget", "areasmodule", "duip", "hlwq", "fz5i", "dehu", "tbh0", "fwir", "x7am", "pcnd", "valr", "boolean", "portal", "partner", "ascio partner", "ascio", "tlds", "login en", "en de", "join today", "idns", "skip", "ascio domains", "tlds offered", "global whois", "checker", "helvetica neue", "arial", "d67a60", "inter", "baskerville", "15px", "180deg", "135deg", "video", "init", "wrap", "flip direction", "stop animation", "scale", "htmlelement", "hide", "typeof", "property", "fill", "noscroll", "matrix", "skew", "look", "julian garnier", "mit license", "typeof define", "typeof module", "htmlcollection", "255a", "qnull", "float32array", "nfunction", "tobias ahlin", "github", "spotify", "hyper island", "strong", "tobias", "read", "view", "ahlin bjerrome", "minecraft", "view project", "spinkit", "lookback", "ruby", "hello" ], "references": [ "xfe-URL-ascio.com-stix2-2.1-export.json", "https://tobiasahlin.com", "xfe-URL-tobiasahlin.com-stix2-2.1-export.json", "https://tobiasahlin.com/js/anime.min.js", "https://tobiasahlin.com/js/app.js?v=1", "https://tobiasahlin.com/js/portfolio.js", "https://tobiasahlin.com/css/site.css", "https://ascio.com", "https://portal.ascio.com/login", "https://static.zdassets.com/ekr/snippet.js?key=d814ea4a-a8eb-4a9c-aedd-cac0aa0e3551", "https://portal.ascio.com/7.602be6705ce7b901b821.js", "https://cdn.pendo.io/agent/static/783a696b-ddf4-4152-439e-f3761f54f088/pendo.js", "https://portal.ascio.com/runtime.48adad1e07e2679eb1f4.js", "https://js.hs-scripts.com/20704235.js", "https://www.ascio.com/wp-content/themes/Ascio/dist/js/front.js?ver=1648137806", "https://www.ascio.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834", "https://www.ascio.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c", "https://www.ascio.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=17.0.1", "https://www.ascio.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19", "xfe-URL-lodash.com-stix2-2.1-export.json", "https://www.ascio.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://www.google-analytics.com/gtm/optimize.js?id=OPT-NVZ8RF3", "https://www.googletagmanager.com/gtag/js?id=G-8M7FT2S1TV&l=dataLayer&cx=c" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4203, "hostname": 1221, "domain": 2558, "FileHash-SHA256": 622, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "1449 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "622ccdabfe5537a5a8cc71e1", "name": "assorted xyz sites for researching.", "description": "", "modified": "2022-05-13T14:11:33.609000", "created": "2022-03-12T16:43:23.872000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "mokomoko1", "id": "45776", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_45776/resized/80/avatar_c26be60cfd.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1128, "hostname": 1061, "FileHash-SHA256": 24, "domain": 1983, "email": 2 }, "indicator_count": 4198, "is_author": false, "is_subscribing": null, "subscriber_count": 351, "modified_text": "1480 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62498485afc3d6ebba050b8b", "name": "www.virgilio. various Malacious tld's", "description": "", "modified": "2022-05-03T00:01:26.398000", "created": "2022-04-03T11:27:01.556000", "tags": [ "virgillo" ], "references": [ "https://hybrid-analysis.com/sample/c914c5cc1371bbc7d2285bbbeec77a94a0d1586c73d3a3f95b48766f1452cca8/6248c9f1f90df91459524ac8" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 336, "domain": 177, "URL": 818, "FileHash-SHA256": 238, "CVE": 1, "FileHash-MD5": 79, "FileHash-SHA1": 47, "email": 6 }, "indicator_count": 1702, "is_author": false, "is_subscribing": null, "subscriber_count": 398, "modified_text": "1491 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://static.zdassets.com/ekr/snippet.js?key=d814ea4a-a8eb-4a9c-aedd-cac0aa0e3551", "https://hybrid-analysis.com/sample/c914c5cc1371bbc7d2285bbbeec77a94a0d1586c73d3a3f95b48766f1452cca8/6248c9f1f90df91459524ac8", "https://rtb.da.us.criteo.com/google/auction/notify?profile=14&payload=UPmfDtqCMOgCgAXiIp0XAgAAAPYoFff2TiA6EJ2IymBKkkrxCNowD06JjQAS&wp=YMqInQAE53wKZIjPAA9S9H1IbXvGlF_g6pMG-Q", "device-*******-*****-****-****-*********.remotewd.com", "Premise liability covers premises, employees and premises visitors. Weaponizing is not covered.", "\u2026lie about the severity of injuries and do crap like this.", "https://cullenbehavioralhealth.theraplatform.com/ \u2022 amghealthnetwork.com", "https://www.ascio.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834", "Those attacked are the severely injured, survivors of dead workers, victims of providers.", "\"OC47TWOY.txt\" has type \"ASCII text\"- [targetUID: N/A] \"spyglass-w_1_.png\" has type \"Unknown\"- [targetUID: N/A]", "http://cdn.lineate-33x.net/static/vpaid/vpaid.98dc0711.js?viewable_impression_url=https://lbs-event.gcp.lineate-33x.net/view?event=AAAAAB7wpEhwdgACAq1WS2xcVxmee8cej0dJIVkgVmjkBWrRnPF5P9pFcCPURiZpEocGsbHO0771vLgzdppUlSpL3VggFbOBLFAViU1WyCuwWHkFkUAoy7AiG5C7qbxC3oT_zkxQG7Hkyrpzzq_v_o_v_85_3Prt5dajy60bRDIplMAacyUNI0KoTSq55jKZEFnaZEQKxjVBIeGAeMQOmYAVwoxEil1yIsZNxqwvh-Px5dtFf7T5__X57X_99Xc_a7T__Y9__v1vq9-7UAXYK-I963rx9kUiTJdS0mW0S_BPyuvDB0WvZ1dFF7dfv1sMwvDeuH3jTpvgLn6rDQbJ32p_KPkb7bXRqBfvRrdeTFYFU10m26-vv3vn-g877", "https://pagead2.googlesyndication.com/pagead/ads?ltd_cs=1&client=ca-pub-6165363645315831&output=html&adk=1812271804&adf=3025194257&lmt=1713778114&plat=3%3A16%2C4%3A16%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fschroederdennis.de%2Fubiquiti%2Fubiquiti-unifi-u6-plus-vs-u6-lite-vergleich-access-point-wifi%2F&pra=5&wgl=1&easpi=0&asro=0&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyNC4wLjYzNjcuNjAiLG51bGwsMCx", "https://secure.gravatar.com/avatar/6121f5a38f7526427becf34cc1e7bb2f?d=https://avatar-management--avatars.us-west-2.prod.public.atl-paas.net/default-avatar-2.png];https://5res.atlassian.net/secure/ViewProfile.jspa?accountId=6204fb88f38765006f673bf3;https://p4dx.s3.eu-west-3.amazonaws.com/Mcafee/mcafeech.html;https://p4dx.s3.eu-west-3.amazonaws.com/Mcafee/McAfee.jpg];https://p4dx.s3.eu-west-3.amazonaws.com/Mcafee/mcafeech.html;https://p4dx.s3.eu-west-3.amazonaws.com/Mcafee/mcafeech.html;https://p4dx.s3.eu-wes", "https://www.ascio.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c", "URL www.apache.org/licenses/LICENSE-2.0http://www.apache.org/licenses/LICENSE-2.0Open", "These people aren\u2019t in the dark. They are clear of the need to pay benefits.", "https://sap.dswd.gov.ph.index.ph \u2022 login.prod.siecm.gov.mg \u2022 nre-362.dev.nre.gss.gov.uk", "https://www.ascio.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19", "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd", "https://hybrid-analysis.com/sample/00f5292bbe68d9edc68f9a22a750eafb58e4f8474e15a48e3cc217fbbd0cdef9/690e24bb39c801e6d80a824e", "sdp-dev-ingest.ci.lineageandprovenance.gss.gov.uk", "https://tobiasahlin.com/js/portfolio.js", "https://portal.ascio.com/login", "http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL8-@", "URL https://cs.media.net/cksync?cs=1&type=ttd&ovsid=d0e0d23f-e88f-4ddb-868b-66da2a5995fc", "https://photoprism.thedipling.dns64.de/ \u2022 synertec-audit-cloud.healthchecks.prismcloud.uk", "There are absolute losers in the dole illegally benefiting from the suffering others.", "xfe-URL-lodash.com-stix2-2.1-export.json", "photoprism.thedipling.dns64.de \u2022 https://schroederdennis.de/wp-content/plugins/highlighting-code-block/assets/js/prism.js?ver=2.0.1", "https://urlscan.io/result/019a5fbd-e7c6-743a-b9a7-a20e8b2943cd/", "https://www.tiuli.com/tracks/21/%D7%9E%D7%92-%D7%A8%D7%A1%D7%94-%D7%91%D7%A7%D7%A2%D7%AA-%D7%91%D7%99%D7%AA-%D7%A6%D7%99%D7%93%D7%94", "g09925ed356e14431a1e64a663b9575c0939804b376704d96b75c2aea4245b05d.json", "https://hybrid-analysis.com/sample/de899c3feee092fe028bc50148544f31b8901675743fc0f97bfce327259dbee3/62c044d92ef9da07aa01321d", "xfe-URL-ascio.com-stix2-2.1-export.json", "https://tobiasahlin.com", "remote.tecbuddy.de | remote.schneider-hv.de | remotedesktop.thedipling", "http://d1biim3gqfg2c3.cloudfront.net/installer/2012861567342/10902508", "www.ventoxhealthcare.in \u2022 synertec-audit-cloud.healthchecks.prismcloud.uk", "https://www.googletagmanager.com/gtag/js?id=G-8M7FT2S1TV&l=dataLayer&cx=c", "Domain Name: schroederdennis.de | Status: connect", "http://www.xonitec.com/pornosu/yuotubesex.html", "https://tobiasahlin.com/js/app.js?v=1", "URL http://ert-banner.s3-website-eu-west-1.amazonaws.com/hu-banner.min.js", "\"spyglass-w_1_.png\" has type \"Unknown\" and extension \"png\" \"clock-g_1_.png\" has type \"Unknown\" and extension \"png\"", "http://direct.digitallanding.com/javascript/9.5.11.0/en-US/strings.js", "sonarr.app.pineapplegod.co.nz", "https://www.google-analytics.com/gtm/optimize.js?id=OPT-NVZ8RF3", "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0", "https://portal.ascio.com/7.602be6705ce7b901b821.js", "https://hybrid-analysis.com/sample/e7d74be84c0b7bd09a96d5932c79d9579a9b2426f8ab43896a77a4b8b11d289a/6430d038f2ba281e660c5ef6", "Domain healthcareshapers.com \u2022 https://www.healthcareshapers.com/", "Why Is this always a problem? Just curious. - http://wyblog.us/blog/rants/strikers-get-unemployment-benefits", "https://js.hs-scripts.com/20704235.js", "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png", "wwwwww.publicpublicwww.portal.apple-apple-number3.ipv64.net", "https://tobiasahlin.com/js/anime.min.js", "3ddruck-celle.de", "ai-sandboxes.com", "This money belongs to people who paid insurance to cover on job injuries that happen in the job.", "rowanandbenporn.ssssssssssssshadow.home64.de", "www-linuxbabe-com.webpkgcache.com", "root-dns.netcup", "$ is funneled back to government, (quasi) , bonused \u2018doctors\u2019 State \u2018experts\u2019 who\u2026", "https://cdn.pendo.io/agent/static/783a696b-ddf4-4152-439e-f3761f54f088/pendo.js", "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb", "https://www.ascio.com/wp-content/themes/Ascio/dist/js/front.js?ver=1648137806", "https://ascio.com", "https://www.ascio.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=17.0.1", "\u2022 http://demo.ideaboxthemes.com/prism", "http://svc.ghlink.com/svc/Authenticate/Applications", "https://portal.ascio.com/runtime.48adad1e07e2679eb1f4.js", "https://www.ascio.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9", "https://hybrid-analysis.com/sample/9a478e33d2a8fa58780b09519e3f9bbbc9a32595e67b7fead10a9ad4ec17a614/6430cb9896a0a8d5f1092b9d", "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36", "xfe-URL-tobiasahlin.com-stix2-2.1-export.json", "https://tobiasahlin.com/css/site.css" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Win.dropper.limerat-9776087-0", "Reduceright", "Win.packed.rrat-9798963-0", "Malware packed" ], "industries": [ "Government", "Technology", "Healthcare", "Legal" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 13, "pulses": [ { "id": "690e47a694d9bc5c12d83bc0", "name": "LimeRAT | Dark Room Dennis | SpyGlassPrism HealthCare", "description": "Invasive, dark , illegal. Malicious. Will sift through malware Spyware systems. Perpetual remote connections. Employed by Tam Legals Christopher P. Ahmann (Colorado government) to spy on, tamper with , annoy, terrorize, out of financial awards. \n\n spyglass-w_1_.png\n\nSize\n362B (362 bytes)\nMD5\n3c0e6546a44bd9a0f2768df07db5c1c9 Copy MD5 to clipboard\nSHA1\neddf26d1da4a140f2f963b8564c4e99cd6f1a677 Copy SHA1 to clipboard\nSHA256\n83eec393865a35363695d6f2416792d0117f551bb3e41d13b141d70e6b35e02c Copy SHA256 to clipboard", "modified": "2025-12-07T18:01:48.980000", "created": "2025-11-07T19:25:26.827000", "tags": [ "germany asn", "as24940 hetzner", "status connect", "associated", "present nov", "germany", "moved", "present oct", "accept", "germany unknown", "web trebuchet", "ms lucida", "grande lucida", "sans unicode", "lucida sans", "tahoma", "passive dns", "title", "error", "gmbh ccp", "germany germany", "asn as197540", "response ip", "address google", "safe browsing", "present jun", "present may", "present mar", "present jan", "urls", "aaaa", "gmt content", "type", "tags", "tag groups", "countries", "add country", "malware att", "ck it1140", "information", "cisco", "umbrella rank", "automatic", "webgl", "please", "november", "typeof function", "topropertykey", "masonry object", "prism function", "cookies", "source level", "reverse dns", "protocol h2", "security tls", "asn24940", "online gmbh", "general full", "url https", "falkenstein", "community forum", "it url", "youtube videos", "twitch kanal", "discord channel", "spenden", "shop url", "google", "hetzneras", "http", "april", "de summary", "ehingen", "march", "google safe", "browsing", "learn", "issues tab", "value", "masonry", "domainpath name", "cgjerrieegagfw", "label", "input", "suchen nach", "suche", "form", "hash", "name value", "main", "flag", "contacted hosts", "ip address", "process details", "windir", "openurl c", "prefetch2", "ck id", "name tactics", "suspicious", "informative", "adversaries", "command", "defense evasion", "spawns", "found", "a domains", "ascio", "china unknown", "record value", "apache", "encrypt", "dns resolutions", "domains top", "level", "unique tlds", "related pulses", "related tags", "certificate", "hostname add", "url analysis", "files", "domain", "files ip", "address", "asn as24940", "less", "raspberry pi", "ubiquiti", "remote", "hostname", "pulse submit", "status", "entries", "x xss", "sameorigin x", "unicode text", "utf8 text", "click", "strings", "mitre att", "ck matrix", "pattern match", "ascii text", "href", "show process", "network traffic", "general", "hybrid", "local", "path", "monitored target", "spyglass", "spyware.", "pegasus systems", "prism", "colorado leg", "christopher p.ahmann", "ahmann", "christopher", "P", "tam legal", "treece", "alfrey", "muscat", "criminal", "jeffrey reimer", "theft", "remote connect", "schroeder dennis" ], "references": [ "Domain Name: schroederdennis.de | Status: connect", "remote.tecbuddy.de | remote.schneider-hv.de | remotedesktop.thedipling", "root-dns.netcup", "device-*******-*****-****-****-*********.remotewd.com", "ai-sandboxes.com", "Why Is this always a problem? Just curious. - http://wyblog.us/blog/rants/strikers-get-unemployment-benefits", "$ is funneled back to government, (quasi) , bonused \u2018doctors\u2019 State \u2018experts\u2019 who\u2026", "\u2026lie about the severity of injuries and do crap like this.", "This money belongs to people who paid insurance to cover on job injuries that happen in the job.", "Premise liability covers premises, employees and premises visitors. Weaponizing is not covered.", "Those attacked are the severely injured, survivors of dead workers, victims of providers.", "These people aren\u2019t in the dark. They are clear of the need to pay benefits.", "There are absolute losers in the dole illegally benefiting from the suffering others.", "https://hybrid-analysis.com/sample/00f5292bbe68d9edc68f9a22a750eafb58e4f8474e15a48e3cc217fbbd0cdef9/690e24bb39c801e6d80a824e", "\u2022 http://demo.ideaboxthemes.com/prism", "https://photoprism.thedipling.dns64.de/ \u2022 synertec-audit-cloud.healthchecks.prismcloud.uk", "photoprism.thedipling.dns64.de \u2022 https://schroederdennis.de/wp-content/plugins/highlighting-code-block/assets/js/prism.js?ver=2.0.1", "\"OC47TWOY.txt\" has type \"ASCII text\"- [targetUID: N/A] \"spyglass-w_1_.png\" has type \"Unknown\"- [targetUID: N/A]", "\"spyglass-w_1_.png\" has type \"Unknown\" and extension \"png\" \"clock-g_1_.png\" has type \"Unknown\" and extension \"png\"", "Domain healthcareshapers.com \u2022 https://www.healthcareshapers.com/", "www.ventoxhealthcare.in \u2022 synertec-audit-cloud.healthchecks.prismcloud.uk", "https://cullenbehavioralhealth.theraplatform.com/ \u2022 amghealthnetwork.com", "3ddruck-celle.de", "wwwwww.publicpublicwww.portal.apple-apple-number3.ipv64.net", "sonarr.app.pineapplegod.co.nz", "http://svc.ghlink.com/svc/Authenticate/Applications", "https://sap.dswd.gov.ph.index.ph \u2022 login.prod.siecm.gov.mg \u2022 nre-362.dev.nre.gss.gov.uk", "sdp-dev-ingest.ci.lineageandprovenance.gss.gov.uk", "http://www.xonitec.com/pornosu/yuotubesex.html", "rowanandbenporn.ssssssssssssshadow.home64.de", "https://pagead2.googlesyndication.com/pagead/ads?ltd_cs=1&client=ca-pub-6165363645315831&output=html&adk=1812271804&adf=3025194257&lmt=1713778114&plat=3%3A16%2C4%3A16%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fschroederdennis.de%2Fubiquiti%2Fubiquiti-unifi-u6-plus-vs-u6-lite-vergleich-access-point-wifi%2F&pra=5&wgl=1&easpi=0&asro=0&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyNC4wLjYzNjcuNjAiLG51bGwsMCx", "https://urlscan.io/result/019a5fbd-e7c6-743a-b9a7-a20e8b2943cd/", "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win.Packed.Rrat-9798963-0", "display_name": "Win.Packed.Rrat-9798963-0", "target": null }, { "id": "Win.Dropper.LimeRAT-9776087-0", "display_name": "Win.Dropper.LimeRAT-9776087-0", "target": null }, { "id": "Malware Packed", "display_name": "Malware Packed", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" } ], "industries": [ "Healthcare", "Legal", "Government", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1258, "hostname": 2018, "URL": 3033, "FileHash-SHA256": 651, "email": 4, "FileHash-MD5": 62, "FileHash-SHA1": 69, "SSLCertFingerprint": 5 }, "indicator_count": 7100, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "176 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65709943cc506763d721edec", "name": ":v3 - and the rest.... - www.tiuli.com/image/a057f08d1d773ab75e116ba4fffc595f.jpg?width=1080'", "description": "", "modified": "2023-12-06T15:54:43.175000", "created": "2023-12-06T15:54:43.175000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 781, "domain": 712, "URL": 4962, "hostname": 1795, "email": 4, "FileHash-MD5": 164, "FileHash-SHA1": 159 }, "indicator_count": 8577, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570914fe73d6efb17198812", "name": "https://areyou1or0.com/ - just like a lucky dip", "description": "", "modified": "2023-12-06T15:20:47.515000", "created": "2023-12-06T15:20:47.515000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "hostname": 496, "FileHash-SHA256": 351, "FileHash-MD5": 56, "FileHash-SHA1": 50, "URL": 2028, "domain": 711, "email": 1 }, "indicator_count": 3695, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708e2d7cb4228401888b63", "name": "possibly a central bank", "description": "", "modified": "2023-12-06T15:07:25.990000", "created": "2023-12-06T15:07:25.990000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 622, "domain": 2558, "URL": 4203, "hostname": 1221, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708a8f3203633312147d1e", "name": "www.virgilio. various Malacious tld's", "description": "", "modified": "2023-12-06T14:51:59.166000", "created": "2023-12-06T14:51:59.166000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 238, "URL": 818, "domain": 177, "hostname": 336, "email": 6, "FileHash-MD5": 79, "FileHash-SHA1": 47 }, "indicator_count": 1702, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "657081811cbd9a5dca05bd3d", "name": "assorted xyz sites for researching.", "description": "", "modified": "2023-12-06T14:13:21.425000", "created": "2023-12-06T14:13:21.425000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1061, "URL": 1128, "FileHash-SHA256": 24, "domain": 1983, "email": 2 }, "indicator_count": 4198, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6430dfed2b3b3f93d5a7cc19", "name": ":v3 - and the rest.... - www.tiuli.com/image/a057f08d1d773ab75e116ba4fffc595f.jpg?width=1080'", "description": "", "modified": "2023-05-08T02:00:47.680000", "created": "2023-04-08T03:30:53.195000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "chromeua", "optout", "runtime data", "ansi", "pcap processing", "drmedgeua", "pcap", "pcap frame", "optin", "edgeua", "date", "suspicious", "hybrid", "close", "click", "hosts", "april", "general", "strings", "qakbot", "united", "https://www.tiuli.com/tracks/21/%D7%9E%D7%92-%D7%A8%D7%A1%D7%94-" ], "references": [ "https://hybrid-analysis.com/sample/9a478e33d2a8fa58780b09519e3f9bbbc9a32595e67b7fead10a9ad4ec17a614/6430cb9896a0a8d5f1092b9d", "https://hybrid-analysis.com/sample/e7d74be84c0b7bd09a96d5932c79d9579a9b2426f8ab43896a77a4b8b11d289a/6430d038f2ba281e660c5ef6", "http://cdn.lineate-33x.net/static/vpaid/vpaid.98dc0711.js?viewable_impression_url=https://lbs-event.gcp.lineate-33x.net/view?event=AAAAAB7wpEhwdgACAq1WS2xcVxmee8cej0dJIVkgVmjkBWrRnPF5P9pFcCPURiZpEocGsbHO0771vLgzdppUlSpL3VggFbOBLFAViU1WyCuwWHkFkUAoy7AiG5C7qbxC3oT_zkxQG7Hkyrpzzq_v_o_v_85_3Prt5dajy60bRDIplMAacyUNI0KoTSq55jKZEFnaZEQKxjVBIeGAeMQOmYAVwoxEil1yIsZNxqwvh-Px5dtFf7T5__X57X_99Xc_a7T__Y9__v1vq9-7UAXYK-I963rx9kUiTJdS0mW0S_BPyuvDB0WvZ1dFF7dfv1sMwvDeuH3jTpvgLn6rDQbJ32p_KPkb7bXRqBfvRrdeTFYFU10m26-vv3vn-g877", "https://www.tiuli.com/tracks/21/%D7%9E%D7%92-%D7%A8%D7%A1%D7%94-%D7%91%D7%A7%D7%A2%D7%AA-%D7%91%D7%99%D7%AA-%D7%A6%D7%99%D7%93%D7%94" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4962, "hostname": 1795, "FileHash-SHA256": 781, "domain": 712, "email": 4, "FileHash-MD5": 164, "FileHash-SHA1": 159 }, "indicator_count": 8577, "is_author": false, "is_subscribing": null, "subscriber_count": 94, "modified_text": "1121 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642eac06b2963a871b0fdd45", "name": "just a bunch of tv's - Oh maybe these tv channels are all neural \ud83e\udd37\u200d\u2640\ufe0f world tv stream infection", "description": "The Falcon Sandbox malware analysis service is available to download, download and use any of the Falcon MalQuery tools or information you may have seen on the website. \u00c2\u00a31.5m", "modified": "2023-05-06T10:00:48.707000", "created": "2023-04-06T11:24:54.313000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "dropped file", "runtime data", "chromeua", "span", "optout", "pcap processing", "pattern match", "script", "click", "date", "middle", "null", "april", "twitter", "body", "error", "jackson", "desktop", "service", "bill", "heat", "webview", "cruise", "blank", "meta", "night", "false", "contact", "suspicious", "facebook", "close", "cannon", "mayberry", "santana", "comment", "flex", "karma", "nightmare", "find", "spacer", "kitty", "mike", "local", "already", "soldier", "wallpaper", "story", "generic", "tiny", "trident", "android", "hybrid", "general", "hosts", "favorite", "homepage", "music", "code", "push", "strings", "malicious", "qakbot", "25px", "60px", "24px", "100px", "1439px", "segoe ui", "roboto", "path", "chat", "form", "embed", "unknown", "live", "network", "unicode", "feed", "5000", "next", "fullscreen", "iframe", "latv", "latino voices", "localappdata", "latino", "noscript", "pragma", "this", "hybrid analysis", "programfiles", "input", "wilstaging02", "potential ip" ], "references": [ "https://hybrid-analysis.com/sample/843923233cd86185dc3983fbe0fe3be72c6aeef0372db6c076287befc9d3fc5b/642d9d1695c2babbb70478eb", "https://hybrid-analysis.com/sample/52cd1ef12d9ec251dee2996f76150757f7247903d1cf86322569ed90536f59b3/642d9d5f20d5a59b1c0443fd", "https://hybrid-analysis.com/sample/ead272d3ccb36a5a827f80418096bfc30d1251bb739b06ff1711844d99d1b214/642d9de1e48d649afd01ad36", "https://hybrid-analysis.com/sample/3243e4a1f5a075f4d57121d5738d321dcd7e4c79bd96828442e351f660b60dc3/642d9d9c7cb35d938c068be9", "https://hybrid-analysis.com/sample/ea23092a5495e8990d050e61214866717374d79a9403232e37e271e327fe3a58/642db9b4ddc1df124a09bec0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1291, "email": 13, "domain": 591, "URL": 3931, "FileHash-SHA256": 431, "FileHash-MD5": 92, "FileHash-SHA1": 89 }, "indicator_count": 6438, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "1122 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62f578d9bd71fef18276273b", "name": "https://areyou1or0.com/ - just like a lucky dip", "description": "", "modified": "2022-09-10T00:03:24.542000", "created": "2022-08-11T21:47:05.669000", "tags": [ "https://areyou1or0.com/", "http://direct.digitallanding.com/javascript/9.5.11.0/en-US/strin" ], "references": [ "g09925ed356e14431a1e64a663b9575c0939804b376704d96b75c2aea4245b05d.json", "http://direct.digitallanding.com/javascript/9.5.11.0/en-US/strings.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2047, "FileHash-SHA256": 351, "hostname": 503, "domain": 724, "CVE": 2, "FileHash-MD5": 56, "FileHash-SHA1": 50, "email": 1 }, "indicator_count": 3734, "is_author": false, "is_subscribing": null, "subscriber_count": 395, "modified_text": "1361 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62c0f67de71e1a7105c84885", "name": "www.firstsportz.com", "description": "", "modified": "2022-08-02T00:03:03.164000", "created": "2022-07-03T01:53:01.448000", "tags": [ "timo" ], "references": [ "https://hybrid-analysis.com/sample/de899c3feee092fe028bc50148544f31b8901675743fc0f97bfce327259dbee3/62c044d92ef9da07aa01321d", "URL www.apache.org/licenses/LICENSE-2.0http://www.apache.org/licenses/LICENSE-2.0Open", "http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL8-@", "https://rtb.da.us.criteo.com/google/auction/notify?profile=14&payload=UPmfDtqCMOgCgAXiIp0XAgAAAPYoFff2TiA6EJ2IymBKkkrxCNowD06JjQAS&wp=YMqInQAE53wKZIjPAA9S9H1IbXvGlF_g6pMG-Q", "https://secure.gravatar.com/avatar/6121f5a38f7526427becf34cc1e7bb2f?d=https://avatar-management--avatars.us-west-2.prod.public.atl-paas.net/default-avatar-2.png];https://5res.atlassian.net/secure/ViewProfile.jspa?accountId=6204fb88f38765006f673bf3;https://p4dx.s3.eu-west-3.amazonaws.com/Mcafee/mcafeech.html;https://p4dx.s3.eu-west-3.amazonaws.com/Mcafee/McAfee.jpg];https://p4dx.s3.eu-west-3.amazonaws.com/Mcafee/mcafeech.html;https://p4dx.s3.eu-west-3.amazonaws.com/Mcafee/mcafeech.html;https://p4dx.s3.eu-wes", "URL http://ert-banner.s3-website-eu-west-1.amazonaws.com/hu-banner.min.js", "URL https://cs.media.net/cksync?cs=1&type=ttd&ovsid=d0e0d23f-e88f-4ddb-868b-66da2a5995fc", "http://d1biim3gqfg2c3.cloudfront.net/installer/2012861567342/10902508", "www-linuxbabe-com.webpkgcache.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 258, "URL": 462, "domain": 106, "FileHash-SHA256": 329, "FileHash-MD5": 73, "CVE": 1, "FileHash-SHA1": 52, "email": 2 }, "indicator_count": 1283, "is_author": false, "is_subscribing": null, "subscriber_count": 393, "modified_text": "1400 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "ascio.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "ascio.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780369638.0672665 }