{ "type": "Domain", "indicator": "bitminter.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/bitminter.com", "alexa": "http://www.alexa.com/siteinfo/bitminter.com", "indicator": "bitminter.com", "type": "domain", "type_title": "Domain", "validation": [ { "source": "mining", "message": "Whitelisted mining domain bitminter.com", "name": "Whitelisted mining domain" }, { "source": "whitelist", "message": "Whitelisted domain bitminter.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 204910440, "indicator": "bitminter.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 11, "pulses": [ { "id": "65eb9b88c811f35e060a2aa5", "name": "Emotet | YouTube \u2022 Darklivity Podcast \"Crimes of Tracey Richter\"", "description": "", "modified": "2024-08-14T06:01:01.267000", "created": "2024-03-08T23:13:12.950000", "tags": [ "communicating", "replacement", "unauthorized", "cyber attack", "emotet", "suspicious", "ransom", "Jays Youtube Bot.exe", "united", "unknown", "passive dns", "gmt server", "gmt etag", "accept encoding", "scan endpoints", "all octoseek", "ipv4", "pulse submit", "accept", "pragma", "injection", "downloader", "as44273 host", "search", "record value", "status", "nxdomain", "content type", "next", "body", "entries", "object", "com cnt", "dem fin", "gov int", "nav onl", "phy pre", "pur sta", "win32", "as15169 google", "aaaa", "domain", "pulse pulses", "urls", "contacted", "contacted urls", "whois whois", "pcname", "machinename", "execution", "bundled", "whois sneaky", "smokeloader", "amadey", "android", "youtube", "darklivity podcast", "tracey richter", "michael roberts", "server redirect", "hacking", "botnet", "application/binary", "jomax", "early, iowa", "hacker", "ruthless", "colorado", "pitman and or dentist hired roberts obvi", "song culture", "tsara brashears" ], "references": [ "www.youtube.com/watch?v=GyuMozsVyYs [Emotet] Songculture linked to Darklivity Podcast", "https://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2 [https://b.link/infringementhttps://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2]", "message.htm.com [Ransom | Malware Spreader]", "Ransom: FileHash-MD5 cece27e27fcad115504a2dc155358dae", "Ransom: FileHash-SHA1 90f739d446a6cab0a73086e56b1473e3c05ab752", "Ransom: FileHash-SHA256 c2f7df5c2fd585ba533fca2c2f1933bec36c4713ed5351a3656ddefee71c4cea", "Tracey Richter Roberts convicted murderer framed IMO] Michael Roberts suspect [self promoting hacker/PI]", "Jays Youtube Bot.exe: FileHash-SHA256 00514527e00ee001d042e5963b7c69f01060c4b4bc5064319c4af853a3d162c5 \u2022 303 status redirect to Bot server.", "host.secureserver.net \u2022 htm.com \u2022 rue.services \u2022 199.22.109.208.host.secureserver.net \u2022 n1s.18b.mywebsitetransfer.com \u2022 mywebsitetransfer.com", "godaddy.com \u2022 prod.phx3.secureserver.net", "Trojan.Win32.Snovir.kfmibf | FreeYTVDownloader.exe: FileHash-SHA256 3f5576bcd7bab6cf302bfaaa151f5807aac0b80ad01879662c01ca83ebf457ab", "Tea Conquer Bot.exe | FileHash-SHA256 00fc3c28ee517b91128d25c65eeddcd8dac2328447566e94732a3c92b71bfee5", "Amadey: FileHash-MD5 9a0b7ee713610b8395c8f0580a3b1e3d", "Amadey: FileHash-SHA1\te44a9e7ec6fe06ae6ba1b9518db78e95ad451942", "Amadey: FileHash-SHA256 6b8e428cff996c49aa52e017213c7016880a2bc1583d051240c74992bf83c357", "Amadey: IP 104.26.5.15", "CS IDS: ET INFO Android Device Connectivity Check [Low Risk] was executed.", "Attempted to send viewer to own server.", "How about stop harming people" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Trojan.Win32.Snovir.kfmibf", "display_name": "Trojan.Win32.Snovir.kfmibf", "target": null }, { "id": "AMADEY", "display_name": "AMADEY", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65ea64dbc3938c6472fd5e7b", "export_count": 48, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 121, "FileHash-SHA1": 120, "FileHash-SHA256": 1086, "URL": 391, "domain": 285, "hostname": 369, "email": 1 }, "indicator_count": 2373, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "656 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6675403ebdfc5bb1288b8b0b", "name": "Sakula RAT | Remote Attacks | Mirai | Piracy", "description": "", "modified": "2024-07-21T08:03:04.249000", "created": "2024-06-21T08:56:30.887000", "tags": [ "historical ssl", "remote", "high level", "hackers", "unknown win", "executable", "highly targeted", "cyber attack", "spotify artist", "sakula rat", "div div", "a div", "unknown", "united", "search", "nubile cowgirl", "mommy", "businessman", "slavegirl", "busty brunette", "date", "meta", "name servers", "status", "aaaa", "certificate", "cookie", "next", "log id", "gmtn", "go daddy", "authority", "tls web", "passive dns", "urls", "arizona", "scottsdale", "ca issuers", "false", "virgin islands", "as44273 host", "cname", "as19905", "creation date", "pulses", "trojan", "as22612", "react app", "verizon feed", "error", "typeof e", "body", "path", "info", "trace", "pulse submit", "url analysis", "files", "domain", "files ip", "external", "whois", "window", "as133618", "nxdomain", "coco", "elsa jean", "katrina jade", "amazing girls", "puffy nipples", "all scoreblue", "ipv4", "pulse pulses", "location virgin", "as133775 xiamen", "germany unknown", "florence co", "tsara brashears", "scan endpoints", "ip address", "ip related", "pulses otx", "redacted for", "for privacy", "dnssec", "as49870 alsycon", "as49305 map", "as24940 hetzner", "moved", "a domains", "encrypt", "showing", "expiration date", "as19527 google", "as397240", "get http", "read c", "write c", "et trojan", "dcom port", "possible", "host sinkhole", "write", "win32", "artemis", "malware", "nivdort", "zeus gameover", "copy", "xserver", "apple", "intellectual property theft", "dns replication", "type name", "replication", "domains", "ripe ncc", "ripe network", "whois lookups", "as49870 city", "abuse contact", "orgid", "mohammed zourob", "address", "orgabuseref", "mirai", "honeypot ips", "collection", "referrer", "mirai malware", "relacionada", "mirai 03042024", "bashlite", "sha256", "sha1", "windows nt", "pattern match", "et tor", "known tor", "relayrouter", "exit", "node traffic", "misc attack", "hybrid", "june", "local", "click", "strings", "contact", "as34788", "title", "body doctype", "html public", "ietfdtd html", "gmt server", "service", "apache", "targeting", "piracy" ], "references": [ "Sakula RAT - www.polarroute.com-CnC", "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html", "appleremotesupport.com", "Remote Attack x12 devices: device-local-2d1dedc1-a9a2-445b-8475-c2a24b9c1f58.remotewd.com", "Win32:Malware-gen : watchhers.net", "89.190.156.61: Backdoor:Linux/Mirai.AY!MTB | Backdoor:Linux/DemonBot.Aa!MTB | Unix.Trojan.Mirai-7100807-0 | Unix.Trojan.Tsunami-6981155-0", "Artemis!88755E38FB0B: http://static.123mediaplayer.com/Styles/Softwares/03652e13_aartemis.zip", "Nivdort: 130.255.191.101 | 192.232.223.67 | 192.64.119.172 | 208.113.243.145", "Bayrob: 173.236.19.82", "Win32:Malware-gen: message.htm.com", "Verizon Feed: https://api.aws.parking.godaddy.com | api.aws.parking.godaddy.com | https://api.aws.parking.godaddy.com/d/search/p/godaddy/xml/domain/multiset/v4/", "Tracking: track.123mediaplayer.com | track4you2me.com | mobiletrackersoft.com | www.tracking.getrobux.gg", "Malvertising: https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net | i3.cdn-image.com", "https://esvid.net/video/la-escuelita-especial-de-halloween-tv-ana-emilia-mfYrv_yj7eM.html", "sex.com | xxgayporn.com | http://www.myporncdn.com/ | http://meyzo.com/porn/ww.xxxhorse.virlcom/3", "IDS Detections: ETPRO TROJAN Terse HTTP 1.0 Request Possible Nivdort | ETPRO TROJAN W32/Bayrob Attempted Checkin 2", "IDS Detections: ET TROJAN Possible Compromised Host Sinkhole Cookie Value Snkz | ET TROJAN Zeus GameOver Possible DGA NXDOMAIN Responses", "IDS Detections: ETPRO TROJAN Possible Tinba DGA NXDOMAIN Responses (net)", "https://otx.alienvault.com/indicator/file/2bf47000e3fd57a0a66f114378e27bc7119657ae0e9f692cfb6add41fdd25d43", "Mirai: http://adsbox.net/www/delivery/ajs.php?zoneid=19&cb=1313058492&charset=UTF-8&loc=http%3A//yorozuya.miraiserver.com/archives/20716", "Mirai: http://adsbox.net/www/delivery/ajs.php?zoneid=19&cb=93256626515&charset=utf-8&loc=http%3A//yorozuya.miraiserver.com/archives/10404&referer=http%3A//www.google.co.jp/url%3Fsa%3Dt%26rct%3Dj%26q%3D%26esrc%3Ds%26source%3Dweb%26cd%3D2%26ved%3D0ahUKEwiYv8vl6dHWAhUIf7wKHZD-CeUQFg No Expiration\t0\t URL https://adsbox.net/www/delivery/ajs.php?zoneid=19&cb=94867445544&charset=UTF-8&loc=https%3A//yorozuya.miraiserver.com/archives/21384&referer=http%3A//search.yahoo.co.jp/ No Expiration\t0\t URL https://www.adsbo", "https://www.hybrid-analysis.com/sample/c878607fd780c9bc0d2f66b0c23ee33961c58ad568f4a2f1fe46082185299017/667532fda77e8833a9099b6b" ], "public": 1, "adversary": "", "targeted_countries": [ "Netherlands", "Germany", "United States of America" ], "malware_families": [ { "id": "Sakula RAT", "display_name": "Sakula RAT", "target": null }, { "id": "a variant of Win32/Bayrob.BL", "display_name": "a variant of Win32/Bayrob.BL", "target": null }, { "id": "Win32:Malware-gen", "display_name": "Win32:Malware-gen", "target": null }, { "id": "Trojan.Bayrob!gen9", "display_name": "Trojan.Bayrob!gen9", "target": null }, { "id": "Trojan", "display_name": "Trojan", "target": null }, { "id": "HEUR:Trojan.Win32.Generic", "display_name": "HEUR:Trojan.Win32.Generic", "target": null }, { "id": "Mal/Bayrob-C ,", "display_name": "Mal/Bayrob-C ,", "target": null }, { "id": "DownLoader24.56470", "display_name": "DownLoader24.56470", "target": null }, { "id": "Trojan/Win32.Nivdort.C1321145", "display_name": "Trojan/Win32.Nivdort.C1321145", "target": null }, { "id": "Backdoor:Linux/Mirai.AY!MTB", "display_name": "Backdoor:Linux/Mirai.AY!MTB", "target": "/malware/Backdoor:Linux/Mirai.AY!MTB" }, { "id": "Unix.Trojan.Tsunami-6981155-0", "display_name": "Unix.Trojan.Tsunami-6981155-0", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6903, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1390, "FileHash-MD5": 97, "FileHash-SHA1": 91, "FileHash-SHA256": 1341, "URL": 3993, "domain": 1903, "email": 11, "SSLCertFingerprint": 4, "CIDR": 2 }, "indicator_count": 8832, "is_author": false, "is_subscribing": null, "subscriber_count": 233, "modified_text": "680 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65e843669f4ba77affa4b297", "name": "Emotet | YouTube \u2022 Darklivity Podcast \"Unhinged Horror\"", "description": "303 Error redirect target to desired service. | Likely using infected, updated apple Product. | Jays Youtube Bot.exe found. | Target saw episode subject, was suspicious due to 'diabolical women' connection promoted by Rexxfield[.] com (Tracey Richters ex-husband). I believe she was framed as is target I have come across. YouTube accounts are only told from the perspective of 2 ex-husbands, 1 doctor, 1 hacker and dentist[assaulter] who abused power. This trap makes targets look crazy, non credible leaving them traumatized. Attorneys or law enforcement likely overwhelmed, wild stories. I often consider truth is can be much stranger than fiction. Fiction often loosely based on truth.", "modified": "2024-04-05T09:00:01.502000", "created": "2024-03-06T10:20:22.440000", "tags": [ "communicating", "replacement", "unauthorized", "cyber attack", "emotet", "suspicious", "ransom", "Jays Youtube Bot.exe", "united", "unknown", "passive dns", "gmt server", "gmt etag", "accept encoding", "scan endpoints", "all octoseek", "ipv4", "pulse submit", "accept", "pragma", "injection", "downloader", "as44273 host", "search", "record value", "status", "nxdomain", "content type", "next", "body", "entries", "object", "com cnt", "dem fin", "gov int", "nav onl", "phy pre", "pur sta", "win32", "as15169 google", "aaaa", "domain", "pulse pulses", "urls", "contacted", "contacted urls", "whois whois", "pcname", "machinename", "execution", "bundled", "whois sneaky", "smokeloader", "amadey", "android", "youtube", "darklivity podcast", "tracey richter", "michael roberts", "server redirect", "hacking", "botnet", "application/binary", "jomax", "early, iowa", "hacker", "ruthless", "colorado", "pitman and or dentist hired roberts obvi", "song culture", "tsara brashears" ], "references": [ "www.youtube.com/watch?v=GyuMozsVyYs [Emotet] Songculture linked to Darklivity Podcast", "https://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2 [https://b.link/infringementhttps://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2]", "message.htm.com [Ransom | Malware Spreader]", "Ransom: FileHash-MD5 cece27e27fcad115504a2dc155358dae", "Ransom: FileHash-SHA1 90f739d446a6cab0a73086e56b1473e3c05ab752", "Ransom: FileHash-SHA256 c2f7df5c2fd585ba533fca2c2f1933bec36c4713ed5351a3656ddefee71c4cea", "Tracey Richter Roberts convicted murderer framed IMO] Michael Roberts suspect [self promoting hacker/PI]", "Jays Youtube Bot.exe: FileHash-SHA256 00514527e00ee001d042e5963b7c69f01060c4b4bc5064319c4af853a3d162c5 \u2022 303 status redirect to Bot server.", "host.secureserver.net \u2022 htm.com \u2022 rue.services \u2022 199.22.109.208.host.secureserver.net \u2022 n1s.18b.mywebsitetransfer.com \u2022 mywebsitetransfer.com", "godaddy.com \u2022 prod.phx3.secureserver.net", "Trojan.Win32.Snovir.kfmibf | FreeYTVDownloader.exe: FileHash-SHA256 3f5576bcd7bab6cf302bfaaa151f5807aac0b80ad01879662c01ca83ebf457ab", "Tea Conquer Bot.exe | FileHash-SHA256 00fc3c28ee517b91128d25c65eeddcd8dac2328447566e94732a3c92b71bfee5", "Amadey: FileHash-MD5 9a0b7ee713610b8395c8f0580a3b1e3d", "Amadey: FileHash-SHA1\te44a9e7ec6fe06ae6ba1b9518db78e95ad451942", "Amadey: FileHash-SHA256 6b8e428cff996c49aa52e017213c7016880a2bc1583d051240c74992bf83c357", "Amadey: IP 104.26.5.15", "CS IDS: ET INFO Android Device Connectivity Check [Low Risk] was executed.", "Attempted to send viewer to own server.", "How about stop harming people" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Trojan.Win32.Snovir.kfmibf", "display_name": "Trojan.Win32.Snovir.kfmibf", "target": null }, { "id": "AMADEY", "display_name": "AMADEY", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 52, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 115, "FileHash-SHA1": 114, "FileHash-SHA256": 952, "URL": 285, "domain": 257, "hostname": 285, "email": 1 }, "indicator_count": 2009, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "787 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65ea64dbc3938c6472fd5e7b", "name": "Emotet | YouTube \u2022 Darklivity Podcast \"Unhinged Horror\" Crimes of Tracey Richter", "description": "", "modified": "2024-04-05T09:00:01.502000", "created": "2024-03-08T01:07:39.514000", "tags": [ "communicating", "replacement", "unauthorized", "cyber attack", "emotet", "suspicious", "ransom", "Jays Youtube Bot.exe", "united", "unknown", "passive dns", "gmt server", "gmt etag", "accept encoding", "scan endpoints", "all octoseek", "ipv4", "pulse submit", "accept", "pragma", "injection", "downloader", "as44273 host", "search", "record value", "status", "nxdomain", "content type", "next", "body", "entries", "object", "com cnt", "dem fin", "gov int", "nav onl", "phy pre", "pur sta", "win32", "as15169 google", "aaaa", "domain", "pulse pulses", "urls", "contacted", "contacted urls", "whois whois", "pcname", "machinename", "execution", "bundled", "whois sneaky", "smokeloader", "amadey", "android", "youtube", "darklivity podcast", "tracey richter", "michael roberts", "server redirect", "hacking", "botnet", "application/binary", "jomax", "early, iowa", "hacker", "ruthless", "colorado", "pitman and or dentist hired roberts obvi", "song culture", "tsara brashears" ], "references": [ "www.youtube.com/watch?v=GyuMozsVyYs [Emotet] Songculture linked to Darklivity Podcast", "https://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2 [https://b.link/infringementhttps://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2]", "message.htm.com [Ransom | Malware Spreader]", "Ransom: FileHash-MD5 cece27e27fcad115504a2dc155358dae", "Ransom: FileHash-SHA1 90f739d446a6cab0a73086e56b1473e3c05ab752", "Ransom: FileHash-SHA256 c2f7df5c2fd585ba533fca2c2f1933bec36c4713ed5351a3656ddefee71c4cea", "Tracey Richter Roberts convicted murderer framed IMO] Michael Roberts suspect [self promoting hacker/PI]", "Jays Youtube Bot.exe: FileHash-SHA256 00514527e00ee001d042e5963b7c69f01060c4b4bc5064319c4af853a3d162c5 \u2022 303 status redirect to Bot server.", "host.secureserver.net \u2022 htm.com \u2022 rue.services \u2022 199.22.109.208.host.secureserver.net \u2022 n1s.18b.mywebsitetransfer.com \u2022 mywebsitetransfer.com", "godaddy.com \u2022 prod.phx3.secureserver.net", "Trojan.Win32.Snovir.kfmibf | FreeYTVDownloader.exe: FileHash-SHA256 3f5576bcd7bab6cf302bfaaa151f5807aac0b80ad01879662c01ca83ebf457ab", "Tea Conquer Bot.exe | FileHash-SHA256 00fc3c28ee517b91128d25c65eeddcd8dac2328447566e94732a3c92b71bfee5", "Amadey: FileHash-MD5 9a0b7ee713610b8395c8f0580a3b1e3d", "Amadey: FileHash-SHA1\te44a9e7ec6fe06ae6ba1b9518db78e95ad451942", "Amadey: FileHash-SHA256 6b8e428cff996c49aa52e017213c7016880a2bc1583d051240c74992bf83c357", "Amadey: IP 104.26.5.15", "CS IDS: ET INFO Android Device Connectivity Check [Low Risk] was executed.", "Attempted to send viewer to own server.", "How about stop harming people" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Trojan.Win32.Snovir.kfmibf", "display_name": "Trojan.Win32.Snovir.kfmibf", "target": null }, { "id": "AMADEY", "display_name": "AMADEY", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65e843669f4ba77affa4b297", "export_count": 48, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 115, "FileHash-SHA1": 114, "FileHash-SHA256": 952, "URL": 285, "domain": 257, "hostname": 285, "email": 1 }, "indicator_count": 2009, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "787 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d34c8a64436a7aee2e25a1", "name": "Locky: File Deletion targeting incriminating archived files.", "description": "redhatdelete.com : Adversaries are deleting files in bulk from Virustotal, otx AlienVault, WebArchive, Perma.cc Urlscan.io, Archive.Today, Archive.ph, iCloud, apple data, photo deletion.\nVarious ransomware used. iOS service modified, cloud encrypted by adversary. Indicator point to a target with a zombie device. An iPhone and potentially other devices were targeted in a specific attack. | Locky Ransomware is a piece of malware that encrypts important files on your device, rendering them inaccessible and unusable.", "modified": "2024-03-20T12:00:39.809000", "created": "2024-02-19T12:41:46.707000", "tags": [ "it consultant", "uk collection", "dns intel", "ips collection", "suspicous ip", "whois file", "cname", "record type", "ttl value", "algorithm", "v3 serial", "number", "cus cnr3", "olet", "subject public", "key info", "key algorithm", "key identifier", "whois lookup", "region create", "domain", "name server", "registrant name", "technical city", "region update", "united", "command decode", "mitre att", "suricata ipv4", "windows nt", "win64", "khtml", "gecko", "ck id", "cookie", "meta", "february", "hybrid", "general", "click", "strings", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "dns replication", "code", "namecheap", "registrar abuse", "namecheap inc", "privacy service", "withheld", "privacy", "dnssec", "email", "first", "bodis", "unknown", "creation date", "search", "emails", "as397240", "date", "next", "all octoseek", "threat roundup", "january", "june", "historical ssl", "referrer", "contacted", "group", "execution", "phishing", "malware", "core", "malicious", "dark power", "play ransomware", "pe32", "intel", "ms windows", "win32 dynamic", "link library", "win16 ne", "icons library", "os2 executable", "pe32 linker", "gnu linker", "compiler", "info header", "name md5", "overlay", "passive dns", "entries", "ipv4", "pulse pulses", "urls", "files", "trojan", "location united", "query", "activity dns", "observed dns", "msie", "high", "copy", "write", "win32", "hashes", "host interaction", "sabey type", "hallrender", "brian sabey", "memory pattern", "http requests", "http method", "get response", "dns resolutions", "ip traffic", "domains", "mutex", "samplepath", "created", "shell commands", "r processes", "tree", "analyze", "hostnames", "url https", "samples", "hostname", "pattern urls", "memory", "pattern", "pattern domains", "roundup", "formbook", "mirai", "ben c", "injection", "server", "scan endpoints", "show", "august", "bq feb", "chrome", "precondition", "virtool", "downloadmr", "body", "status", "servers", "record value", "name servers", "showing", "mailrubar", "trojanclicker", "slcc2", "media center", "delete c", "malware beacon", "suspicious", "class", "internal", "local", "encrypt", "as15169 google", "gmt cache", "twitter", "rostpay", "date hash", "avast avg", "mtb may", "susp", "cryp", "win32upatre may", "mtb showing", "lowfi", "aaaa", "win32pcmega jan", "urlshortner dec", "urlshortner sep", "as133618", "nxdomain", "as133775 xiamen", "germany unknown", "webtoolbar", "nanocore rat", "gamehack", "cobalt strike", "whois record", "ssl certificate", "tsara brashears", "resolutions", "critical risk", "apple phone", "unlocker", "shell code", "installer", "ursnif", "hacktool", "emotet", "tracker", "chaos", "ransomexx", "xor ddos", "xorddos", "mitre attack", "parent domain", "urls url", "siblings", "metro", "communicating", "collection", "dropped", "skynet", "youth", "com laude", "ltd dba", "utc submissions", "submitters", "cloudflarenet", "akamaias", "digitaloceanasn", "csc corporate", "pt mora", "univjos", "etisalat misr", "acurix networks", "pty ltd", "beijing baidu", "highly targeted", "http", "network hijacks", "redline stealer", "whois sslcert", "contacted urls", "whois whois", "september", "hidden cobra", "threats", "kimsuky", "service", "read c", "create c", "write c", "regsetvalueexa", "mozilla", "capture", "asnone", "domain http", "request", "malware dns", "lookup wannacry", "default", "ransom", "push", "playgame", "command", "email document", "exploit domain", "owner exploit", "kit exploit", "source file", "hacking tools", "hunting macro", "malware hosting", "memory scanning", "yara detections", "debug", "icmp traffic", "pdb path", "pe section", "low software", "packing t1045", "ransomware", "egregor", "find", "false", "psexec", "powershell", "qakbot", "qbot", "icedid" ], "references": [ "redhatdelete.com", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "target": null }, { "id": "Rostpay", "display_name": "Rostpay", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Mitre Attack", "display_name": "Mitre Attack", "target": null }, { "id": "Chaos (ELF)", "display_name": "Chaos (ELF)", "target": null }, { "id": "TrojanDropper:Win32/GameHack", "display_name": "TrojanDropper:Win32/GameHack", "target": "/malware/TrojanDropper:Win32/GameHack" }, { "id": "Win.Ransomware.Locky-7766366-0", "display_name": "Win.Ransomware.Locky-7766366-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt.A!rsm", "display_name": "Ransom:Win32/WannaCrypt.A!rsm", "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm" }, { "id": "ALF:E5.SpikeAex.rhh_pid", "display_name": "ALF:E5.SpikeAex.rhh_pid", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 65, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1848, "FileHash-SHA1": 1783, "FileHash-SHA256": 7170, "domain": 1649, "hostname": 1191, "email": 9, "URL": 729, "CVE": 2, "SSLCertFingerprint": 2, "CIDR": 1 }, "indicator_count": 14384, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "803 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d34c91868744aa1449fef2", "name": "Locky: File Deletion targeting incriminating archived files.", "description": "redhatdelete.com : Adversaries are deleting files in bulk from Virustotal, otx AlienVault, WebArchive, Perma.cc Urlscan.io, Archive.Today, Archive.ph, iCloud, apple data, photo deletion.\nVarious ransomware used. iOS service modified, cloud encrypted by adversary. Indicator point to a target with a zombie device. An iPhone and potentially other devices were targeted in a specific attack. | Locky Ransomware is a piece of malware that encrypts important files on your device, rendering them inaccessible and unusable.", "modified": "2024-03-20T12:00:39.809000", "created": "2024-02-19T12:41:52.846000", "tags": [ "it consultant", "uk collection", "dns intel", "ips collection", "suspicous ip", "whois file", "cname", "record type", "ttl value", "algorithm", "v3 serial", "number", "cus cnr3", "olet", "subject public", "key info", "key algorithm", "key identifier", "whois lookup", "region create", "domain", "name server", "registrant name", "technical city", "region update", "united", "command decode", "mitre att", "suricata ipv4", "windows nt", "win64", "khtml", "gecko", "ck id", "cookie", "meta", "february", "hybrid", "general", "click", "strings", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "dns replication", "code", "namecheap", "registrar abuse", "namecheap inc", "privacy service", "withheld", "privacy", "dnssec", "email", "first", "bodis", "unknown", "creation date", "search", "emails", "as397240", "date", "next", "all octoseek", "threat roundup", "january", "june", "historical ssl", "referrer", "contacted", "group", "execution", "phishing", "malware", "core", "malicious", "dark power", "play ransomware", "pe32", "intel", "ms windows", "win32 dynamic", "link library", "win16 ne", "icons library", "os2 executable", "pe32 linker", "gnu linker", "compiler", "info header", "name md5", "overlay", "passive dns", "entries", "ipv4", "pulse pulses", "urls", "files", "trojan", "location united", "query", "activity dns", "observed dns", "msie", "high", "copy", "write", "win32", "hashes", "host interaction", "sabey type", "hallrender", "brian sabey", "memory pattern", "http requests", "http method", "get response", "dns resolutions", "ip traffic", "domains", "mutex", "samplepath", "created", "shell commands", "r processes", "tree", "analyze", "hostnames", "url https", "samples", "hostname", "pattern urls", "memory", "pattern", "pattern domains", "roundup", "formbook", "mirai", "ben c", "injection", "server", "scan endpoints", "show", "august", "bq feb", "chrome", "precondition", "virtool", "downloadmr", "body", "status", "servers", "record value", "name servers", "showing", "mailrubar", "trojanclicker", "slcc2", "media center", "delete c", "malware beacon", "suspicious", "class", "internal", "local", "encrypt", "as15169 google", "gmt cache", "twitter", "rostpay", "date hash", "avast avg", "mtb may", "susp", "cryp", "win32upatre may", "mtb showing", "lowfi", "aaaa", "win32pcmega jan", "urlshortner dec", "urlshortner sep", "as133618", "nxdomain", "as133775 xiamen", "germany unknown", "webtoolbar", "nanocore rat", "gamehack", "cobalt strike", "whois record", "ssl certificate", "tsara brashears", "resolutions", "critical risk", "apple phone", "unlocker", "shell code", "installer", "ursnif", "hacktool", "emotet", "tracker", "chaos", "ransomexx", "xor ddos", "xorddos", "mitre attack", "parent domain", "urls url", "siblings", "metro", "communicating", "collection", "dropped", "skynet", "youth", "com laude", "ltd dba", "utc submissions", "submitters", "cloudflarenet", "akamaias", "digitaloceanasn", "csc corporate", "pt mora", "univjos", "etisalat misr", "acurix networks", "pty ltd", "beijing baidu", "highly targeted", "http", "network hijacks", "redline stealer", "whois sslcert", "contacted urls", "whois whois", "september", "hidden cobra", "threats", "kimsuky", "service", "read c", "create c", "write c", "regsetvalueexa", "mozilla", "capture", "asnone", "domain http", "request", "malware dns", "lookup wannacry", "default", "ransom", "push", "playgame", "command", "email document", "exploit domain", "owner exploit", "kit exploit", "source file", "hacking tools", "hunting macro", "malware hosting", "memory scanning", "yara detections", "debug", "icmp traffic", "pdb path", "pe section", "low software", "packing t1045", "ransomware", "egregor", "find", "false", "psexec", "powershell", "qakbot", "qbot", "icedid" ], "references": [ "redhatdelete.com", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "target": null }, { "id": "Rostpay", "display_name": "Rostpay", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Mitre Attack", "display_name": "Mitre Attack", "target": null }, { "id": "Chaos (ELF)", "display_name": "Chaos (ELF)", "target": null }, { "id": "TrojanDropper:Win32/GameHack", "display_name": "TrojanDropper:Win32/GameHack", "target": "/malware/TrojanDropper:Win32/GameHack" }, { "id": "Win.Ransomware.Locky-7766366-0", "display_name": "Win.Ransomware.Locky-7766366-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt.A!rsm", "display_name": "Ransom:Win32/WannaCrypt.A!rsm", "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm" }, { "id": "ALF:E5.SpikeAex.rhh_pid", "display_name": "ALF:E5.SpikeAex.rhh_pid", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 57, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1848, "FileHash-SHA1": 1783, "FileHash-SHA256": 7170, "domain": 1649, "hostname": 1191, "email": 9, "URL": 729, "CVE": 2, "SSLCertFingerprint": 2, "CIDR": 1 }, "indicator_count": 14384, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "803 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d3acf32e1088e76165a307", "name": "Locky: File Deletion targeting incriminating archived files.", "description": "", "modified": "2024-03-20T12:00:39.809000", "created": "2024-02-19T19:33:07.504000", "tags": [ "it consultant", "uk collection", "dns intel", "ips collection", "suspicous ip", "whois file", "cname", "record type", "ttl value", "algorithm", "v3 serial", "number", "cus cnr3", "olet", "subject public", "key info", "key algorithm", "key identifier", "whois lookup", "region create", "domain", "name server", "registrant name", "technical city", "region update", "united", "command decode", "mitre att", "suricata ipv4", "windows nt", "win64", "khtml", "gecko", "ck id", "cookie", "meta", "february", "hybrid", "general", "click", "strings", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "dns replication", "code", "namecheap", "registrar abuse", "namecheap inc", "privacy service", "withheld", "privacy", "dnssec", "email", "first", "bodis", "unknown", "creation date", "search", "emails", "as397240", "date", "next", "all octoseek", "threat roundup", "january", "june", "historical ssl", "referrer", "contacted", "group", "execution", "phishing", "malware", "core", "malicious", "dark power", "play ransomware", "pe32", "intel", "ms windows", "win32 dynamic", "link library", "win16 ne", "icons library", "os2 executable", "pe32 linker", "gnu linker", "compiler", "info header", "name md5", "overlay", "passive dns", "entries", "ipv4", "pulse pulses", "urls", "files", "trojan", "location united", "query", "activity dns", "observed dns", "msie", "high", "copy", "write", "win32", "hashes", "host interaction", "sabey type", "hallrender", "brian sabey", "memory pattern", "http requests", "http method", "get response", "dns resolutions", "ip traffic", "domains", "mutex", "samplepath", "created", "shell commands", "r processes", "tree", "analyze", "hostnames", "url https", "samples", "hostname", "pattern urls", "memory", "pattern", "pattern domains", "roundup", "formbook", "mirai", "ben c", "injection", "server", "scan endpoints", "show", "august", "bq feb", "chrome", "precondition", "virtool", "downloadmr", "body", "status", "servers", "record value", "name servers", "showing", "mailrubar", "trojanclicker", "slcc2", "media center", "delete c", "malware beacon", "suspicious", "class", "internal", "local", "encrypt", "as15169 google", "gmt cache", "twitter", "rostpay", "date hash", "avast avg", "mtb may", "susp", "cryp", "win32upatre may", "mtb showing", "lowfi", "aaaa", "win32pcmega jan", "urlshortner dec", "urlshortner sep", "as133618", "nxdomain", "as133775 xiamen", "germany unknown", "webtoolbar", "nanocore rat", "gamehack", "cobalt strike", "whois record", "ssl certificate", "tsara brashears", "resolutions", "critical risk", "apple phone", "unlocker", "shell code", "installer", "ursnif", "hacktool", "emotet", "tracker", "chaos", "ransomexx", "xor ddos", "xorddos", "mitre attack", "parent domain", "urls url", "siblings", "metro", "communicating", "collection", "dropped", "skynet", "youth", "com laude", "ltd dba", "utc submissions", "submitters", "cloudflarenet", "akamaias", "digitaloceanasn", "csc corporate", "pt mora", "univjos", "etisalat misr", "acurix networks", "pty ltd", "beijing baidu", "highly targeted", "http", "network hijacks", "redline stealer", "whois sslcert", "contacted urls", "whois whois", "september", "hidden cobra", "threats", "kimsuky", "service", "read c", "create c", "write c", "regsetvalueexa", "mozilla", "capture", "asnone", "domain http", "request", "malware dns", "lookup wannacry", "default", "ransom", "push", "playgame", "command", "email document", "exploit domain", "owner exploit", "kit exploit", "source file", "hacking tools", "hunting macro", "malware hosting", "memory scanning", "yara detections", "debug", "icmp traffic", "pdb path", "pe section", "low software", "packing t1045", "ransomware", "egregor", "find", "false", "psexec", "powershell", "qakbot", "qbot", "icedid" ], "references": [ "redhatdelete.com", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "target": null }, { "id": "Rostpay", "display_name": "Rostpay", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Mitre Attack", "display_name": "Mitre Attack", "target": null }, { "id": "Chaos (ELF)", "display_name": "Chaos (ELF)", "target": null }, { "id": "TrojanDropper:Win32/GameHack", "display_name": "TrojanDropper:Win32/GameHack", "target": "/malware/TrojanDropper:Win32/GameHack" }, { "id": "Win.Ransomware.Locky-7766366-0", "display_name": "Win.Ransomware.Locky-7766366-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt.A!rsm", "display_name": "Ransom:Win32/WannaCrypt.A!rsm", "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm" }, { "id": "ALF:E5.SpikeAex.rhh_pid", "display_name": "ALF:E5.SpikeAex.rhh_pid", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": "65d34c91868744aa1449fef2", "export_count": 64, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1848, "FileHash-SHA1": 1783, "FileHash-SHA256": 7170, "domain": 1649, "hostname": 1191, "email": 9, "URL": 729, "CVE": 2, "SSLCertFingerprint": 2, "CIDR": 1 }, "indicator_count": 14384, "is_author": false, "is_subscribing": null, "subscriber_count": 234, "modified_text": "803 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d3c31230455f6d8da3a9f0", "name": "Locky: File Deletion targeting incriminating archived files II", "description": "", "modified": "2024-03-20T12:00:39.809000", "created": "2024-02-19T21:07:30.887000", "tags": [ "it consultant", "uk collection", "dns intel", "ips collection", "suspicous ip", "whois file", "cname", "record type", "ttl value", "algorithm", "v3 serial", "number", "cus cnr3", "olet", "subject public", "key info", "key algorithm", "key identifier", "whois lookup", "region create", "domain", "name server", "registrant name", "technical city", "region update", "united", "command decode", "mitre att", "suricata ipv4", "windows nt", "win64", "khtml", "gecko", "ck id", "cookie", "meta", "february", "hybrid", "general", "click", "strings", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "dns replication", "code", "namecheap", "registrar abuse", "namecheap inc", "privacy service", "withheld", "privacy", "dnssec", "email", "first", "bodis", "unknown", "creation date", "search", "emails", "as397240", "date", "next", "all octoseek", "threat roundup", "january", "june", "historical ssl", "referrer", "contacted", "group", "execution", "phishing", "malware", "core", "malicious", "dark power", "play ransomware", "pe32", "intel", "ms windows", "win32 dynamic", "link library", "win16 ne", "icons library", "os2 executable", "pe32 linker", "gnu linker", "compiler", "info header", "name md5", "overlay", "passive dns", "entries", "ipv4", "pulse pulses", "urls", "files", "trojan", "location united", "query", "activity dns", "observed dns", "msie", "high", "copy", "write", "win32", "hashes", "host interaction", "sabey type", "hallrender", "brian sabey", "memory pattern", "http requests", "http method", "get response", "dns resolutions", "ip traffic", "domains", "mutex", "samplepath", "created", "shell commands", "r processes", "tree", "analyze", "hostnames", "url https", "samples", "hostname", "pattern urls", "memory", "pattern", "pattern domains", "roundup", "formbook", "mirai", "ben c", "injection", "server", "scan endpoints", "show", "august", "bq feb", "chrome", "precondition", "virtool", "downloadmr", "body", "status", "servers", "record value", "name servers", "showing", "mailrubar", "trojanclicker", "slcc2", "media center", "delete c", "malware beacon", "suspicious", "class", "internal", "local", "encrypt", "as15169 google", "gmt cache", "twitter", "rostpay", "date hash", "avast avg", "mtb may", "susp", "cryp", "win32upatre may", "mtb showing", "lowfi", "aaaa", "win32pcmega jan", "urlshortner dec", "urlshortner sep", "as133618", "nxdomain", "as133775 xiamen", "germany unknown", "webtoolbar", "nanocore rat", "gamehack", "cobalt strike", "whois record", "ssl certificate", "tsara brashears", "resolutions", "critical risk", "apple phone", "unlocker", "shell code", "installer", "ursnif", "hacktool", "emotet", "tracker", "chaos", "ransomexx", "xor ddos", "xorddos", "mitre attack", "parent domain", "urls url", "siblings", "metro", "communicating", "collection", "dropped", "skynet", "youth", "com laude", "ltd dba", "utc submissions", "submitters", "cloudflarenet", "akamaias", "digitaloceanasn", "csc corporate", "pt mora", "univjos", "etisalat misr", "acurix networks", "pty ltd", "beijing baidu", "highly targeted", "http", "network hijacks", "redline stealer", "whois sslcert", "contacted urls", "whois whois", "september", "hidden cobra", "threats", "kimsuky", "service", "read c", "create c", "write c", "regsetvalueexa", "mozilla", "capture", "asnone", "domain http", "request", "malware dns", "lookup wannacry", "default", "ransom", "push", "playgame", "command", "email document", "exploit domain", "owner exploit", "kit exploit", "source file", "hacking tools", "hunting macro", "malware hosting", "memory scanning", "yara detections", "debug", "icmp traffic", "pdb path", "pe section", "low software", "packing t1045", "ransomware", "egregor", "find", "false", "psexec", "powershell", "qakbot", "qbot", "icedid" ], "references": [ "redhatdelete.com", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "target": null }, { "id": "Rostpay", "display_name": "Rostpay", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Mitre Attack", "display_name": "Mitre Attack", "target": null }, { "id": "Chaos (ELF)", "display_name": "Chaos (ELF)", "target": null }, { "id": "TrojanDropper:Win32/GameHack", "display_name": "TrojanDropper:Win32/GameHack", "target": "/malware/TrojanDropper:Win32/GameHack" }, { "id": "Win.Ransomware.Locky-7766366-0", "display_name": "Win.Ransomware.Locky-7766366-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt.A!rsm", "display_name": "Ransom:Win32/WannaCrypt.A!rsm", "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm" }, { "id": "ALF:E5.SpikeAex.rhh_pid", "display_name": "ALF:E5.SpikeAex.rhh_pid", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": "65d34c8a64436a7aee2e25a1", "export_count": 73, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Enqrypted", "id": "272105", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1848, "FileHash-SHA1": 1783, "FileHash-SHA256": 7170, "domain": 1649, "hostname": 1191, "email": 9, "URL": 729, "CVE": 2, "SSLCertFingerprint": 2, "CIDR": 1 }, "indicator_count": 14384, "is_author": false, "is_subscribing": null, "subscriber_count": 62, "modified_text": "803 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "5f491bcb154bd506b5421d5b", "name": "Crypto Mining Pool Hostnames", "description": "", "modified": "2022-11-09T21:17:55.513000", "created": "2020-08-28T14:59:23.972000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 389, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "threatmanager", "id": "74623", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 271091, "domain": 5085 }, "indicator_count": 276176, "is_author": false, "is_subscribing": null, "subscriber_count": 606, "modified_text": "1299 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62414b06ce63f02c018ae8a8", "name": "Mining Domains", "description": "", "modified": "2022-03-28T05:43:34.853000", "created": "2022-03-28T05:43:34.853000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "5f491bcb154bd506b5421d5b", "export_count": 45, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZMJ20160625", "id": "178377", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 261544, "domain": 4964 }, "indicator_count": 266508, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "1526 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62414b012a9a928552c680a0", "name": "Mining Domains", "description": "", "modified": "2022-03-28T05:43:29.938000", "created": "2022-03-28T05:43:29.938000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "5f491bcb154bd506b5421d5b", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZMJ20160625", "id": "178377", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 261544, "domain": 4964 }, "indicator_count": 266508, "is_author": false, "is_subscribing": null, "subscriber_count": 37, "modified_text": "1526 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "Tea Conquer Bot.exe | FileHash-SHA256 00fc3c28ee517b91128d25c65eeddcd8dac2328447566e94732a3c92b71bfee5", "Amadey: IP 104.26.5.15", "https://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2 [https://b.link/infringementhttps://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2]", "Amadey: FileHash-SHA256 6b8e428cff996c49aa52e017213c7016880a2bc1583d051240c74992bf83c357", "message.htm.com [Ransom | Malware Spreader]", "Jays Youtube Bot.exe: FileHash-SHA256 00514527e00ee001d042e5963b7c69f01060c4b4bc5064319c4af853a3d162c5 \u2022 303 status redirect to Bot server.", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "IDS Detections: ET TROJAN Possible Compromised Host Sinkhole Cookie Value Snkz | ET TROJAN Zeus GameOver Possible DGA NXDOMAIN Responses", "Sakula RAT - www.polarroute.com-CnC", "Win32:Malware-gen: message.htm.com", "Mirai: http://adsbox.net/www/delivery/ajs.php?zoneid=19&cb=93256626515&charset=utf-8&loc=http%3A//yorozuya.miraiserver.com/archives/10404&referer=http%3A//www.google.co.jp/url%3Fsa%3Dt%26rct%3Dj%26q%3D%26esrc%3Ds%26source%3Dweb%26cd%3D2%26ved%3D0ahUKEwiYv8vl6dHWAhUIf7wKHZD-CeUQFg No Expiration\t0\t URL https://adsbox.net/www/delivery/ajs.php?zoneid=19&cb=94867445544&charset=UTF-8&loc=https%3A//yorozuya.miraiserver.com/archives/21384&referer=http%3A//search.yahoo.co.jp/ No Expiration\t0\t URL https://www.adsbo", "Attempted to send viewer to own server.", "Remote Attack x12 devices: device-local-2d1dedc1-a9a2-445b-8475-c2a24b9c1f58.remotewd.com", "Ransom: FileHash-SHA1 90f739d446a6cab0a73086e56b1473e3c05ab752", "Amadey: FileHash-MD5 9a0b7ee713610b8395c8f0580a3b1e3d", "https://otx.alienvault.com/indicator/file/2bf47000e3fd57a0a66f114378e27bc7119657ae0e9f692cfb6add41fdd25d43", "Bayrob: 173.236.19.82", "Ransom: FileHash-MD5 cece27e27fcad115504a2dc155358dae", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "appleremotesupport.com", "godaddy.com \u2022 prod.phx3.secureserver.net", "IDS Detections: ETPRO TROJAN Terse HTTP 1.0 Request Possible Nivdort | ETPRO TROJAN W32/Bayrob Attempted Checkin 2", "https://www.hybrid-analysis.com/sample/c878607fd780c9bc0d2f66b0c23ee33961c58ad568f4a2f1fe46082185299017/667532fda77e8833a9099b6b", "Ransom: FileHash-SHA256 c2f7df5c2fd585ba533fca2c2f1933bec36c4713ed5351a3656ddefee71c4cea", "Win32:Malware-gen : watchhers.net", "Malvertising: https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net | i3.cdn-image.com", "Trojan.Win32.Snovir.kfmibf | FreeYTVDownloader.exe: FileHash-SHA256 3f5576bcd7bab6cf302bfaaa151f5807aac0b80ad01879662c01ca83ebf457ab", "Verizon Feed: https://api.aws.parking.godaddy.com | api.aws.parking.godaddy.com | https://api.aws.parking.godaddy.com/d/search/p/godaddy/xml/domain/multiset/v4/", "Nivdort: 130.255.191.101 | 192.232.223.67 | 192.64.119.172 | 208.113.243.145", "Artemis!88755E38FB0B: http://static.123mediaplayer.com/Styles/Softwares/03652e13_aartemis.zip", "How about stop harming people", "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695", "sex.com | xxgayporn.com | http://www.myporncdn.com/ | http://meyzo.com/porn/ww.xxxhorse.virlcom/3", "CS IDS: ET INFO Android Device Connectivity Check [Low Risk] was executed.", "https://esvid.net/video/la-escuelita-especial-de-halloween-tv-ana-emilia-mfYrv_yj7eM.html", "IDS Detections: ETPRO TROJAN Possible Tinba DGA NXDOMAIN Responses (net)", "Tracey Richter Roberts convicted murderer framed IMO] Michael Roberts suspect [self promoting hacker/PI]", "redhatdelete.com", "Mirai: http://adsbox.net/www/delivery/ajs.php?zoneid=19&cb=1313058492&charset=UTF-8&loc=http%3A//yorozuya.miraiserver.com/archives/20716", "host.secureserver.net \u2022 htm.com \u2022 rue.services \u2022 199.22.109.208.host.secureserver.net \u2022 n1s.18b.mywebsitetransfer.com \u2022 mywebsitetransfer.com", "Tracking: track.123mediaplayer.com | track4you2me.com | mobiletrackersoft.com | www.tracking.getrobux.gg", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "89.190.156.61: Backdoor:Linux/Mirai.AY!MTB | Backdoor:Linux/DemonBot.Aa!MTB | Unix.Trojan.Mirai-7100807-0 | Unix.Trojan.Tsunami-6981155-0", "www.youtube.com/watch?v=GyuMozsVyYs [Emotet] Songculture linked to Darklivity Podcast", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "Amadey: FileHash-SHA1\te44a9e7ec6fe06ae6ba1b9518db78e95ad451942" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Trojan.win32.snovir.kfmibf", "Backdoor:linux/mirai.ay!mtb", "Trojan.bayrob!gen9", "#lowfienabledtcontinueafterunpacking", "Win32:malware-gen", "Downloader24.56470", "Trojan", "Mirai", "Alf:e5.spikeaex.rhh_pid", "Win.ransomware.locky-7766366-0", "Chaos (elf)", "Mitre attack", "Sakula rat", "Trojan/win32.nivdort.c1321145", "Unix.trojan.tsunami-6981155-0", "Rostpay", "Ransom:win32/wannacrypt.a!rsm", "Trojan-ransom.win32.blocker.jgb checkin", "Virtool", "Heur:trojan.win32.generic", "Mal/bayrob-c ,", "Amadey", "A variant of win32/bayrob.bl", "Emotet", "Trojandropper:win32/gamehack" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 11, "pulses": [ { "id": "65eb9b88c811f35e060a2aa5", "name": "Emotet | YouTube \u2022 Darklivity Podcast \"Crimes of Tracey Richter\"", "description": "", "modified": "2024-08-14T06:01:01.267000", "created": "2024-03-08T23:13:12.950000", "tags": [ "communicating", "replacement", "unauthorized", "cyber attack", "emotet", "suspicious", "ransom", "Jays Youtube Bot.exe", "united", "unknown", "passive dns", "gmt server", "gmt etag", "accept encoding", "scan endpoints", "all octoseek", "ipv4", "pulse submit", "accept", "pragma", "injection", "downloader", "as44273 host", "search", "record value", "status", "nxdomain", "content type", "next", "body", "entries", "object", "com cnt", "dem fin", "gov int", "nav onl", "phy pre", "pur sta", "win32", "as15169 google", "aaaa", "domain", "pulse pulses", "urls", "contacted", "contacted urls", "whois whois", "pcname", "machinename", "execution", "bundled", "whois sneaky", "smokeloader", "amadey", "android", "youtube", "darklivity podcast", "tracey richter", "michael roberts", "server redirect", "hacking", "botnet", "application/binary", "jomax", "early, iowa", "hacker", "ruthless", "colorado", "pitman and or dentist hired roberts obvi", "song culture", "tsara brashears" ], "references": [ "www.youtube.com/watch?v=GyuMozsVyYs [Emotet] Songculture linked to Darklivity Podcast", "https://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2 [https://b.link/infringementhttps://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2]", "message.htm.com [Ransom | Malware Spreader]", "Ransom: FileHash-MD5 cece27e27fcad115504a2dc155358dae", "Ransom: FileHash-SHA1 90f739d446a6cab0a73086e56b1473e3c05ab752", "Ransom: FileHash-SHA256 c2f7df5c2fd585ba533fca2c2f1933bec36c4713ed5351a3656ddefee71c4cea", "Tracey Richter Roberts convicted murderer framed IMO] Michael Roberts suspect [self promoting hacker/PI]", "Jays Youtube Bot.exe: FileHash-SHA256 00514527e00ee001d042e5963b7c69f01060c4b4bc5064319c4af853a3d162c5 \u2022 303 status redirect to Bot server.", "host.secureserver.net \u2022 htm.com \u2022 rue.services \u2022 199.22.109.208.host.secureserver.net \u2022 n1s.18b.mywebsitetransfer.com \u2022 mywebsitetransfer.com", "godaddy.com \u2022 prod.phx3.secureserver.net", "Trojan.Win32.Snovir.kfmibf | FreeYTVDownloader.exe: FileHash-SHA256 3f5576bcd7bab6cf302bfaaa151f5807aac0b80ad01879662c01ca83ebf457ab", "Tea Conquer Bot.exe | FileHash-SHA256 00fc3c28ee517b91128d25c65eeddcd8dac2328447566e94732a3c92b71bfee5", "Amadey: FileHash-MD5 9a0b7ee713610b8395c8f0580a3b1e3d", "Amadey: FileHash-SHA1\te44a9e7ec6fe06ae6ba1b9518db78e95ad451942", "Amadey: FileHash-SHA256 6b8e428cff996c49aa52e017213c7016880a2bc1583d051240c74992bf83c357", "Amadey: IP 104.26.5.15", "CS IDS: ET INFO Android Device Connectivity Check [Low Risk] was executed.", "Attempted to send viewer to own server.", "How about stop harming people" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Trojan.Win32.Snovir.kfmibf", "display_name": "Trojan.Win32.Snovir.kfmibf", "target": null }, { "id": "AMADEY", "display_name": "AMADEY", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65ea64dbc3938c6472fd5e7b", "export_count": 48, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 121, "FileHash-SHA1": 120, "FileHash-SHA256": 1086, "URL": 391, "domain": 285, "hostname": 369, "email": 1 }, "indicator_count": 2373, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "656 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6675403ebdfc5bb1288b8b0b", "name": "Sakula RAT | Remote Attacks | Mirai | Piracy", "description": "", "modified": "2024-07-21T08:03:04.249000", "created": "2024-06-21T08:56:30.887000", "tags": [ "historical ssl", "remote", "high level", "hackers", "unknown win", "executable", "highly targeted", "cyber attack", "spotify artist", "sakula rat", "div div", "a div", "unknown", "united", "search", "nubile cowgirl", "mommy", "businessman", "slavegirl", "busty brunette", "date", "meta", "name servers", "status", "aaaa", "certificate", "cookie", "next", "log id", "gmtn", "go daddy", "authority", "tls web", "passive dns", "urls", "arizona", "scottsdale", "ca issuers", "false", "virgin islands", "as44273 host", "cname", "as19905", "creation date", "pulses", "trojan", "as22612", "react app", "verizon feed", "error", "typeof e", "body", "path", "info", "trace", "pulse submit", "url analysis", "files", "domain", "files ip", "external", "whois", "window", "as133618", "nxdomain", "coco", "elsa jean", "katrina jade", "amazing girls", "puffy nipples", "all scoreblue", "ipv4", "pulse pulses", "location virgin", "as133775 xiamen", "germany unknown", "florence co", "tsara brashears", "scan endpoints", "ip address", "ip related", "pulses otx", "redacted for", "for privacy", "dnssec", "as49870 alsycon", "as49305 map", "as24940 hetzner", "moved", "a domains", "encrypt", "showing", "expiration date", "as19527 google", "as397240", "get http", "read c", "write c", "et trojan", "dcom port", "possible", "host sinkhole", "write", "win32", "artemis", "malware", "nivdort", "zeus gameover", "copy", "xserver", "apple", "intellectual property theft", "dns replication", "type name", "replication", "domains", "ripe ncc", "ripe network", "whois lookups", "as49870 city", "abuse contact", "orgid", "mohammed zourob", "address", "orgabuseref", "mirai", "honeypot ips", "collection", "referrer", "mirai malware", "relacionada", "mirai 03042024", "bashlite", "sha256", "sha1", "windows nt", "pattern match", "et tor", "known tor", "relayrouter", "exit", "node traffic", "misc attack", "hybrid", "june", "local", "click", "strings", "contact", "as34788", "title", "body doctype", "html public", "ietfdtd html", "gmt server", "service", "apache", "targeting", "piracy" ], "references": [ "Sakula RAT - www.polarroute.com-CnC", "http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html", "appleremotesupport.com", "Remote Attack x12 devices: device-local-2d1dedc1-a9a2-445b-8475-c2a24b9c1f58.remotewd.com", "Win32:Malware-gen : watchhers.net", "89.190.156.61: Backdoor:Linux/Mirai.AY!MTB | Backdoor:Linux/DemonBot.Aa!MTB | Unix.Trojan.Mirai-7100807-0 | Unix.Trojan.Tsunami-6981155-0", "Artemis!88755E38FB0B: http://static.123mediaplayer.com/Styles/Softwares/03652e13_aartemis.zip", "Nivdort: 130.255.191.101 | 192.232.223.67 | 192.64.119.172 | 208.113.243.145", "Bayrob: 173.236.19.82", "Win32:Malware-gen: message.htm.com", "Verizon Feed: https://api.aws.parking.godaddy.com | api.aws.parking.godaddy.com | https://api.aws.parking.godaddy.com/d/search/p/godaddy/xml/domain/multiset/v4/", "Tracking: track.123mediaplayer.com | track4you2me.com | mobiletrackersoft.com | www.tracking.getrobux.gg", "Malvertising: https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net | i3.cdn-image.com", "https://esvid.net/video/la-escuelita-especial-de-halloween-tv-ana-emilia-mfYrv_yj7eM.html", "sex.com | xxgayporn.com | http://www.myporncdn.com/ | http://meyzo.com/porn/ww.xxxhorse.virlcom/3", "IDS Detections: ETPRO TROJAN Terse HTTP 1.0 Request Possible Nivdort | ETPRO TROJAN W32/Bayrob Attempted Checkin 2", "IDS Detections: ET TROJAN Possible Compromised Host Sinkhole Cookie Value Snkz | ET TROJAN Zeus GameOver Possible DGA NXDOMAIN Responses", "IDS Detections: ETPRO TROJAN Possible Tinba DGA NXDOMAIN Responses (net)", "https://otx.alienvault.com/indicator/file/2bf47000e3fd57a0a66f114378e27bc7119657ae0e9f692cfb6add41fdd25d43", "Mirai: http://adsbox.net/www/delivery/ajs.php?zoneid=19&cb=1313058492&charset=UTF-8&loc=http%3A//yorozuya.miraiserver.com/archives/20716", "Mirai: http://adsbox.net/www/delivery/ajs.php?zoneid=19&cb=93256626515&charset=utf-8&loc=http%3A//yorozuya.miraiserver.com/archives/10404&referer=http%3A//www.google.co.jp/url%3Fsa%3Dt%26rct%3Dj%26q%3D%26esrc%3Ds%26source%3Dweb%26cd%3D2%26ved%3D0ahUKEwiYv8vl6dHWAhUIf7wKHZD-CeUQFg No Expiration\t0\t URL https://adsbox.net/www/delivery/ajs.php?zoneid=19&cb=94867445544&charset=UTF-8&loc=https%3A//yorozuya.miraiserver.com/archives/21384&referer=http%3A//search.yahoo.co.jp/ No Expiration\t0\t URL https://www.adsbo", "https://www.hybrid-analysis.com/sample/c878607fd780c9bc0d2f66b0c23ee33961c58ad568f4a2f1fe46082185299017/667532fda77e8833a9099b6b" ], "public": 1, "adversary": "", "targeted_countries": [ "Netherlands", "Germany", "United States of America" ], "malware_families": [ { "id": "Sakula RAT", "display_name": "Sakula RAT", "target": null }, { "id": "a variant of Win32/Bayrob.BL", "display_name": "a variant of Win32/Bayrob.BL", "target": null }, { "id": "Win32:Malware-gen", "display_name": "Win32:Malware-gen", "target": null }, { "id": "Trojan.Bayrob!gen9", "display_name": "Trojan.Bayrob!gen9", "target": null }, { "id": "Trojan", "display_name": "Trojan", "target": null }, { "id": "HEUR:Trojan.Win32.Generic", "display_name": "HEUR:Trojan.Win32.Generic", "target": null }, { "id": "Mal/Bayrob-C ,", "display_name": "Mal/Bayrob-C ,", "target": null }, { "id": "DownLoader24.56470", "display_name": "DownLoader24.56470", "target": null }, { "id": "Trojan/Win32.Nivdort.C1321145", "display_name": "Trojan/Win32.Nivdort.C1321145", "target": null }, { "id": "Backdoor:Linux/Mirai.AY!MTB", "display_name": "Backdoor:Linux/Mirai.AY!MTB", "target": "/malware/Backdoor:Linux/Mirai.AY!MTB" }, { "id": "Unix.Trojan.Tsunami-6981155-0", "display_name": "Unix.Trojan.Tsunami-6981155-0", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6903, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1390, "FileHash-MD5": 97, "FileHash-SHA1": 91, "FileHash-SHA256": 1341, "URL": 3993, "domain": 1903, "email": 11, "SSLCertFingerprint": 4, "CIDR": 2 }, "indicator_count": 8832, "is_author": false, "is_subscribing": null, "subscriber_count": 233, "modified_text": "680 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65e843669f4ba77affa4b297", "name": "Emotet | YouTube \u2022 Darklivity Podcast \"Unhinged Horror\"", "description": "303 Error redirect target to desired service. | Likely using infected, updated apple Product. | Jays Youtube Bot.exe found. | Target saw episode subject, was suspicious due to 'diabolical women' connection promoted by Rexxfield[.] com (Tracey Richters ex-husband). I believe she was framed as is target I have come across. YouTube accounts are only told from the perspective of 2 ex-husbands, 1 doctor, 1 hacker and dentist[assaulter] who abused power. This trap makes targets look crazy, non credible leaving them traumatized. Attorneys or law enforcement likely overwhelmed, wild stories. I often consider truth is can be much stranger than fiction. Fiction often loosely based on truth.", "modified": "2024-04-05T09:00:01.502000", "created": "2024-03-06T10:20:22.440000", "tags": [ "communicating", "replacement", "unauthorized", "cyber attack", "emotet", "suspicious", "ransom", "Jays Youtube Bot.exe", "united", "unknown", "passive dns", "gmt server", "gmt etag", "accept encoding", "scan endpoints", "all octoseek", "ipv4", "pulse submit", "accept", "pragma", "injection", "downloader", "as44273 host", "search", "record value", "status", "nxdomain", "content type", "next", "body", "entries", "object", "com cnt", "dem fin", "gov int", "nav onl", "phy pre", "pur sta", "win32", "as15169 google", "aaaa", "domain", "pulse pulses", "urls", "contacted", "contacted urls", "whois whois", "pcname", "machinename", "execution", "bundled", "whois sneaky", "smokeloader", "amadey", "android", "youtube", "darklivity podcast", "tracey richter", "michael roberts", "server redirect", "hacking", "botnet", "application/binary", "jomax", "early, iowa", "hacker", "ruthless", "colorado", "pitman and or dentist hired roberts obvi", "song culture", "tsara brashears" ], "references": [ "www.youtube.com/watch?v=GyuMozsVyYs [Emotet] Songculture linked to Darklivity Podcast", "https://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2 [https://b.link/infringementhttps://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2]", "message.htm.com [Ransom | Malware Spreader]", "Ransom: FileHash-MD5 cece27e27fcad115504a2dc155358dae", "Ransom: FileHash-SHA1 90f739d446a6cab0a73086e56b1473e3c05ab752", "Ransom: FileHash-SHA256 c2f7df5c2fd585ba533fca2c2f1933bec36c4713ed5351a3656ddefee71c4cea", "Tracey Richter Roberts convicted murderer framed IMO] Michael Roberts suspect [self promoting hacker/PI]", "Jays Youtube Bot.exe: FileHash-SHA256 00514527e00ee001d042e5963b7c69f01060c4b4bc5064319c4af853a3d162c5 \u2022 303 status redirect to Bot server.", "host.secureserver.net \u2022 htm.com \u2022 rue.services \u2022 199.22.109.208.host.secureserver.net \u2022 n1s.18b.mywebsitetransfer.com \u2022 mywebsitetransfer.com", "godaddy.com \u2022 prod.phx3.secureserver.net", "Trojan.Win32.Snovir.kfmibf | FreeYTVDownloader.exe: FileHash-SHA256 3f5576bcd7bab6cf302bfaaa151f5807aac0b80ad01879662c01ca83ebf457ab", "Tea Conquer Bot.exe | FileHash-SHA256 00fc3c28ee517b91128d25c65eeddcd8dac2328447566e94732a3c92b71bfee5", "Amadey: FileHash-MD5 9a0b7ee713610b8395c8f0580a3b1e3d", "Amadey: FileHash-SHA1\te44a9e7ec6fe06ae6ba1b9518db78e95ad451942", "Amadey: FileHash-SHA256 6b8e428cff996c49aa52e017213c7016880a2bc1583d051240c74992bf83c357", "Amadey: IP 104.26.5.15", "CS IDS: ET INFO Android Device Connectivity Check [Low Risk] was executed.", "Attempted to send viewer to own server.", "How about stop harming people" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Trojan.Win32.Snovir.kfmibf", "display_name": "Trojan.Win32.Snovir.kfmibf", "target": null }, { "id": "AMADEY", "display_name": "AMADEY", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 52, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 115, "FileHash-SHA1": 114, "FileHash-SHA256": 952, "URL": 285, "domain": 257, "hostname": 285, "email": 1 }, "indicator_count": 2009, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "787 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65ea64dbc3938c6472fd5e7b", "name": "Emotet | YouTube \u2022 Darklivity Podcast \"Unhinged Horror\" Crimes of Tracey Richter", "description": "", "modified": "2024-04-05T09:00:01.502000", "created": "2024-03-08T01:07:39.514000", "tags": [ "communicating", "replacement", "unauthorized", "cyber attack", "emotet", "suspicious", "ransom", "Jays Youtube Bot.exe", "united", "unknown", "passive dns", "gmt server", "gmt etag", "accept encoding", "scan endpoints", "all octoseek", "ipv4", "pulse submit", "accept", "pragma", "injection", "downloader", "as44273 host", "search", "record value", "status", "nxdomain", "content type", "next", "body", "entries", "object", "com cnt", "dem fin", "gov int", "nav onl", "phy pre", "pur sta", "win32", "as15169 google", "aaaa", "domain", "pulse pulses", "urls", "contacted", "contacted urls", "whois whois", "pcname", "machinename", "execution", "bundled", "whois sneaky", "smokeloader", "amadey", "android", "youtube", "darklivity podcast", "tracey richter", "michael roberts", "server redirect", "hacking", "botnet", "application/binary", "jomax", "early, iowa", "hacker", "ruthless", "colorado", "pitman and or dentist hired roberts obvi", "song culture", "tsara brashears" ], "references": [ "www.youtube.com/watch?v=GyuMozsVyYs [Emotet] Songculture linked to Darklivity Podcast", "https://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2 [https://b.link/infringementhttps://www.youtube.com/watch?v=ucEkWcFuH0Y&list=TLPQMDgwNjIwMjKO_xApd0GzPQ&index=2]", "message.htm.com [Ransom | Malware Spreader]", "Ransom: FileHash-MD5 cece27e27fcad115504a2dc155358dae", "Ransom: FileHash-SHA1 90f739d446a6cab0a73086e56b1473e3c05ab752", "Ransom: FileHash-SHA256 c2f7df5c2fd585ba533fca2c2f1933bec36c4713ed5351a3656ddefee71c4cea", "Tracey Richter Roberts convicted murderer framed IMO] Michael Roberts suspect [self promoting hacker/PI]", "Jays Youtube Bot.exe: FileHash-SHA256 00514527e00ee001d042e5963b7c69f01060c4b4bc5064319c4af853a3d162c5 \u2022 303 status redirect to Bot server.", "host.secureserver.net \u2022 htm.com \u2022 rue.services \u2022 199.22.109.208.host.secureserver.net \u2022 n1s.18b.mywebsitetransfer.com \u2022 mywebsitetransfer.com", "godaddy.com \u2022 prod.phx3.secureserver.net", "Trojan.Win32.Snovir.kfmibf | FreeYTVDownloader.exe: FileHash-SHA256 3f5576bcd7bab6cf302bfaaa151f5807aac0b80ad01879662c01ca83ebf457ab", "Tea Conquer Bot.exe | FileHash-SHA256 00fc3c28ee517b91128d25c65eeddcd8dac2328447566e94732a3c92b71bfee5", "Amadey: FileHash-MD5 9a0b7ee713610b8395c8f0580a3b1e3d", "Amadey: FileHash-SHA1\te44a9e7ec6fe06ae6ba1b9518db78e95ad451942", "Amadey: FileHash-SHA256 6b8e428cff996c49aa52e017213c7016880a2bc1583d051240c74992bf83c357", "Amadey: IP 104.26.5.15", "CS IDS: ET INFO Android Device Connectivity Check [Low Risk] was executed.", "Attempted to send viewer to own server.", "How about stop harming people" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Trojan.Win32.Snovir.kfmibf", "display_name": "Trojan.Win32.Snovir.kfmibf", "target": null }, { "id": "AMADEY", "display_name": "AMADEY", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65e843669f4ba77affa4b297", "export_count": 48, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 115, "FileHash-SHA1": 114, "FileHash-SHA256": 952, "URL": 285, "domain": 257, "hostname": 285, "email": 1 }, "indicator_count": 2009, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "787 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d34c8a64436a7aee2e25a1", "name": "Locky: File Deletion targeting incriminating archived files.", "description": "redhatdelete.com : Adversaries are deleting files in bulk from Virustotal, otx AlienVault, WebArchive, Perma.cc Urlscan.io, Archive.Today, Archive.ph, iCloud, apple data, photo deletion.\nVarious ransomware used. iOS service modified, cloud encrypted by adversary. Indicator point to a target with a zombie device. An iPhone and potentially other devices were targeted in a specific attack. | Locky Ransomware is a piece of malware that encrypts important files on your device, rendering them inaccessible and unusable.", "modified": "2024-03-20T12:00:39.809000", "created": "2024-02-19T12:41:46.707000", "tags": [ "it consultant", "uk collection", "dns intel", "ips collection", "suspicous ip", "whois file", "cname", "record type", "ttl value", "algorithm", "v3 serial", "number", "cus cnr3", "olet", "subject public", "key info", "key algorithm", "key identifier", "whois lookup", "region create", "domain", "name server", "registrant name", "technical city", "region update", "united", "command decode", "mitre att", "suricata ipv4", "windows nt", "win64", "khtml", "gecko", "ck id", "cookie", "meta", "february", "hybrid", "general", "click", "strings", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "dns replication", "code", "namecheap", "registrar abuse", "namecheap inc", "privacy service", "withheld", "privacy", "dnssec", "email", "first", "bodis", "unknown", "creation date", "search", "emails", "as397240", "date", "next", "all octoseek", "threat roundup", "january", "june", "historical ssl", "referrer", "contacted", "group", "execution", "phishing", "malware", "core", "malicious", "dark power", "play ransomware", "pe32", "intel", "ms windows", "win32 dynamic", "link library", "win16 ne", "icons library", "os2 executable", "pe32 linker", "gnu linker", "compiler", "info header", "name md5", "overlay", "passive dns", "entries", "ipv4", "pulse pulses", "urls", "files", "trojan", "location united", "query", "activity dns", "observed dns", "msie", "high", "copy", "write", "win32", "hashes", "host interaction", "sabey type", "hallrender", "brian sabey", "memory pattern", "http requests", "http method", "get response", "dns resolutions", "ip traffic", "domains", "mutex", "samplepath", "created", "shell commands", "r processes", "tree", "analyze", "hostnames", "url https", "samples", "hostname", "pattern urls", "memory", "pattern", "pattern domains", "roundup", "formbook", "mirai", "ben c", "injection", "server", "scan endpoints", "show", "august", "bq feb", "chrome", "precondition", "virtool", "downloadmr", "body", "status", "servers", "record value", "name servers", "showing", "mailrubar", "trojanclicker", "slcc2", "media center", "delete c", "malware beacon", "suspicious", "class", "internal", "local", "encrypt", "as15169 google", "gmt cache", "twitter", "rostpay", "date hash", "avast avg", "mtb may", "susp", "cryp", "win32upatre may", "mtb showing", "lowfi", "aaaa", "win32pcmega jan", "urlshortner dec", "urlshortner sep", "as133618", "nxdomain", "as133775 xiamen", "germany unknown", "webtoolbar", "nanocore rat", "gamehack", "cobalt strike", "whois record", "ssl certificate", "tsara brashears", "resolutions", "critical risk", "apple phone", "unlocker", "shell code", "installer", "ursnif", "hacktool", "emotet", "tracker", "chaos", "ransomexx", "xor ddos", "xorddos", "mitre attack", "parent domain", "urls url", "siblings", "metro", "communicating", "collection", "dropped", "skynet", "youth", "com laude", "ltd dba", "utc submissions", "submitters", "cloudflarenet", "akamaias", "digitaloceanasn", "csc corporate", "pt mora", "univjos", "etisalat misr", "acurix networks", "pty ltd", "beijing baidu", "highly targeted", "http", "network hijacks", "redline stealer", "whois sslcert", "contacted urls", "whois whois", "september", "hidden cobra", "threats", "kimsuky", "service", "read c", "create c", "write c", "regsetvalueexa", "mozilla", "capture", "asnone", "domain http", "request", "malware dns", "lookup wannacry", "default", "ransom", "push", "playgame", "command", "email document", "exploit domain", "owner exploit", "kit exploit", "source file", "hacking tools", "hunting macro", "malware hosting", "memory scanning", "yara detections", "debug", "icmp traffic", "pdb path", "pe section", "low software", "packing t1045", "ransomware", "egregor", "find", "false", "psexec", "powershell", "qakbot", "qbot", "icedid" ], "references": [ "redhatdelete.com", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "target": null }, { "id": "Rostpay", "display_name": "Rostpay", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Mitre Attack", "display_name": "Mitre Attack", "target": null }, { "id": "Chaos (ELF)", "display_name": "Chaos (ELF)", "target": null }, { "id": "TrojanDropper:Win32/GameHack", "display_name": "TrojanDropper:Win32/GameHack", "target": "/malware/TrojanDropper:Win32/GameHack" }, { "id": "Win.Ransomware.Locky-7766366-0", "display_name": "Win.Ransomware.Locky-7766366-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt.A!rsm", "display_name": "Ransom:Win32/WannaCrypt.A!rsm", "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm" }, { "id": "ALF:E5.SpikeAex.rhh_pid", "display_name": "ALF:E5.SpikeAex.rhh_pid", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 65, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1848, "FileHash-SHA1": 1783, "FileHash-SHA256": 7170, "domain": 1649, "hostname": 1191, "email": 9, "URL": 729, "CVE": 2, "SSLCertFingerprint": 2, "CIDR": 1 }, "indicator_count": 14384, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "803 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d34c91868744aa1449fef2", "name": "Locky: File Deletion targeting incriminating archived files.", "description": "redhatdelete.com : Adversaries are deleting files in bulk from Virustotal, otx AlienVault, WebArchive, Perma.cc Urlscan.io, Archive.Today, Archive.ph, iCloud, apple data, photo deletion.\nVarious ransomware used. iOS service modified, cloud encrypted by adversary. Indicator point to a target with a zombie device. An iPhone and potentially other devices were targeted in a specific attack. | Locky Ransomware is a piece of malware that encrypts important files on your device, rendering them inaccessible and unusable.", "modified": "2024-03-20T12:00:39.809000", "created": "2024-02-19T12:41:52.846000", "tags": [ "it consultant", "uk collection", "dns intel", "ips collection", "suspicous ip", "whois file", "cname", "record type", "ttl value", "algorithm", "v3 serial", "number", "cus cnr3", "olet", "subject public", "key info", "key algorithm", "key identifier", "whois lookup", "region create", "domain", "name server", "registrant name", "technical city", "region update", "united", "command decode", "mitre att", "suricata ipv4", "windows nt", "win64", "khtml", "gecko", "ck id", "cookie", "meta", "february", "hybrid", "general", "click", "strings", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "dns replication", "code", "namecheap", "registrar abuse", "namecheap inc", "privacy service", "withheld", "privacy", "dnssec", "email", "first", "bodis", "unknown", "creation date", "search", "emails", "as397240", "date", "next", "all octoseek", "threat roundup", "january", "june", "historical ssl", "referrer", "contacted", "group", "execution", "phishing", "malware", "core", "malicious", "dark power", "play ransomware", "pe32", "intel", "ms windows", "win32 dynamic", "link library", "win16 ne", "icons library", "os2 executable", "pe32 linker", "gnu linker", "compiler", "info header", "name md5", "overlay", "passive dns", "entries", "ipv4", "pulse pulses", "urls", "files", "trojan", "location united", "query", "activity dns", "observed dns", "msie", "high", "copy", "write", "win32", "hashes", "host interaction", "sabey type", "hallrender", "brian sabey", "memory pattern", "http requests", "http method", "get response", "dns resolutions", "ip traffic", "domains", "mutex", "samplepath", "created", "shell commands", "r processes", "tree", "analyze", "hostnames", "url https", "samples", "hostname", "pattern urls", "memory", "pattern", "pattern domains", "roundup", "formbook", "mirai", "ben c", "injection", "server", "scan endpoints", "show", "august", "bq feb", "chrome", "precondition", "virtool", "downloadmr", "body", "status", "servers", "record value", "name servers", "showing", "mailrubar", "trojanclicker", "slcc2", "media center", "delete c", "malware beacon", "suspicious", "class", "internal", "local", "encrypt", "as15169 google", "gmt cache", "twitter", "rostpay", "date hash", "avast avg", "mtb may", "susp", "cryp", "win32upatre may", "mtb showing", "lowfi", "aaaa", "win32pcmega jan", "urlshortner dec", "urlshortner sep", "as133618", "nxdomain", "as133775 xiamen", "germany unknown", "webtoolbar", "nanocore rat", "gamehack", "cobalt strike", "whois record", "ssl certificate", "tsara brashears", "resolutions", "critical risk", "apple phone", "unlocker", "shell code", "installer", "ursnif", "hacktool", "emotet", "tracker", "chaos", "ransomexx", "xor ddos", "xorddos", "mitre attack", "parent domain", "urls url", "siblings", "metro", "communicating", "collection", "dropped", "skynet", "youth", "com laude", "ltd dba", "utc submissions", "submitters", "cloudflarenet", "akamaias", "digitaloceanasn", "csc corporate", "pt mora", "univjos", "etisalat misr", "acurix networks", "pty ltd", "beijing baidu", "highly targeted", "http", "network hijacks", "redline stealer", "whois sslcert", "contacted urls", "whois whois", "september", "hidden cobra", "threats", "kimsuky", "service", "read c", "create c", "write c", "regsetvalueexa", "mozilla", "capture", "asnone", "domain http", "request", "malware dns", "lookup wannacry", "default", "ransom", "push", "playgame", "command", "email document", "exploit domain", "owner exploit", "kit exploit", "source file", "hacking tools", "hunting macro", "malware hosting", "memory scanning", "yara detections", "debug", "icmp traffic", "pdb path", "pe section", "low software", "packing t1045", "ransomware", "egregor", "find", "false", "psexec", "powershell", "qakbot", "qbot", "icedid" ], "references": [ "redhatdelete.com", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "target": null }, { "id": "Rostpay", "display_name": "Rostpay", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Mitre Attack", "display_name": "Mitre Attack", "target": null }, { "id": "Chaos (ELF)", "display_name": "Chaos (ELF)", "target": null }, { "id": "TrojanDropper:Win32/GameHack", "display_name": "TrojanDropper:Win32/GameHack", "target": "/malware/TrojanDropper:Win32/GameHack" }, { "id": "Win.Ransomware.Locky-7766366-0", "display_name": "Win.Ransomware.Locky-7766366-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt.A!rsm", "display_name": "Ransom:Win32/WannaCrypt.A!rsm", "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm" }, { "id": "ALF:E5.SpikeAex.rhh_pid", "display_name": "ALF:E5.SpikeAex.rhh_pid", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 57, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1848, "FileHash-SHA1": 1783, "FileHash-SHA256": 7170, "domain": 1649, "hostname": 1191, "email": 9, "URL": 729, "CVE": 2, "SSLCertFingerprint": 2, "CIDR": 1 }, "indicator_count": 14384, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "803 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d3acf32e1088e76165a307", "name": "Locky: File Deletion targeting incriminating archived files.", "description": "", "modified": "2024-03-20T12:00:39.809000", "created": "2024-02-19T19:33:07.504000", "tags": [ "it consultant", "uk collection", "dns intel", "ips collection", "suspicous ip", "whois file", "cname", "record type", "ttl value", "algorithm", "v3 serial", "number", "cus cnr3", "olet", "subject public", "key info", "key algorithm", "key identifier", "whois lookup", "region create", "domain", "name server", "registrant name", "technical city", "region update", "united", "command decode", "mitre att", "suricata ipv4", "windows nt", "win64", "khtml", "gecko", "ck id", "cookie", "meta", "february", "hybrid", "general", "click", "strings", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "dns replication", "code", "namecheap", "registrar abuse", "namecheap inc", "privacy service", "withheld", "privacy", "dnssec", "email", "first", "bodis", "unknown", "creation date", "search", "emails", "as397240", "date", "next", "all octoseek", "threat roundup", "january", "june", "historical ssl", "referrer", "contacted", "group", "execution", "phishing", "malware", "core", "malicious", "dark power", "play ransomware", "pe32", "intel", "ms windows", "win32 dynamic", "link library", "win16 ne", "icons library", "os2 executable", "pe32 linker", "gnu linker", "compiler", "info header", "name md5", "overlay", "passive dns", "entries", "ipv4", "pulse pulses", "urls", "files", "trojan", "location united", "query", "activity dns", "observed dns", "msie", "high", "copy", "write", "win32", "hashes", "host interaction", "sabey type", "hallrender", "brian sabey", "memory pattern", "http requests", "http method", "get response", "dns resolutions", "ip traffic", "domains", "mutex", "samplepath", "created", "shell commands", "r processes", "tree", "analyze", "hostnames", "url https", "samples", "hostname", "pattern urls", "memory", "pattern", "pattern domains", "roundup", "formbook", "mirai", "ben c", "injection", "server", "scan endpoints", "show", "august", "bq feb", "chrome", "precondition", "virtool", "downloadmr", "body", "status", "servers", "record value", "name servers", "showing", "mailrubar", "trojanclicker", "slcc2", "media center", "delete c", "malware beacon", "suspicious", "class", "internal", "local", "encrypt", "as15169 google", "gmt cache", "twitter", "rostpay", "date hash", "avast avg", "mtb may", "susp", "cryp", "win32upatre may", "mtb showing", "lowfi", "aaaa", "win32pcmega jan", "urlshortner dec", "urlshortner sep", "as133618", "nxdomain", "as133775 xiamen", "germany unknown", "webtoolbar", "nanocore rat", "gamehack", "cobalt strike", "whois record", "ssl certificate", "tsara brashears", "resolutions", "critical risk", "apple phone", "unlocker", "shell code", "installer", "ursnif", "hacktool", "emotet", "tracker", "chaos", "ransomexx", "xor ddos", "xorddos", "mitre attack", "parent domain", "urls url", "siblings", "metro", "communicating", "collection", "dropped", "skynet", "youth", "com laude", "ltd dba", "utc submissions", "submitters", "cloudflarenet", "akamaias", "digitaloceanasn", "csc corporate", "pt mora", "univjos", "etisalat misr", "acurix networks", "pty ltd", "beijing baidu", "highly targeted", "http", "network hijacks", "redline stealer", "whois sslcert", "contacted urls", "whois whois", "september", "hidden cobra", "threats", "kimsuky", "service", "read c", "create c", "write c", "regsetvalueexa", "mozilla", "capture", "asnone", "domain http", "request", "malware dns", "lookup wannacry", "default", "ransom", "push", "playgame", "command", "email document", "exploit domain", "owner exploit", "kit exploit", "source file", "hacking tools", "hunting macro", "malware hosting", "memory scanning", "yara detections", "debug", "icmp traffic", "pdb path", "pe section", "low software", "packing t1045", "ransomware", "egregor", "find", "false", "psexec", "powershell", "qakbot", "qbot", "icedid" ], "references": [ "redhatdelete.com", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "target": null }, { "id": "Rostpay", "display_name": "Rostpay", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Mitre Attack", "display_name": "Mitre Attack", "target": null }, { "id": "Chaos (ELF)", "display_name": "Chaos (ELF)", "target": null }, { "id": "TrojanDropper:Win32/GameHack", "display_name": "TrojanDropper:Win32/GameHack", "target": "/malware/TrojanDropper:Win32/GameHack" }, { "id": "Win.Ransomware.Locky-7766366-0", "display_name": "Win.Ransomware.Locky-7766366-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt.A!rsm", "display_name": "Ransom:Win32/WannaCrypt.A!rsm", "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm" }, { "id": "ALF:E5.SpikeAex.rhh_pid", "display_name": "ALF:E5.SpikeAex.rhh_pid", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": "65d34c91868744aa1449fef2", "export_count": 64, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1848, "FileHash-SHA1": 1783, "FileHash-SHA256": 7170, "domain": 1649, "hostname": 1191, "email": 9, "URL": 729, "CVE": 2, "SSLCertFingerprint": 2, "CIDR": 1 }, "indicator_count": 14384, "is_author": false, "is_subscribing": null, "subscriber_count": 234, "modified_text": "803 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d3c31230455f6d8da3a9f0", "name": "Locky: File Deletion targeting incriminating archived files II", "description": "", "modified": "2024-03-20T12:00:39.809000", "created": "2024-02-19T21:07:30.887000", "tags": [ "it consultant", "uk collection", "dns intel", "ips collection", "suspicous ip", "whois file", "cname", "record type", "ttl value", "algorithm", "v3 serial", "number", "cus cnr3", "olet", "subject public", "key info", "key algorithm", "key identifier", "whois lookup", "region create", "domain", "name server", "registrant name", "technical city", "region update", "united", "command decode", "mitre att", "suricata ipv4", "windows nt", "win64", "khtml", "gecko", "ck id", "cookie", "meta", "february", "hybrid", "general", "click", "strings", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "dns replication", "code", "namecheap", "registrar abuse", "namecheap inc", "privacy service", "withheld", "privacy", "dnssec", "email", "first", "bodis", "unknown", "creation date", "search", "emails", "as397240", "date", "next", "all octoseek", "threat roundup", "january", "june", "historical ssl", "referrer", "contacted", "group", "execution", "phishing", "malware", "core", "malicious", "dark power", "play ransomware", "pe32", "intel", "ms windows", "win32 dynamic", "link library", "win16 ne", "icons library", "os2 executable", "pe32 linker", "gnu linker", "compiler", "info header", "name md5", "overlay", "passive dns", "entries", "ipv4", "pulse pulses", "urls", "files", "trojan", "location united", "query", "activity dns", "observed dns", "msie", "high", "copy", "write", "win32", "hashes", "host interaction", "sabey type", "hallrender", "brian sabey", "memory pattern", "http requests", "http method", "get response", "dns resolutions", "ip traffic", "domains", "mutex", "samplepath", "created", "shell commands", "r processes", "tree", "analyze", "hostnames", "url https", "samples", "hostname", "pattern urls", "memory", "pattern", "pattern domains", "roundup", "formbook", "mirai", "ben c", "injection", "server", "scan endpoints", "show", "august", "bq feb", "chrome", "precondition", "virtool", "downloadmr", "body", "status", "servers", "record value", "name servers", "showing", "mailrubar", "trojanclicker", "slcc2", "media center", "delete c", "malware beacon", "suspicious", "class", "internal", "local", "encrypt", "as15169 google", "gmt cache", "twitter", "rostpay", "date hash", "avast avg", "mtb may", "susp", "cryp", "win32upatre may", "mtb showing", "lowfi", "aaaa", "win32pcmega jan", "urlshortner dec", "urlshortner sep", "as133618", "nxdomain", "as133775 xiamen", "germany unknown", "webtoolbar", "nanocore rat", "gamehack", "cobalt strike", "whois record", "ssl certificate", "tsara brashears", "resolutions", "critical risk", "apple phone", "unlocker", "shell code", "installer", "ursnif", "hacktool", "emotet", "tracker", "chaos", "ransomexx", "xor ddos", "xorddos", "mitre attack", "parent domain", "urls url", "siblings", "metro", "communicating", "collection", "dropped", "skynet", "youth", "com laude", "ltd dba", "utc submissions", "submitters", "cloudflarenet", "akamaias", "digitaloceanasn", "csc corporate", "pt mora", "univjos", "etisalat misr", "acurix networks", "pty ltd", "beijing baidu", "highly targeted", "http", "network hijacks", "redline stealer", "whois sslcert", "contacted urls", "whois whois", "september", "hidden cobra", "threats", "kimsuky", "service", "read c", "create c", "write c", "regsetvalueexa", "mozilla", "capture", "asnone", "domain http", "request", "malware dns", "lookup wannacry", "default", "ransom", "push", "playgame", "command", "email document", "exploit domain", "owner exploit", "kit exploit", "source file", "hacking tools", "hunting macro", "malware hosting", "memory scanning", "yara detections", "debug", "icmp traffic", "pdb path", "pe section", "low software", "packing t1045", "ransomware", "egregor", "find", "false", "psexec", "powershell", "qakbot", "qbot", "icedid" ], "references": [ "redhatdelete.com", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "target": null }, { "id": "Rostpay", "display_name": "Rostpay", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Mitre Attack", "display_name": "Mitre Attack", "target": null }, { "id": "Chaos (ELF)", "display_name": "Chaos (ELF)", "target": null }, { "id": "TrojanDropper:Win32/GameHack", "display_name": "TrojanDropper:Win32/GameHack", "target": "/malware/TrojanDropper:Win32/GameHack" }, { "id": "Win.Ransomware.Locky-7766366-0", "display_name": "Win.Ransomware.Locky-7766366-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt.A!rsm", "display_name": "Ransom:Win32/WannaCrypt.A!rsm", "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm" }, { "id": "ALF:E5.SpikeAex.rhh_pid", "display_name": "ALF:E5.SpikeAex.rhh_pid", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": "65d34c8a64436a7aee2e25a1", "export_count": 73, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Enqrypted", "id": "272105", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1848, "FileHash-SHA1": 1783, "FileHash-SHA256": 7170, "domain": 1649, "hostname": 1191, "email": 9, "URL": 729, "CVE": 2, "SSLCertFingerprint": 2, "CIDR": 1 }, "indicator_count": 14384, "is_author": false, "is_subscribing": null, "subscriber_count": 62, "modified_text": "803 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "5f491bcb154bd506b5421d5b", "name": "Crypto Mining Pool Hostnames", "description": "", "modified": "2022-11-09T21:17:55.513000", "created": "2020-08-28T14:59:23.972000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 389, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "threatmanager", "id": "74623", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 271091, "domain": 5085 }, "indicator_count": 276176, "is_author": false, "is_subscribing": null, "subscriber_count": 606, "modified_text": "1299 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62414b06ce63f02c018ae8a8", "name": "Mining Domains", "description": "", "modified": "2022-03-28T05:43:34.853000", "created": "2022-03-28T05:43:34.853000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "5f491bcb154bd506b5421d5b", "export_count": 45, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZMJ20160625", "id": "178377", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 261544, "domain": 4964 }, "indicator_count": 266508, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "1526 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "bitminter.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "bitminter.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780346327.0734375 }