{ "type": "Domain", "indicator": "cloudyoryx.dev", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/cloudyoryx.dev", "alexa": "http://www.alexa.com/siteinfo/cloudyoryx.dev", "indicator": "cloudyoryx.dev", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3485182172, "indicator": "cloudyoryx.dev", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 14, "pulses": [ { "id": "698e93e1ab02db8c49e8c3ed", "name": "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)", "description": "Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (\u201cBroken Seal\u201d) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.", "modified": "2026-05-17T15:52:35.396000", "created": "2026-02-13T03:00:49.872000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr", "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all." ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28000, "FileHash-SHA256": 48374, "FileHash-MD5": 42596, "FileHash-SHA1": 23243, "hostname": 35654, "URL": 75758, "SSLCertFingerprint": 30, "CVE": 7585, "email": 316, "FileHash-IMPHASH": 8, "CIDR": 26205, "JA3": 1, "URI": 5, "IPv4": 574, "Mutex": 1 }, "indicator_count": 288350, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "14 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bf64e1d5e06aa6207f78de", "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "description": "", "modified": "2026-03-27T00:30:39.055000", "created": "2026-03-22T03:41:21.863000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr" ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": "698e93e1ab02db8c49e8c3ed", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27572, "FileHash-SHA256": 46076, "FileHash-MD5": 42177, "FileHash-SHA1": 22874, "hostname": 33438, "URL": 74810, "SSLCertFingerprint": 21, "CVE": 7579, "email": 297, "FileHash-IMPHASH": 8, "CIDR": 26203, "JA3": 1 }, "indicator_count": 281056, "is_author": false, "is_subscribing": null, "subscriber_count": 149, "modified_text": "66 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bf64eccb5d39a90a3c391e", "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "description": "", "modified": "2026-03-27T00:30:39.055000", "created": "2026-03-22T03:41:32.565000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr" ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": "698e93e1ab02db8c49e8c3ed", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27572, "FileHash-SHA256": 46076, "FileHash-MD5": 42177, "FileHash-SHA1": 22874, "hostname": 33438, "URL": 74810, "SSLCertFingerprint": 21, "CVE": 7579, "email": 297, "FileHash-IMPHASH": 8, "CIDR": 26203, "JA3": 1 }, "indicator_count": 281056, "is_author": false, "is_subscribing": null, "subscriber_count": 152, "modified_text": "66 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6919473b9e0624394e9b68e9", "name": "Backdoor:Linux/DemonBot Affecting Unsecured servers", "description": "A closer look at a hacker group found in Mirai Bot Network. Catgirls is still active , has running web server , is only viewable to group according to remarks regarding \u2018catgirls\u2019 domains , sub domains , hosts.\n\n Multiple hosts , name servers and links. .Backdoor:Linux/DemonBot Malicious attacks affecting unsecured servers (personal , business) networks, DDOS attacks , Mitre. Worm, Ransomware. \n\nHacker group has seemingly caused a fair ammunition of damage to small businesses and / or individuals/civil society.. Seen in attacks against handful of targets are in this Mirai Botnet. Of course we know how very large the Mirai Botnet is.", "modified": "2025-12-16T03:02:09.743000", "created": "2025-11-16T03:38:35.430000", "tags": [ "server", "algorithm", "x509v3 subject", "registrar abuse", "v3 serial", "spaceship", "community", "related pulses", "cidr", "mirai botnet", "hacker", "mirai att", "ck id", "group", "active", "generic pong", "reporting arch", "msie", "windows nt", "resolverror", "backdoor", "malware", "strings", "learn", "command", "name tactics", "suspicious", "informative", "adversaries", "spawns", "evasion att", "t1480 execution", "ipv4", "iocs", "drop", "review iocs", "found", "ascii text", "pattern match", "mitre att", "beginstring", "null", "refresh", "span", "hybrid", "click", "error", "tools", "look", "verify", "restart", "united", "moved", "passive dns", "urls", "record value", "unknown aaaa", "gmt content", "title", "cookie", "signing defense", "t1553 technique", "subvert trust", "controls learn", "disable", "modify tools", "defense evasion", "t1562 technique", "rdap", "domain database", "dap domain", "datab", "database", "array", "content", "ascii", "form", "initial access", "execution", "present aug", "present jul", "present nov", "present oct", "ip address", "command decode", "suricata ipv4", "localappdata", "windir", "openurl c", "programfiles", "edge", "cloudflare", "ssl certificate", "size", "starfield", "accept", "path", "general", "local", "hostname add", "pulse pulses", "read c", "port", "destination", "rgba", "unicode text", "medium", "unknown", "code", "write", "pecompact", "packer", "delphi", "win32", "persistence", "crash", "next", "china unknown", "chrome", "internal server", "next associated", "ipv4 add", "trojandropper", "date", "domain", "search", "domain add", "certificate", "next http", "scans show", "found title", "head body", "hostname", "files", "files ip", "address", "location united", "asn asnone", "present feb", "present jun", "unknown ns", "internet", "emails", "present sep", "show", "memcommit", "gapd5d", "key0", "packing t1045", "filehash", "sha1 add", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "file score", "medium risk", "mirai", "json", "total", "delete", "win64", "url http", "http", "related nids", "files location", "flag united", "gmt cache", "pulse submit", "url analysis", "verdict", "win32dh", "reverse dns", "america flag", "worm", "warehouse mgmt", "built", "retailexperts", "read", "top source", "top destination", "aaaa", "ransom", "trojan", "entries", "singapore", "singapore asn", "as16509", "present mar", "creation date", "contacted", "hostile", "targeting", "whitelisted", "high", "systemroot", "as15169", "copy", "global", "dynamicloader", "directui", "yara rule", "element", "classinfobase", "ccbase", "hwndhost", "windows" ], "references": [ "http://catgirls.foundation/main \u2022 https://spaceship.com/", "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/68e72a3b96eaf61daf0eb13f", "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2", "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2" ], "public": 1, "adversary": "Mirai", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Backdoor:Linux/DemonBot.Aa!MTB", "display_name": "Backdoor:Linux/DemonBot.Aa!MTB", "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB" }, { "id": "Mirai (ELF)", "display_name": "Mirai (ELF)", "target": null }, { "id": "Backdoor:Linux/Mirai", "display_name": "Backdoor:Linux/Mirai", "target": "/malware/Backdoor:Linux/Mirai" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "PSW.Sinowal.X", "display_name": "PSW.Sinowal.X", "target": null }, { "id": "mirai", "display_name": "mirai", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null }, { "id": "Win.Virus.PolyRansom-5704625-0", "display_name": "Win.Virus.PolyRansom-5704625-0", "target": null }, { "id": "Worm:Win32/Locksky.gen!A", "display_name": "Worm:Win32/Locksky.gen!A", "target": "/malware/Worm:Win32/Locksky.gen!A" } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1991, "domain": 428, "hostname": 882, "FileHash-SHA256": 2213, "FileHash-MD5": 675, "FileHash-SHA1": 530, "email": 7, "CIDR": 1, "CVE": 1, "SSLCertFingerprint": 23 }, "indicator_count": 6751, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "167 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "657093ebb4721854f28870a1", "name": "http://www.appasamy.com/", "description": "", "modified": "2023-12-06T15:31:54.924000", "created": "2023-12-06T15:31:54.924000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 110, "domain": 99, "URL": 584, "FileHash-SHA256": 195, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1018, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708fa9137ebcc0549ac8d0", "name": "https://take-away.ml/ - interesting - CVE-2021-22941", "description": "", "modified": "2023-12-06T15:13:45.159000", "created": "2023-12-06T15:13:45.159000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 315, "hostname": 91, "URL": 235, "FileHash-MD5": 46, "FileHash-SHA1": 42, "domain": 68, "CVE": 1 }, "indicator_count": 798, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "652396e713c1ed328a30e252", "name": "Multiple Antagonist", "description": "Multiple antagonist related to this issue.\n\n\nBased on extensive research attack not aimed at medical business. \n\nTargeting: visitors, specified female individual, associates, targets businesses, devices, digital profile , technology, insurance, communications, search redirects, targets route through BN.\n\n\n\nResearch points to multiple involved antagonists, a female target, a clear motive.", "modified": "2023-11-08T04:04:40.217000", "created": "2023-10-09T06:00:07.575000", "tags": [ "heur", "united", "malicious site", "phishing site", "malware", "anonymisation", "ibm xforce", "exchange", "unsafe", "artemis", "formbook", "downloader", "facebook", "bank", "download", "union", "fuery", "team", "qbot", "bankerx", "riskware", "dropper", "nimda", "swrort", "unruy", "adwind", "trojanx", "crack", "win64", "agent", "generic", "alexa top", "million", "team top", "site", "cisco umbrella", "safe site", "malware site", "iframe", "opencandy", "exploit", "zbot", "nircmd", "acint", "downldr", "tiggre", "presenoker", "filetour", "cleaner", "conduit", "wacatac", "quasar rat", "mimikatz", "pony", "funshion", "mywebsearch", "rostpay", "iobit", "mediaget", "systweak", "behav", "genkryptik", "phishing", "alexa", "installpack", "xtrat", "webtoolbar", "trojanspy", "detection list", "blacklist http", "bottom3", "sig10vr3b813", "lcid1033", "smlen", "spn224", "bv7uet92ww", "blacklist", "denver", "s tamarac", "dr ste", "therapists", "centennial", "therahand", "review", "physical", "tomorrow", "hours mon", "dpt", "404", "gettr", "whois record", "referrer", "historical ssl", "contacted", "communicating", "resolutions", "whois whois", "whois ssl", "ssl certificate", "bottom3 http", "FileRepMetagen", "evasive,hyteod,ransomware", "AI_Score_52%", "ATT&CK fonts.gstatic.com", "mitre", "button", "path", "input", "form", "malicious url", "paypal", "team phishing", "filerepmetagen", "azorult", "service", "runescape", "business url", "delivery optout", "superpages url", "us url", "network partner", "google", "windows nt", "khtml", "gecko", "aes128gcm", "gts ca", "europeberlin", "frankfurt", "main", "sign", "people search", "state directory", "join browse", "nail salons", "popular", "the local", "nearby", "strong", "use my", "fakealert", "zpevdo" ], "references": [ "https://www.superpages.com/denver-co/bpp/amp/therahand-472908110", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "Hybrid Analysis via AlienVault OTX Extraction Details", "Extensive research", "Data Analysis", "Comparative Analysis", "Content servers: https://c.ypcdn.com/", "https://www.superpages.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "XRat", "display_name": "XRat", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ALF:JASYP:PUA:Win32/Systweak", "display_name": "ALF:JASYP:PUA:Win32/Systweak", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Worm:Win32/Nimda", "display_name": "Worm:Win32/Nimda", "target": "/malware/Worm:Win32/Nimda" }, { "id": "HackTool:Win32/Crack", "display_name": "HackTool:Win32/Crack", "target": "/malware/HackTool:Win32/Crack" }, { "id": "ALF:PUA:Win32/OpenCandy", "display_name": "ALF:PUA:Win32/OpenCandy", "target": null }, { "id": "Trojan:Win32/Wacatac", "display_name": "Trojan:Win32/Wacatac", "target": "/malware/Trojan:Win32/Wacatac" }, { "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "target": null }, { "id": "HackTool:PowerShell/Mimikatz", "display_name": "HackTool:PowerShell/Mimikatz", "target": "/malware/HackTool:PowerShell/Mimikatz" }, { "id": "ALF:Program:Win32/Mediaget", "display_name": "ALF:Program:Win32/Mediaget", "target": null }, { "id": "Trojan:Win32/Qbot", "display_name": "Trojan:Win32/Qbot", "target": "/malware/Trojan:Win32/Qbot" }, { "id": "Worm:Win32/Acint", "display_name": "Worm:Win32/Acint", "target": "/malware/Worm:Win32/Acint" }, { "id": "Adwind RAT", "display_name": "Adwind RAT", "target": null }, { "id": "Trojan:Win32/Tiggre", "display_name": "Trojan:Win32/Tiggre", "target": "/malware/Trojan:Win32/Tiggre" }, { "id": "Virus:DOS/Better_Tomorrow", "display_name": "Virus:DOS/Better_Tomorrow", "target": "/malware/Virus:DOS/Better_Tomorrow" }, { "id": "Pony", "display_name": "Pony", "target": null }, { "id": "ALF:PUA:Win32/Rostpay", "display_name": "ALF:PUA:Win32/Rostpay", "target": null }, { "id": "NirCmd", "display_name": "NirCmd", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "trojanx", "display_name": "trojanx", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "target": null }, { "id": "Trojan:Win32/Fuery", "display_name": "Trojan:Win32/Fuery", "target": "/malware/Trojan:Win32/Fuery" }, { "id": "Trojan:Win32/Filetour", "display_name": "Trojan:Win32/Filetour", "target": "/malware/Trojan:Win32/Filetour" }, { "id": "ALF:PUA:Win32/IObit", "display_name": "ALF:PUA:Win32/IObit", "target": null }, { "id": "ALF:Cert:InstallPack", "display_name": "ALF:Cert:InstallPack", "target": null }, { "id": "Ransom:Win32/WannaCrypt", "display_name": "Ransom:Win32/WannaCrypt", "target": "/malware/Ransom:Win32/WannaCrypt" }, { "id": "TROJ_FRS.VSN1EA19", "display_name": "TROJ_FRS.VSN1EA19", "target": null }, { "id": "PE.Heur", "display_name": "PE.Heur", "target": null }, { "id": "Slimware.a", "display_name": "Slimware.a", "target": null }, { "id": "PhishingMS.ABC", "display_name": "PhishingMS.ABC", "target": null }, { "id": "FileRepMetagen [PUP]", "display_name": "FileRepMetagen [PUP]", "target": null }, { "id": "malicious.35bb6b", "display_name": "malicious.35bb6b", "target": null }, { "id": "Agent.3132311", "display_name": "Agent.3132311", "target": null }, { "id": "virus.html.gen03", "display_name": "virus.html.gen03", "target": null }, { "id": "BU", "display_name": "BU", "target": null }, { "id": "Trojan:Win32/Presenoker", "display_name": "Trojan:Win32/Presenoker", "target": "/malware/Trojan:Win32/Presenoker" }, { "id": "Trojan:Win32/Swrort", "display_name": "Trojan:Win32/Swrort", "target": "/malware/Trojan:Win32/Swrort" }, { "id": "ALF:PUA:Win32/Funshion", "display_name": "ALF:PUA:Win32/Funshion", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 14, "hostname": 313, "FileHash-MD5": 187, "FileHash-SHA1": 102, "domain": 115, "URL": 134, "FileHash-SHA256": 169, "FilePath": 1, "CIDR": 1 }, "indicator_count": 1036, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6523978d9bc58273e16261a6", "name": "Ransom:Win32/WannaCrypt ", "description": "", "modified": "2023-11-08T04:04:40.217000", "created": "2023-10-09T06:02:53.483000", "tags": [ "heur", "united", "malicious site", "phishing site", "malware", "anonymisation", "ibm xforce", "exchange", "unsafe", "artemis", "formbook", "downloader", "facebook", "bank", "download", "union", "fuery", "team", "qbot", "bankerx", "riskware", "dropper", "nimda", "swrort", "unruy", "adwind", "trojanx", "crack", "win64", "agent", "generic", "alexa top", "million", "team top", "site", "cisco umbrella", "safe site", "malware site", "iframe", "opencandy", "exploit", "zbot", "nircmd", "acint", "downldr", "tiggre", "presenoker", "filetour", "cleaner", "conduit", "wacatac", "quasar rat", "mimikatz", "pony", "funshion", "mywebsearch", "rostpay", "iobit", "mediaget", "systweak", "behav", "genkryptik", "phishing", "alexa", "installpack", "xtrat", "webtoolbar", "trojanspy", "detection list", "blacklist http", "bottom3", "sig10vr3b813", "lcid1033", "smlen", "spn224", "bv7uet92ww", "blacklist", "denver", "s tamarac", "dr ste", "therapists", "centennial", "therahand", "review", "physical", "tomorrow", "hours mon", "dpt", "404", "gettr", "whois record", "referrer", "historical ssl", "contacted", "communicating", "resolutions", "whois whois", "whois ssl", "ssl certificate", "bottom3 http", "FileRepMetagen", "evasive,hyteod,ransomware", "AI_Score_52%", "ATT&CK fonts.gstatic.com", "mitre", "button", "path", "input", "form", "malicious url", "paypal", "team phishing", "filerepmetagen", "azorult", "service", "runescape", "business url", "delivery optout", "superpages url", "us url", "network partner", "google", "windows nt", "khtml", "gecko", "aes128gcm", "gts ca", "europeberlin", "frankfurt", "main", "sign", "people search", "state directory", "join browse", "nail salons", "popular", "the local", "nearby", "strong", "use my", "fakealert", "zpevdo" ], "references": [ "https://www.superpages.com/denver-co/bpp/amp/therahand-472908110", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "Hybrid Analysis via AlienVault OTX Extraction Details", "Extensive research", "Data Analysis", "Comparative Analysis", "Content servers: https://c.ypcdn.com/", "https://www.superpages.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "XRat", "display_name": "XRat", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ALF:JASYP:PUA:Win32/Systweak", "display_name": "ALF:JASYP:PUA:Win32/Systweak", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Worm:Win32/Nimda", "display_name": "Worm:Win32/Nimda", "target": "/malware/Worm:Win32/Nimda" }, { "id": "HackTool:Win32/Crack", "display_name": "HackTool:Win32/Crack", "target": "/malware/HackTool:Win32/Crack" }, { "id": "ALF:PUA:Win32/OpenCandy", "display_name": "ALF:PUA:Win32/OpenCandy", "target": null }, { "id": "Trojan:Win32/Wacatac", "display_name": "Trojan:Win32/Wacatac", "target": "/malware/Trojan:Win32/Wacatac" }, { "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "target": null }, { "id": "HackTool:PowerShell/Mimikatz", "display_name": "HackTool:PowerShell/Mimikatz", "target": "/malware/HackTool:PowerShell/Mimikatz" }, { "id": "ALF:Program:Win32/Mediaget", "display_name": "ALF:Program:Win32/Mediaget", "target": null }, { "id": "Trojan:Win32/Qbot", "display_name": "Trojan:Win32/Qbot", "target": "/malware/Trojan:Win32/Qbot" }, { "id": "Worm:Win32/Acint", "display_name": "Worm:Win32/Acint", "target": "/malware/Worm:Win32/Acint" }, { "id": "Adwind RAT", "display_name": "Adwind RAT", "target": null }, { "id": "Trojan:Win32/Tiggre", "display_name": "Trojan:Win32/Tiggre", "target": "/malware/Trojan:Win32/Tiggre" }, { "id": "Virus:DOS/Better_Tomorrow", "display_name": "Virus:DOS/Better_Tomorrow", "target": "/malware/Virus:DOS/Better_Tomorrow" }, { "id": "Pony", "display_name": "Pony", "target": null }, { "id": "ALF:PUA:Win32/Rostpay", "display_name": "ALF:PUA:Win32/Rostpay", "target": null }, { "id": "NirCmd", "display_name": "NirCmd", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "trojanx", "display_name": "trojanx", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "target": null }, { "id": "Trojan:Win32/Fuery", "display_name": "Trojan:Win32/Fuery", "target": "/malware/Trojan:Win32/Fuery" }, { "id": "Trojan:Win32/Filetour", "display_name": "Trojan:Win32/Filetour", "target": "/malware/Trojan:Win32/Filetour" }, { "id": "ALF:PUA:Win32/IObit", "display_name": "ALF:PUA:Win32/IObit", "target": null }, { "id": "ALF:Cert:InstallPack", "display_name": "ALF:Cert:InstallPack", "target": null }, { "id": "Ransom:Win32/WannaCrypt", "display_name": "Ransom:Win32/WannaCrypt", "target": "/malware/Ransom:Win32/WannaCrypt" }, { "id": "TROJ_FRS.VSN1EA19", "display_name": "TROJ_FRS.VSN1EA19", "target": null }, { "id": "PE.Heur", "display_name": "PE.Heur", "target": null }, { "id": "Slimware.a", "display_name": "Slimware.a", "target": null }, { "id": "PhishingMS.ABC", "display_name": "PhishingMS.ABC", "target": null }, { "id": "FileRepMetagen [PUP]", "display_name": "FileRepMetagen [PUP]", "target": null }, { "id": "malicious.35bb6b", "display_name": "malicious.35bb6b", "target": null }, { "id": "Agent.3132311", "display_name": "Agent.3132311", "target": null }, { "id": "virus.html.gen03", "display_name": "virus.html.gen03", "target": null }, { "id": "BU", "display_name": "BU", "target": null }, { "id": "Trojan:Win32/Presenoker", "display_name": "Trojan:Win32/Presenoker", "target": "/malware/Trojan:Win32/Presenoker" }, { "id": "Trojan:Win32/Swrort", "display_name": "Trojan:Win32/Swrort", "target": "/malware/Trojan:Win32/Swrort" }, { "id": "ALF:PUA:Win32/Funshion", "display_name": "ALF:PUA:Win32/Funshion", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": "652396e713c1ed328a30e252", "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 14, "hostname": 313, "FileHash-MD5": 187, "FileHash-SHA1": 102, "domain": 115, "URL": 134, "FileHash-SHA256": 169, "FilePath": 1, "CIDR": 1 }, "indicator_count": 1036, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "653f1b9d7b8c6e2836f2c1a5", "name": "Ransom:Win32/WannaCrypt", "description": "", "modified": "2023-11-08T04:04:40.217000", "created": "2023-10-30T02:57:33.289000", "tags": [ "heur", "united", "malicious site", "phishing site", "malware", "anonymisation", "ibm xforce", "exchange", "unsafe", "artemis", "formbook", "downloader", "facebook", "bank", "download", "union", "fuery", "team", "qbot", "bankerx", "riskware", "dropper", "nimda", "swrort", "unruy", "adwind", "trojanx", "crack", "win64", "agent", "generic", "alexa top", "million", "team top", "site", "cisco umbrella", "safe site", "malware site", "iframe", "opencandy", "exploit", "zbot", "nircmd", "acint", "downldr", "tiggre", "presenoker", "filetour", "cleaner", "conduit", "wacatac", "quasar rat", "mimikatz", "pony", "funshion", "mywebsearch", "rostpay", "iobit", "mediaget", "systweak", "behav", "genkryptik", "phishing", "alexa", "installpack", "xtrat", "webtoolbar", "trojanspy", "detection list", "blacklist http", "bottom3", "sig10vr3b813", "lcid1033", "smlen", "spn224", "bv7uet92ww", "blacklist", "denver", "s tamarac", "dr ste", "therapists", "centennial", "therahand", "review", "physical", "tomorrow", "hours mon", "dpt", "404", "gettr", "whois record", "referrer", "historical ssl", "contacted", "communicating", "resolutions", "whois whois", "whois ssl", "ssl certificate", "bottom3 http", "FileRepMetagen", "evasive,hyteod,ransomware", "AI_Score_52%", "ATT&CK fonts.gstatic.com", "mitre", "button", "path", "input", "form", "malicious url", "paypal", "team phishing", "filerepmetagen", "azorult", "service", "runescape", "business url", "delivery optout", "superpages url", "us url", "network partner", "google", "windows nt", "khtml", "gecko", "aes128gcm", "gts ca", "europeberlin", "frankfurt", "main", "sign", "people search", "state directory", "join browse", "nail salons", "popular", "the local", "nearby", "strong", "use my", "fakealert", "zpevdo" ], "references": [ "https://www.superpages.com/denver-co/bpp/amp/therahand-472908110", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "Hybrid Analysis via AlienVault OTX Extraction Details", "Extensive research", "Data Analysis", "Comparative Analysis", "Content servers: https://c.ypcdn.com/", "https://www.superpages.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "XRat", "display_name": "XRat", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ALF:JASYP:PUA:Win32/Systweak", "display_name": "ALF:JASYP:PUA:Win32/Systweak", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Worm:Win32/Nimda", "display_name": "Worm:Win32/Nimda", "target": "/malware/Worm:Win32/Nimda" }, { "id": "HackTool:Win32/Crack", "display_name": "HackTool:Win32/Crack", "target": "/malware/HackTool:Win32/Crack" }, { "id": "ALF:PUA:Win32/OpenCandy", "display_name": "ALF:PUA:Win32/OpenCandy", "target": null }, { "id": "Trojan:Win32/Wacatac", "display_name": "Trojan:Win32/Wacatac", "target": "/malware/Trojan:Win32/Wacatac" }, { "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "target": null }, { "id": "HackTool:PowerShell/Mimikatz", "display_name": "HackTool:PowerShell/Mimikatz", "target": "/malware/HackTool:PowerShell/Mimikatz" }, { "id": "ALF:Program:Win32/Mediaget", "display_name": "ALF:Program:Win32/Mediaget", "target": null }, { "id": "Trojan:Win32/Qbot", "display_name": "Trojan:Win32/Qbot", "target": "/malware/Trojan:Win32/Qbot" }, { "id": "Worm:Win32/Acint", "display_name": "Worm:Win32/Acint", "target": "/malware/Worm:Win32/Acint" }, { "id": "Adwind RAT", "display_name": "Adwind RAT", "target": null }, { "id": "Trojan:Win32/Tiggre", "display_name": "Trojan:Win32/Tiggre", "target": "/malware/Trojan:Win32/Tiggre" }, { "id": "Virus:DOS/Better_Tomorrow", "display_name": "Virus:DOS/Better_Tomorrow", "target": "/malware/Virus:DOS/Better_Tomorrow" }, { "id": "Pony", "display_name": "Pony", "target": null }, { "id": "ALF:PUA:Win32/Rostpay", "display_name": "ALF:PUA:Win32/Rostpay", "target": null }, { "id": "NirCmd", "display_name": "NirCmd", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "trojanx", "display_name": "trojanx", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "target": null }, { "id": "Trojan:Win32/Fuery", "display_name": "Trojan:Win32/Fuery", "target": "/malware/Trojan:Win32/Fuery" }, { "id": "Trojan:Win32/Filetour", "display_name": "Trojan:Win32/Filetour", "target": "/malware/Trojan:Win32/Filetour" }, { "id": "ALF:PUA:Win32/IObit", "display_name": "ALF:PUA:Win32/IObit", "target": null }, { "id": "ALF:Cert:InstallPack", "display_name": "ALF:Cert:InstallPack", "target": null }, { "id": "Ransom:Win32/WannaCrypt", "display_name": "Ransom:Win32/WannaCrypt", "target": "/malware/Ransom:Win32/WannaCrypt" }, { "id": "TROJ_FRS.VSN1EA19", "display_name": "TROJ_FRS.VSN1EA19", "target": null }, { "id": "PE.Heur", "display_name": "PE.Heur", "target": null }, { "id": "Slimware.a", "display_name": "Slimware.a", "target": null }, { "id": "PhishingMS.ABC", "display_name": "PhishingMS.ABC", "target": null }, { "id": "FileRepMetagen [PUP]", "display_name": "FileRepMetagen [PUP]", "target": null }, { "id": "malicious.35bb6b", "display_name": "malicious.35bb6b", "target": null }, { "id": "Agent.3132311", "display_name": "Agent.3132311", "target": null }, { "id": "virus.html.gen03", "display_name": "virus.html.gen03", "target": null }, { "id": "BU", "display_name": "BU", "target": null }, { "id": "Trojan:Win32/Presenoker", "display_name": "Trojan:Win32/Presenoker", "target": "/malware/Trojan:Win32/Presenoker" }, { "id": "Trojan:Win32/Swrort", "display_name": "Trojan:Win32/Swrort", "target": "/malware/Trojan:Win32/Swrort" }, { "id": "ALF:PUA:Win32/Funshion", "display_name": "ALF:PUA:Win32/Funshion", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": "6523978d9bc58273e16261a6", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 14, "hostname": 313, "FileHash-MD5": 187, "FileHash-SHA1": 102, "domain": 115, "URL": 134, "FileHash-SHA256": 169, "FilePath": 1, "CIDR": 1 }, "indicator_count": 1036, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "653f1cc68d8465d74f49192f", "name": "Ransom:Win32/WannaCrypt", "description": "", "modified": "2023-11-08T04:04:40.217000", "created": "2023-10-30T03:02:30.391000", "tags": [ "heur", "united", "malicious site", "phishing site", "malware", "anonymisation", "ibm xforce", "exchange", "unsafe", "artemis", "formbook", "downloader", "facebook", "bank", "download", "union", "fuery", "team", "qbot", "bankerx", "riskware", "dropper", "nimda", "swrort", "unruy", "adwind", "trojanx", "crack", "win64", "agent", "generic", "alexa top", "million", "team top", "site", "cisco umbrella", "safe site", "malware site", "iframe", "opencandy", "exploit", "zbot", "nircmd", "acint", "downldr", "tiggre", "presenoker", "filetour", "cleaner", "conduit", "wacatac", "quasar rat", "mimikatz", "pony", "funshion", "mywebsearch", "rostpay", "iobit", "mediaget", "systweak", "behav", "genkryptik", "phishing", "alexa", "installpack", "xtrat", "webtoolbar", "trojanspy", "detection list", "blacklist http", "bottom3", "sig10vr3b813", "lcid1033", "smlen", "spn224", "bv7uet92ww", "blacklist", "denver", "s tamarac", "dr ste", "therapists", "centennial", "therahand", "review", "physical", "tomorrow", "hours mon", "dpt", "404", "gettr", "whois record", "referrer", "historical ssl", "contacted", "communicating", "resolutions", "whois whois", "whois ssl", "ssl certificate", "bottom3 http", "FileRepMetagen", "evasive,hyteod,ransomware", "AI_Score_52%", "ATT&CK fonts.gstatic.com", "mitre", "button", "path", "input", "form", "malicious url", "paypal", "team phishing", "filerepmetagen", "azorult", "service", "runescape", "business url", "delivery optout", "superpages url", "us url", "network partner", "google", "windows nt", "khtml", "gecko", "aes128gcm", "gts ca", "europeberlin", "frankfurt", "main", "sign", "people search", "state directory", "join browse", "nail salons", "popular", "the local", "nearby", "strong", "use my", "fakealert", "zpevdo" ], "references": [ "https://www.superpages.com/denver-co/bpp/amp/therahand-472908110", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "Hybrid Analysis via AlienVault OTX Extraction Details", "Extensive research", "Data Analysis", "Comparative Analysis", "Content servers: https://c.ypcdn.com/", "https://www.superpages.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "XRat", "display_name": "XRat", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ALF:JASYP:PUA:Win32/Systweak", "display_name": "ALF:JASYP:PUA:Win32/Systweak", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Worm:Win32/Nimda", "display_name": "Worm:Win32/Nimda", "target": "/malware/Worm:Win32/Nimda" }, { "id": "HackTool:Win32/Crack", "display_name": "HackTool:Win32/Crack", "target": "/malware/HackTool:Win32/Crack" }, { "id": "ALF:PUA:Win32/OpenCandy", "display_name": "ALF:PUA:Win32/OpenCandy", "target": null }, { "id": "Trojan:Win32/Wacatac", "display_name": "Trojan:Win32/Wacatac", "target": "/malware/Trojan:Win32/Wacatac" }, { "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "target": null }, { "id": "HackTool:PowerShell/Mimikatz", "display_name": "HackTool:PowerShell/Mimikatz", "target": "/malware/HackTool:PowerShell/Mimikatz" }, { "id": "ALF:Program:Win32/Mediaget", "display_name": "ALF:Program:Win32/Mediaget", "target": null }, { "id": "Trojan:Win32/Qbot", "display_name": "Trojan:Win32/Qbot", "target": "/malware/Trojan:Win32/Qbot" }, { "id": "Worm:Win32/Acint", "display_name": "Worm:Win32/Acint", "target": "/malware/Worm:Win32/Acint" }, { "id": "Adwind RAT", "display_name": "Adwind RAT", "target": null }, { "id": "Trojan:Win32/Tiggre", "display_name": "Trojan:Win32/Tiggre", "target": "/malware/Trojan:Win32/Tiggre" }, { "id": "Virus:DOS/Better_Tomorrow", "display_name": "Virus:DOS/Better_Tomorrow", "target": "/malware/Virus:DOS/Better_Tomorrow" }, { "id": "Pony", "display_name": "Pony", "target": null }, { "id": "ALF:PUA:Win32/Rostpay", "display_name": "ALF:PUA:Win32/Rostpay", "target": null }, { "id": "NirCmd", "display_name": "NirCmd", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "trojanx", "display_name": "trojanx", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "target": null }, { "id": "Trojan:Win32/Fuery", "display_name": "Trojan:Win32/Fuery", "target": "/malware/Trojan:Win32/Fuery" }, { "id": "Trojan:Win32/Filetour", "display_name": "Trojan:Win32/Filetour", "target": "/malware/Trojan:Win32/Filetour" }, { "id": "ALF:PUA:Win32/IObit", "display_name": "ALF:PUA:Win32/IObit", "target": null }, { "id": "ALF:Cert:InstallPack", "display_name": "ALF:Cert:InstallPack", "target": null }, { "id": "Ransom:Win32/WannaCrypt", "display_name": "Ransom:Win32/WannaCrypt", "target": "/malware/Ransom:Win32/WannaCrypt" }, { "id": "TROJ_FRS.VSN1EA19", "display_name": "TROJ_FRS.VSN1EA19", "target": null }, { "id": "PE.Heur", "display_name": "PE.Heur", "target": null }, { "id": "Slimware.a", "display_name": "Slimware.a", "target": null }, { "id": "PhishingMS.ABC", "display_name": "PhishingMS.ABC", "target": null }, { "id": "FileRepMetagen [PUP]", "display_name": "FileRepMetagen [PUP]", "target": null }, { "id": "malicious.35bb6b", "display_name": "malicious.35bb6b", "target": null }, { "id": "Agent.3132311", "display_name": "Agent.3132311", "target": null }, { "id": "virus.html.gen03", "display_name": "virus.html.gen03", "target": null }, { "id": "BU", "display_name": "BU", "target": null }, { "id": "Trojan:Win32/Presenoker", "display_name": "Trojan:Win32/Presenoker", "target": "/malware/Trojan:Win32/Presenoker" }, { "id": "Trojan:Win32/Swrort", "display_name": "Trojan:Win32/Swrort", "target": "/malware/Trojan:Win32/Swrort" }, { "id": "ALF:PUA:Win32/Funshion", "display_name": "ALF:PUA:Win32/Funshion", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": "6523978d9bc58273e16261a6", "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 14, "hostname": 313, "FileHash-MD5": 187, "FileHash-SHA1": 102, "domain": 115, "URL": 134, "FileHash-SHA256": 169, "FilePath": 1, "CIDR": 1 }, "indicator_count": 1036, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "653f21acc5a187c1be5fcc90", "name": "Multiple Antagonist", "description": "", "modified": "2023-11-08T04:04:40.217000", "created": "2023-10-30T03:23:24.863000", "tags": [ "heur", "united", "malicious site", "phishing site", "malware", "anonymisation", "ibm xforce", "exchange", "unsafe", "artemis", "formbook", "downloader", "facebook", "bank", "download", "union", "fuery", "team", "qbot", "bankerx", "riskware", "dropper", "nimda", "swrort", "unruy", "adwind", "trojanx", "crack", "win64", "agent", "generic", "alexa top", "million", "team top", "site", "cisco umbrella", "safe site", "malware site", "iframe", "opencandy", "exploit", "zbot", "nircmd", "acint", "downldr", "tiggre", "presenoker", "filetour", "cleaner", "conduit", "wacatac", "quasar rat", "mimikatz", "pony", "funshion", "mywebsearch", "rostpay", "iobit", "mediaget", "systweak", "behav", "genkryptik", "phishing", "alexa", "installpack", "xtrat", "webtoolbar", "trojanspy", "detection list", "blacklist http", "bottom3", "sig10vr3b813", "lcid1033", "smlen", "spn224", "bv7uet92ww", "blacklist", "denver", "s tamarac", "dr ste", "therapists", "centennial", "therahand", "review", "physical", "tomorrow", "hours mon", "dpt", "404", "gettr", "whois record", "referrer", "historical ssl", "contacted", "communicating", "resolutions", "whois whois", "whois ssl", "ssl certificate", "bottom3 http", "FileRepMetagen", "evasive,hyteod,ransomware", "AI_Score_52%", "ATT&CK fonts.gstatic.com", "mitre", "button", "path", "input", "form", "malicious url", "paypal", "team phishing", "filerepmetagen", "azorult", "service", "runescape", "business url", "delivery optout", "superpages url", "us url", "network partner", "google", "windows nt", "khtml", "gecko", "aes128gcm", "gts ca", "europeberlin", "frankfurt", "main", "sign", "people search", "state directory", "join browse", "nail salons", "popular", "the local", "nearby", "strong", "use my", "fakealert", "zpevdo" ], "references": [ "https://www.superpages.com/denver-co/bpp/amp/therahand-472908110", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "Hybrid Analysis via AlienVault OTX Extraction Details", "Extensive research", "Data Analysis", "Comparative Analysis", "Content servers: https://c.ypcdn.com/", "https://www.superpages.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "XRat", "display_name": "XRat", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ALF:JASYP:PUA:Win32/Systweak", "display_name": "ALF:JASYP:PUA:Win32/Systweak", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Worm:Win32/Nimda", "display_name": "Worm:Win32/Nimda", "target": "/malware/Worm:Win32/Nimda" }, { "id": "HackTool:Win32/Crack", "display_name": "HackTool:Win32/Crack", "target": "/malware/HackTool:Win32/Crack" }, { "id": "ALF:PUA:Win32/OpenCandy", "display_name": "ALF:PUA:Win32/OpenCandy", "target": null }, { "id": "Trojan:Win32/Wacatac", "display_name": "Trojan:Win32/Wacatac", "target": "/malware/Trojan:Win32/Wacatac" }, { "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "target": null }, { "id": "HackTool:PowerShell/Mimikatz", "display_name": "HackTool:PowerShell/Mimikatz", "target": "/malware/HackTool:PowerShell/Mimikatz" }, { "id": "ALF:Program:Win32/Mediaget", "display_name": "ALF:Program:Win32/Mediaget", "target": null }, { "id": "Trojan:Win32/Qbot", "display_name": "Trojan:Win32/Qbot", "target": "/malware/Trojan:Win32/Qbot" }, { "id": "Worm:Win32/Acint", "display_name": "Worm:Win32/Acint", "target": "/malware/Worm:Win32/Acint" }, { "id": "Adwind RAT", "display_name": "Adwind RAT", "target": null }, { "id": "Trojan:Win32/Tiggre", "display_name": "Trojan:Win32/Tiggre", "target": "/malware/Trojan:Win32/Tiggre" }, { "id": "Virus:DOS/Better_Tomorrow", "display_name": "Virus:DOS/Better_Tomorrow", "target": "/malware/Virus:DOS/Better_Tomorrow" }, { "id": "Pony", "display_name": "Pony", "target": null }, { "id": "ALF:PUA:Win32/Rostpay", "display_name": "ALF:PUA:Win32/Rostpay", "target": null }, { "id": "NirCmd", "display_name": "NirCmd", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "trojanx", "display_name": "trojanx", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "target": null }, { "id": "Trojan:Win32/Fuery", "display_name": "Trojan:Win32/Fuery", "target": "/malware/Trojan:Win32/Fuery" }, { "id": "Trojan:Win32/Filetour", "display_name": "Trojan:Win32/Filetour", "target": "/malware/Trojan:Win32/Filetour" }, { "id": "ALF:PUA:Win32/IObit", "display_name": "ALF:PUA:Win32/IObit", "target": null }, { "id": "ALF:Cert:InstallPack", "display_name": "ALF:Cert:InstallPack", "target": null }, { "id": "Ransom:Win32/WannaCrypt", "display_name": "Ransom:Win32/WannaCrypt", "target": "/malware/Ransom:Win32/WannaCrypt" }, { "id": "TROJ_FRS.VSN1EA19", "display_name": "TROJ_FRS.VSN1EA19", "target": null }, { "id": "PE.Heur", "display_name": "PE.Heur", "target": null }, { "id": "Slimware.a", "display_name": "Slimware.a", "target": null }, { "id": "PhishingMS.ABC", "display_name": "PhishingMS.ABC", "target": null }, { "id": "FileRepMetagen [PUP]", "display_name": "FileRepMetagen [PUP]", "target": null }, { "id": "malicious.35bb6b", "display_name": "malicious.35bb6b", "target": null }, { "id": "Agent.3132311", "display_name": "Agent.3132311", "target": null }, { "id": "virus.html.gen03", "display_name": "virus.html.gen03", "target": null }, { "id": "BU", "display_name": "BU", "target": null }, { "id": "Trojan:Win32/Presenoker", "display_name": "Trojan:Win32/Presenoker", "target": "/malware/Trojan:Win32/Presenoker" }, { "id": "Trojan:Win32/Swrort", "display_name": "Trojan:Win32/Swrort", "target": "/malware/Trojan:Win32/Swrort" }, { "id": "ALF:PUA:Win32/Funshion", "display_name": "ALF:PUA:Win32/Funshion", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": "652396e713c1ed328a30e252", "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 14, "hostname": 313, "FileHash-MD5": 187, "FileHash-SHA1": 102, "domain": 115, "URL": 134, "FileHash-SHA256": 169, "FilePath": 1, "CIDR": 1 }, "indicator_count": 1036, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "653fd3ed0900058de627cebc", "name": "Multiple Antagonist", "description": "", "modified": "2023-11-08T04:04:40.217000", "created": "2023-10-30T16:03:57.322000", "tags": [ "heur", "united", "malicious site", "phishing site", "malware", "anonymisation", "ibm xforce", "exchange", "unsafe", "artemis", "formbook", "downloader", "facebook", "bank", "download", "union", "fuery", "team", "qbot", "bankerx", "riskware", "dropper", "nimda", "swrort", "unruy", "adwind", "trojanx", "crack", "win64", "agent", "generic", "alexa top", "million", "team top", "site", "cisco umbrella", "safe site", "malware site", "iframe", "opencandy", "exploit", "zbot", "nircmd", "acint", "downldr", "tiggre", "presenoker", "filetour", "cleaner", "conduit", "wacatac", "quasar rat", "mimikatz", "pony", "funshion", "mywebsearch", "rostpay", "iobit", "mediaget", "systweak", "behav", "genkryptik", "phishing", "alexa", "installpack", "xtrat", "webtoolbar", "trojanspy", "detection list", "blacklist http", "bottom3", "sig10vr3b813", "lcid1033", "smlen", "spn224", "bv7uet92ww", "blacklist", "denver", "s tamarac", "dr ste", "therapists", "centennial", "therahand", "review", "physical", "tomorrow", "hours mon", "dpt", "404", "gettr", "whois record", "referrer", "historical ssl", "contacted", "communicating", "resolutions", "whois whois", "whois ssl", "ssl certificate", "bottom3 http", "FileRepMetagen", "evasive,hyteod,ransomware", "AI_Score_52%", "ATT&CK fonts.gstatic.com", "mitre", "button", "path", "input", "form", "malicious url", "paypal", "team phishing", "filerepmetagen", "azorult", "service", "runescape", "business url", "delivery optout", "superpages url", "us url", "network partner", "google", "windows nt", "khtml", "gecko", "aes128gcm", "gts ca", "europeberlin", "frankfurt", "main", "sign", "people search", "state directory", "join browse", "nail salons", "popular", "the local", "nearby", "strong", "use my", "fakealert", "zpevdo" ], "references": [ "https://www.superpages.com/denver-co/bpp/amp/therahand-472908110", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "Hybrid Analysis via AlienVault OTX Extraction Details", "Extensive research", "Data Analysis", "Comparative Analysis", "Content servers: https://c.ypcdn.com/", "https://www.superpages.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "XRat", "display_name": "XRat", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ALF:JASYP:PUA:Win32/Systweak", "display_name": "ALF:JASYP:PUA:Win32/Systweak", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Worm:Win32/Nimda", "display_name": "Worm:Win32/Nimda", "target": "/malware/Worm:Win32/Nimda" }, { "id": "HackTool:Win32/Crack", "display_name": "HackTool:Win32/Crack", "target": "/malware/HackTool:Win32/Crack" }, { "id": "ALF:PUA:Win32/OpenCandy", "display_name": "ALF:PUA:Win32/OpenCandy", "target": null }, { "id": "Trojan:Win32/Wacatac", "display_name": "Trojan:Win32/Wacatac", "target": "/malware/Trojan:Win32/Wacatac" }, { "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "target": null }, { "id": "HackTool:PowerShell/Mimikatz", "display_name": "HackTool:PowerShell/Mimikatz", "target": "/malware/HackTool:PowerShell/Mimikatz" }, { "id": "ALF:Program:Win32/Mediaget", "display_name": "ALF:Program:Win32/Mediaget", "target": null }, { "id": "Trojan:Win32/Qbot", "display_name": "Trojan:Win32/Qbot", "target": "/malware/Trojan:Win32/Qbot" }, { "id": "Worm:Win32/Acint", "display_name": "Worm:Win32/Acint", "target": "/malware/Worm:Win32/Acint" }, { "id": "Adwind RAT", "display_name": "Adwind RAT", "target": null }, { "id": "Trojan:Win32/Tiggre", "display_name": "Trojan:Win32/Tiggre", "target": "/malware/Trojan:Win32/Tiggre" }, { "id": "Virus:DOS/Better_Tomorrow", "display_name": "Virus:DOS/Better_Tomorrow", "target": "/malware/Virus:DOS/Better_Tomorrow" }, { "id": "Pony", "display_name": "Pony", "target": null }, { "id": "ALF:PUA:Win32/Rostpay", "display_name": "ALF:PUA:Win32/Rostpay", "target": null }, { "id": "NirCmd", "display_name": "NirCmd", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "trojanx", "display_name": "trojanx", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "target": null }, { "id": "Trojan:Win32/Fuery", "display_name": "Trojan:Win32/Fuery", "target": "/malware/Trojan:Win32/Fuery" }, { "id": "Trojan:Win32/Filetour", "display_name": "Trojan:Win32/Filetour", "target": "/malware/Trojan:Win32/Filetour" }, { "id": "ALF:PUA:Win32/IObit", "display_name": "ALF:PUA:Win32/IObit", "target": null }, { "id": "ALF:Cert:InstallPack", "display_name": "ALF:Cert:InstallPack", "target": null }, { "id": "Ransom:Win32/WannaCrypt", "display_name": "Ransom:Win32/WannaCrypt", "target": "/malware/Ransom:Win32/WannaCrypt" }, { "id": "TROJ_FRS.VSN1EA19", "display_name": "TROJ_FRS.VSN1EA19", "target": null }, { "id": "PE.Heur", "display_name": "PE.Heur", "target": null }, { "id": "Slimware.a", "display_name": "Slimware.a", "target": null }, { "id": "PhishingMS.ABC", "display_name": "PhishingMS.ABC", "target": null }, { "id": "FileRepMetagen [PUP]", "display_name": "FileRepMetagen [PUP]", "target": null }, { "id": "malicious.35bb6b", "display_name": "malicious.35bb6b", "target": null }, { "id": "Agent.3132311", "display_name": "Agent.3132311", "target": null }, { "id": "virus.html.gen03", "display_name": "virus.html.gen03", "target": null }, { "id": "BU", "display_name": "BU", "target": null }, { "id": "Trojan:Win32/Presenoker", "display_name": "Trojan:Win32/Presenoker", "target": "/malware/Trojan:Win32/Presenoker" }, { "id": "Trojan:Win32/Swrort", "display_name": "Trojan:Win32/Swrort", "target": "/malware/Trojan:Win32/Swrort" }, { "id": "ALF:PUA:Win32/Funshion", "display_name": "ALF:PUA:Win32/Funshion", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": "653f21acc5a187c1be5fcc90", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 14, "hostname": 313, "FileHash-MD5": 187, "FileHash-SHA1": 102, "domain": 115, "URL": 134, "FileHash-SHA256": 169, "FilePath": 1, "CIDR": 1 }, "indicator_count": 1036, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "636da8bf97228c80948e1569", "name": "http://www.appasamy.com/", "description": "", "modified": "2022-12-11T01:02:56.441000", "created": "2022-11-11T01:43:27.750000", "tags": [ "option", "okdate", "centos", "gmtetag", "windows nt", "null", "islands", "size", "copy md5", "copy sha1", "span", "date", "click", "bounce", "error", "meta", "galaxy", "this", "strings", "contact", "body", "alliance", "hybrid", "general", "hosts", "indonesia", "mexico", "panama", "paraguay", "lucia", "slovak", "ukraine", "uruguay", "form", "april", "tiny", "super", "supra", "iframe", "albania", "armenia", "belarus", "burkina", "chad", "christmas", "cuba", "czech", "hotkey", "android", "class", "core" ], "references": [ "malicious Threat Score: 100/100AV Detection: Marked as cleanLabeled as: Phishing site Link Twitter E-Mail http://www.appasamy.com/ This report is generated from a file or URL submitted to this webservice on November 10th 2022 16:26:16 (UTC) and action script Default browser analysis Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1 Report generated by Falcon Sandbox v9.4.2 \u00a9 Hybrid Analysis Overview Downloads External Reports Re-analyze Hash Not Seen Before Req" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 195, "URL": 584, "hostname": 110, "domain": 99, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1018, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1268 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62b45735fa485bf26a3b666a", "name": "https://take-away.ml/ - interesting - CVE-2021-22941", "description": "", "modified": "2022-07-23T00:04:41.726000", "created": "2022-06-23T12:06:13.537000", "tags": [ "CVE-2021-22941" ], "references": [ "Found decrypted SSL traffic details \"GET / HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: take-away.ml DNT: 1 Connection: Keep-Alive\"- [Source: SSL_145.14.145.152] \"HTTP/1.1 410 Gone Date: Sun, 12 Jun 2022 13:42:10 GMT Content-Type: text/html Content-Length: 16922 Connection: keep-alive ETag: \"5f8d84ab-421a\" Server: awex X-Xss-Protection: 1; mode=block X-Content-Type", "https://hybrid-analysis.com/sample/b1ff0635f1ca2a949dff4616ec2fc455872bc1e6a181e19b3b34461a21fc5304/62a5ec9f239e4f04ec28cf81" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 91, "URL": 235, "FileHash-SHA256": 315, "domain": 68, "CVE": 1, "FileHash-MD5": 46, "FileHash-SHA1": 42 }, "indicator_count": 798, "is_author": false, "is_subscribing": null, "subscriber_count": 394, "modified_text": "1409 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "", "malicious Threat Score: 100/100AV Detection: Marked as cleanLabeled as: Phishing site Link Twitter E-Mail http://www.appasamy.com/ This report is generated from a file or URL submitted to this webservice on November 10th 2022 16:26:16 (UTC) and action script Default browser analysis Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1 Report generated by Falcon Sandbox v9.4.2 \u00a9 Hybrid Analysis Overview Downloads External Reports Re-analyze Hash Not Seen Before Req", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "https://www.superpages.com/", "Verification failure observed in automated verification handlers during sandbox replay.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "Hybrid Analysis via AlienVault OTX Extraction Details", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2", "https://www.superpages.com/denver-co/bpp/amp/therahand-472908110", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "Extensive research", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "Comparative Analysis", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/68e72a3b96eaf61daf0eb13f", "http://catgirls.foundation/main \u2022 https://spaceship.com/", "Content servers: https://c.ypcdn.com/", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all.", "Data Analysis", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "https://hybrid-analysis.com/sample/b1ff0635f1ca2a949dff4616ec2fc455872bc1e6a181e19b3b34461a21fc5304/62a5ec9f239e4f04ec28cf81", "Found decrypted SSL traffic details \"GET / HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: take-away.ml DNT: 1 Connection: Keep-Alive\"- [Source: SSL_145.14.145.152] \"HTTP/1.1 410 Gone Date: Sun, 12 Jun 2022 13:42:10 GMT Content-Type: text/html Content-Length: 16922 Connection: keep-alive ETag: \"5f8d84ab-421a\" Server: awex X-Xss-Protection: 1; mode=block X-Content-Type", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution." ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "Mirai" ], "malware_families": [ "Slimware.a", "Formbook", "Troj_frs.vsn1ea19", "Worm:win32/nimda", "Nircmd", "Trojan:win32/fuery", "Worm:win32/locksky.gen!a", "Trojanspy", "Alf:cert:installpack", "Malicious.35bb6b", "Skynet", "Pe.heur", "Hacktool:powershell/mimikatz", "Alf:pua:win32/iobit", "Trojanx", "Xrat", "Backdoor:win32/zbot", "Alf:pua:win32/funshion", "Trojan:win32/swrort", "Virus.html.gen03", "Maltiverse", "Mirai", "Win.virus.polyransom-5704625-0", "Alf:program:win32/mediaget", "Alf:jasyp:pua:win32/systweak", "Phishingms.abc", "Pony", "Trojan:win32/filetour", "Worm:win32/acint", "Adwind rat", "Alf:heraklezeval:trojandownloader:win32/unruy", "Quasar rat", "Mirai (elf)", "Virus:dos/better_tomorrow", "Filerepmetagen [pup]", "Agent.3132311", "Backdoor:linux/mirai", "Backdoor:linux/demonbot.aa!mtb", "Alf:pua:win32/opencandy", "Bu", "Trojan:win32/wacatac", "Webtoolbar", "Trojan:win32/qbot", "Other malware", "Ransom:win32/wannacrypt", "Trojan:win32/tiggre", "Alf:pua:win32/rostpay", "Hacktool:win32/crack", "#lowfi:siga:trojanspy:msil/keylogger", "Psw.sinowal.x", "Trojan:win32/presenoker" ], "industries": [ "Legal, financial, healthcare, government, municipal, real-estate, enterprise-technology, critical-in" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 14, "pulses": [ { "id": "698e93e1ab02db8c49e8c3ed", "name": "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)", "description": "Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (\u201cBroken Seal\u201d) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.", "modified": "2026-05-17T15:52:35.396000", "created": "2026-02-13T03:00:49.872000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr", "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all." ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28000, "FileHash-SHA256": 48374, "FileHash-MD5": 42596, "FileHash-SHA1": 23243, "hostname": 35654, "URL": 75758, "SSLCertFingerprint": 30, "CVE": 7585, "email": 316, "FileHash-IMPHASH": 8, "CIDR": 26205, "JA3": 1, "URI": 5, "IPv4": 574, "Mutex": 1 }, "indicator_count": 288350, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "14 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bf64e1d5e06aa6207f78de", "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "description": "", "modified": "2026-03-27T00:30:39.055000", "created": "2026-03-22T03:41:21.863000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr" ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": "698e93e1ab02db8c49e8c3ed", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27572, "FileHash-SHA256": 46076, "FileHash-MD5": 42177, "FileHash-SHA1": 22874, "hostname": 33438, "URL": 74810, "SSLCertFingerprint": 21, "CVE": 7579, "email": 297, "FileHash-IMPHASH": 8, "CIDR": 26203, "JA3": 1 }, "indicator_count": 281056, "is_author": false, "is_subscribing": null, "subscriber_count": 149, "modified_text": "66 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bf64eccb5d39a90a3c391e", "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "description": "", "modified": "2026-03-27T00:30:39.055000", "created": "2026-03-22T03:41:32.565000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr" ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": "698e93e1ab02db8c49e8c3ed", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27572, "FileHash-SHA256": 46076, "FileHash-MD5": 42177, "FileHash-SHA1": 22874, "hostname": 33438, "URL": 74810, "SSLCertFingerprint": 21, "CVE": 7579, "email": 297, "FileHash-IMPHASH": 8, "CIDR": 26203, "JA3": 1 }, "indicator_count": 281056, "is_author": false, "is_subscribing": null, "subscriber_count": 152, "modified_text": "66 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6919473b9e0624394e9b68e9", "name": "Backdoor:Linux/DemonBot Affecting Unsecured servers", "description": "A closer look at a hacker group found in Mirai Bot Network. Catgirls is still active , has running web server , is only viewable to group according to remarks regarding \u2018catgirls\u2019 domains , sub domains , hosts.\n\n Multiple hosts , name servers and links. .Backdoor:Linux/DemonBot Malicious attacks affecting unsecured servers (personal , business) networks, DDOS attacks , Mitre. Worm, Ransomware. \n\nHacker group has seemingly caused a fair ammunition of damage to small businesses and / or individuals/civil society.. Seen in attacks against handful of targets are in this Mirai Botnet. Of course we know how very large the Mirai Botnet is.", "modified": "2025-12-16T03:02:09.743000", "created": "2025-11-16T03:38:35.430000", "tags": [ "server", "algorithm", "x509v3 subject", "registrar abuse", "v3 serial", "spaceship", "community", "related pulses", "cidr", "mirai botnet", "hacker", "mirai att", "ck id", "group", "active", "generic pong", "reporting arch", "msie", "windows nt", "resolverror", "backdoor", "malware", "strings", "learn", "command", "name tactics", "suspicious", "informative", "adversaries", "spawns", "evasion att", "t1480 execution", "ipv4", "iocs", "drop", "review iocs", "found", "ascii text", "pattern match", "mitre att", "beginstring", "null", "refresh", "span", "hybrid", "click", "error", "tools", "look", "verify", "restart", "united", "moved", "passive dns", "urls", "record value", "unknown aaaa", "gmt content", "title", "cookie", "signing defense", "t1553 technique", "subvert trust", "controls learn", "disable", "modify tools", "defense evasion", "t1562 technique", "rdap", "domain database", "dap domain", "datab", "database", "array", "content", "ascii", "form", "initial access", "execution", "present aug", "present jul", "present nov", "present oct", "ip address", "command decode", "suricata ipv4", "localappdata", "windir", "openurl c", "programfiles", "edge", "cloudflare", "ssl certificate", "size", "starfield", "accept", "path", "general", "local", "hostname add", "pulse pulses", "read c", "port", "destination", "rgba", "unicode text", "medium", "unknown", "code", "write", "pecompact", "packer", "delphi", "win32", "persistence", "crash", "next", "china unknown", "chrome", "internal server", "next associated", "ipv4 add", "trojandropper", "date", "domain", "search", "domain add", "certificate", "next http", "scans show", "found title", "head body", "hostname", "files", "files ip", "address", "location united", "asn asnone", "present feb", "present jun", "unknown ns", "internet", "emails", "present sep", "show", "memcommit", "gapd5d", "key0", "packing t1045", "filehash", "sha1 add", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "file score", "medium risk", "mirai", "json", "total", "delete", "win64", "url http", "http", "related nids", "files location", "flag united", "gmt cache", "pulse submit", "url analysis", "verdict", "win32dh", "reverse dns", "america flag", "worm", "warehouse mgmt", "built", "retailexperts", "read", "top source", "top destination", "aaaa", "ransom", "trojan", "entries", "singapore", "singapore asn", "as16509", "present mar", "creation date", "contacted", "hostile", "targeting", "whitelisted", "high", "systemroot", "as15169", "copy", "global", "dynamicloader", "directui", "yara rule", "element", "classinfobase", "ccbase", "hwndhost", "windows" ], "references": [ "http://catgirls.foundation/main \u2022 https://spaceship.com/", "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/68e72a3b96eaf61daf0eb13f", "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2", "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2" ], "public": 1, "adversary": "Mirai", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Backdoor:Linux/DemonBot.Aa!MTB", "display_name": "Backdoor:Linux/DemonBot.Aa!MTB", "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB" }, { "id": "Mirai (ELF)", "display_name": "Mirai (ELF)", "target": null }, { "id": "Backdoor:Linux/Mirai", "display_name": "Backdoor:Linux/Mirai", "target": "/malware/Backdoor:Linux/Mirai" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "PSW.Sinowal.X", "display_name": "PSW.Sinowal.X", "target": null }, { "id": "mirai", "display_name": "mirai", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null }, { "id": "Win.Virus.PolyRansom-5704625-0", "display_name": "Win.Virus.PolyRansom-5704625-0", "target": null }, { "id": "Worm:Win32/Locksky.gen!A", "display_name": "Worm:Win32/Locksky.gen!A", "target": "/malware/Worm:Win32/Locksky.gen!A" } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1991, "domain": 428, "hostname": 882, "FileHash-SHA256": 2213, "FileHash-MD5": 675, "FileHash-SHA1": 530, "email": 7, "CIDR": 1, "CVE": 1, "SSLCertFingerprint": 23 }, "indicator_count": 6751, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "167 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "657093ebb4721854f28870a1", "name": "http://www.appasamy.com/", "description": "", "modified": "2023-12-06T15:31:54.924000", "created": "2023-12-06T15:31:54.924000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 110, "domain": 99, "URL": 584, "FileHash-SHA256": 195, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1018, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708fa9137ebcc0549ac8d0", "name": "https://take-away.ml/ - interesting - CVE-2021-22941", "description": "", "modified": "2023-12-06T15:13:45.159000", "created": "2023-12-06T15:13:45.159000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 315, "hostname": 91, "URL": 235, "FileHash-MD5": 46, "FileHash-SHA1": 42, "domain": 68, "CVE": 1 }, "indicator_count": 798, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "652396e713c1ed328a30e252", "name": "Multiple Antagonist", "description": "Multiple antagonist related to this issue.\n\n\nBased on extensive research attack not aimed at medical business. \n\nTargeting: visitors, specified female individual, associates, targets businesses, devices, digital profile , technology, insurance, communications, search redirects, targets route through BN.\n\n\n\nResearch points to multiple involved antagonists, a female target, a clear motive.", "modified": "2023-11-08T04:04:40.217000", "created": "2023-10-09T06:00:07.575000", "tags": [ "heur", "united", "malicious site", "phishing site", "malware", "anonymisation", "ibm xforce", "exchange", "unsafe", "artemis", "formbook", "downloader", "facebook", "bank", "download", "union", "fuery", "team", "qbot", "bankerx", "riskware", "dropper", "nimda", "swrort", "unruy", "adwind", "trojanx", "crack", "win64", "agent", "generic", "alexa top", "million", "team top", "site", "cisco umbrella", "safe site", "malware site", "iframe", "opencandy", "exploit", "zbot", "nircmd", "acint", "downldr", "tiggre", "presenoker", "filetour", "cleaner", "conduit", "wacatac", "quasar rat", "mimikatz", "pony", "funshion", "mywebsearch", "rostpay", "iobit", "mediaget", "systweak", "behav", "genkryptik", "phishing", "alexa", "installpack", "xtrat", "webtoolbar", "trojanspy", "detection list", "blacklist http", "bottom3", "sig10vr3b813", "lcid1033", "smlen", "spn224", "bv7uet92ww", "blacklist", "denver", "s tamarac", "dr ste", "therapists", "centennial", "therahand", "review", "physical", "tomorrow", "hours mon", "dpt", "404", "gettr", "whois record", "referrer", "historical ssl", "contacted", "communicating", "resolutions", "whois whois", "whois ssl", "ssl certificate", "bottom3 http", "FileRepMetagen", "evasive,hyteod,ransomware", "AI_Score_52%", "ATT&CK fonts.gstatic.com", "mitre", "button", "path", "input", "form", "malicious url", "paypal", "team phishing", "filerepmetagen", "azorult", "service", "runescape", "business url", "delivery optout", "superpages url", "us url", "network partner", "google", "windows nt", "khtml", "gecko", "aes128gcm", "gts ca", "europeberlin", "frankfurt", "main", "sign", "people search", "state directory", "join browse", "nail salons", "popular", "the local", "nearby", "strong", "use my", "fakealert", "zpevdo" ], "references": [ "https://www.superpages.com/denver-co/bpp/amp/therahand-472908110", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "Hybrid Analysis via AlienVault OTX Extraction Details", "Extensive research", "Data Analysis", "Comparative Analysis", "Content servers: https://c.ypcdn.com/", "https://www.superpages.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "XRat", "display_name": "XRat", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ALF:JASYP:PUA:Win32/Systweak", "display_name": "ALF:JASYP:PUA:Win32/Systweak", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Worm:Win32/Nimda", "display_name": "Worm:Win32/Nimda", "target": "/malware/Worm:Win32/Nimda" }, { "id": "HackTool:Win32/Crack", "display_name": "HackTool:Win32/Crack", "target": "/malware/HackTool:Win32/Crack" }, { "id": "ALF:PUA:Win32/OpenCandy", "display_name": "ALF:PUA:Win32/OpenCandy", "target": null }, { "id": "Trojan:Win32/Wacatac", "display_name": "Trojan:Win32/Wacatac", "target": "/malware/Trojan:Win32/Wacatac" }, { "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "target": null }, { "id": "HackTool:PowerShell/Mimikatz", "display_name": "HackTool:PowerShell/Mimikatz", "target": "/malware/HackTool:PowerShell/Mimikatz" }, { "id": "ALF:Program:Win32/Mediaget", "display_name": "ALF:Program:Win32/Mediaget", "target": null }, { "id": "Trojan:Win32/Qbot", "display_name": "Trojan:Win32/Qbot", "target": "/malware/Trojan:Win32/Qbot" }, { "id": "Worm:Win32/Acint", "display_name": "Worm:Win32/Acint", "target": "/malware/Worm:Win32/Acint" }, { "id": "Adwind RAT", "display_name": "Adwind RAT", "target": null }, { "id": "Trojan:Win32/Tiggre", "display_name": "Trojan:Win32/Tiggre", "target": "/malware/Trojan:Win32/Tiggre" }, { "id": "Virus:DOS/Better_Tomorrow", "display_name": "Virus:DOS/Better_Tomorrow", "target": "/malware/Virus:DOS/Better_Tomorrow" }, { "id": "Pony", "display_name": "Pony", "target": null }, { "id": "ALF:PUA:Win32/Rostpay", "display_name": "ALF:PUA:Win32/Rostpay", "target": null }, { "id": "NirCmd", "display_name": "NirCmd", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "trojanx", "display_name": "trojanx", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "target": null }, { "id": "Trojan:Win32/Fuery", "display_name": "Trojan:Win32/Fuery", "target": "/malware/Trojan:Win32/Fuery" }, { "id": "Trojan:Win32/Filetour", "display_name": "Trojan:Win32/Filetour", "target": "/malware/Trojan:Win32/Filetour" }, { "id": "ALF:PUA:Win32/IObit", "display_name": "ALF:PUA:Win32/IObit", "target": null }, { "id": "ALF:Cert:InstallPack", "display_name": "ALF:Cert:InstallPack", "target": null }, { "id": "Ransom:Win32/WannaCrypt", "display_name": "Ransom:Win32/WannaCrypt", "target": "/malware/Ransom:Win32/WannaCrypt" }, { "id": "TROJ_FRS.VSN1EA19", "display_name": "TROJ_FRS.VSN1EA19", "target": null }, { "id": "PE.Heur", "display_name": "PE.Heur", "target": null }, { "id": "Slimware.a", "display_name": "Slimware.a", "target": null }, { "id": "PhishingMS.ABC", "display_name": "PhishingMS.ABC", "target": null }, { "id": "FileRepMetagen [PUP]", "display_name": "FileRepMetagen [PUP]", "target": null }, { "id": "malicious.35bb6b", "display_name": "malicious.35bb6b", "target": null }, { "id": "Agent.3132311", "display_name": "Agent.3132311", "target": null }, { "id": "virus.html.gen03", "display_name": "virus.html.gen03", "target": null }, { "id": "BU", "display_name": "BU", "target": null }, { "id": "Trojan:Win32/Presenoker", "display_name": "Trojan:Win32/Presenoker", "target": "/malware/Trojan:Win32/Presenoker" }, { "id": "Trojan:Win32/Swrort", "display_name": "Trojan:Win32/Swrort", "target": "/malware/Trojan:Win32/Swrort" }, { "id": "ALF:PUA:Win32/Funshion", "display_name": "ALF:PUA:Win32/Funshion", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 14, "hostname": 313, "FileHash-MD5": 187, "FileHash-SHA1": 102, "domain": 115, "URL": 134, "FileHash-SHA256": 169, "FilePath": 1, "CIDR": 1 }, "indicator_count": 1036, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6523978d9bc58273e16261a6", "name": "Ransom:Win32/WannaCrypt ", "description": "", "modified": "2023-11-08T04:04:40.217000", "created": "2023-10-09T06:02:53.483000", "tags": [ "heur", "united", "malicious site", "phishing site", "malware", "anonymisation", "ibm xforce", "exchange", "unsafe", "artemis", "formbook", "downloader", "facebook", "bank", "download", "union", "fuery", "team", "qbot", "bankerx", "riskware", "dropper", "nimda", "swrort", "unruy", "adwind", "trojanx", "crack", "win64", "agent", "generic", "alexa top", "million", "team top", "site", "cisco umbrella", "safe site", "malware site", "iframe", "opencandy", "exploit", "zbot", "nircmd", "acint", "downldr", "tiggre", "presenoker", "filetour", "cleaner", "conduit", "wacatac", "quasar rat", "mimikatz", "pony", "funshion", "mywebsearch", "rostpay", "iobit", "mediaget", "systweak", "behav", "genkryptik", "phishing", "alexa", "installpack", "xtrat", "webtoolbar", "trojanspy", "detection list", "blacklist http", "bottom3", "sig10vr3b813", "lcid1033", "smlen", "spn224", "bv7uet92ww", "blacklist", "denver", "s tamarac", "dr ste", "therapists", "centennial", "therahand", "review", "physical", "tomorrow", "hours mon", "dpt", "404", "gettr", "whois record", "referrer", "historical ssl", "contacted", "communicating", "resolutions", "whois whois", "whois ssl", "ssl certificate", "bottom3 http", "FileRepMetagen", "evasive,hyteod,ransomware", "AI_Score_52%", "ATT&CK fonts.gstatic.com", "mitre", "button", "path", "input", "form", "malicious url", "paypal", "team phishing", "filerepmetagen", "azorult", "service", "runescape", "business url", "delivery optout", "superpages url", "us url", "network partner", "google", "windows nt", "khtml", "gecko", "aes128gcm", "gts ca", "europeberlin", "frankfurt", "main", "sign", "people search", "state directory", "join browse", "nail salons", "popular", "the local", "nearby", "strong", "use my", "fakealert", "zpevdo" ], "references": [ "https://www.superpages.com/denver-co/bpp/amp/therahand-472908110", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "Hybrid Analysis via AlienVault OTX Extraction Details", "Extensive research", "Data Analysis", "Comparative Analysis", "Content servers: https://c.ypcdn.com/", "https://www.superpages.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "XRat", "display_name": "XRat", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ALF:JASYP:PUA:Win32/Systweak", "display_name": "ALF:JASYP:PUA:Win32/Systweak", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Worm:Win32/Nimda", "display_name": "Worm:Win32/Nimda", "target": "/malware/Worm:Win32/Nimda" }, { "id": "HackTool:Win32/Crack", "display_name": "HackTool:Win32/Crack", "target": "/malware/HackTool:Win32/Crack" }, { "id": "ALF:PUA:Win32/OpenCandy", "display_name": "ALF:PUA:Win32/OpenCandy", "target": null }, { "id": "Trojan:Win32/Wacatac", "display_name": "Trojan:Win32/Wacatac", "target": "/malware/Trojan:Win32/Wacatac" }, { "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "target": null }, { "id": "HackTool:PowerShell/Mimikatz", "display_name": "HackTool:PowerShell/Mimikatz", "target": "/malware/HackTool:PowerShell/Mimikatz" }, { "id": "ALF:Program:Win32/Mediaget", "display_name": "ALF:Program:Win32/Mediaget", "target": null }, { "id": "Trojan:Win32/Qbot", "display_name": "Trojan:Win32/Qbot", "target": "/malware/Trojan:Win32/Qbot" }, { "id": "Worm:Win32/Acint", "display_name": "Worm:Win32/Acint", "target": "/malware/Worm:Win32/Acint" }, { "id": "Adwind RAT", "display_name": "Adwind RAT", "target": null }, { "id": "Trojan:Win32/Tiggre", "display_name": "Trojan:Win32/Tiggre", "target": "/malware/Trojan:Win32/Tiggre" }, { "id": "Virus:DOS/Better_Tomorrow", "display_name": "Virus:DOS/Better_Tomorrow", "target": "/malware/Virus:DOS/Better_Tomorrow" }, { "id": "Pony", "display_name": "Pony", "target": null }, { "id": "ALF:PUA:Win32/Rostpay", "display_name": "ALF:PUA:Win32/Rostpay", "target": null }, { "id": "NirCmd", "display_name": "NirCmd", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "trojanx", "display_name": "trojanx", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "target": null }, { "id": "Trojan:Win32/Fuery", "display_name": "Trojan:Win32/Fuery", "target": "/malware/Trojan:Win32/Fuery" }, { "id": "Trojan:Win32/Filetour", "display_name": "Trojan:Win32/Filetour", "target": "/malware/Trojan:Win32/Filetour" }, { "id": "ALF:PUA:Win32/IObit", "display_name": "ALF:PUA:Win32/IObit", "target": null }, { "id": "ALF:Cert:InstallPack", "display_name": "ALF:Cert:InstallPack", "target": null }, { "id": "Ransom:Win32/WannaCrypt", "display_name": "Ransom:Win32/WannaCrypt", "target": "/malware/Ransom:Win32/WannaCrypt" }, { "id": "TROJ_FRS.VSN1EA19", "display_name": "TROJ_FRS.VSN1EA19", "target": null }, { "id": "PE.Heur", "display_name": "PE.Heur", "target": null }, { "id": "Slimware.a", "display_name": "Slimware.a", "target": null }, { "id": "PhishingMS.ABC", "display_name": "PhishingMS.ABC", "target": null }, { "id": "FileRepMetagen [PUP]", "display_name": "FileRepMetagen [PUP]", "target": null }, { "id": "malicious.35bb6b", "display_name": "malicious.35bb6b", "target": null }, { "id": "Agent.3132311", "display_name": "Agent.3132311", "target": null }, { "id": "virus.html.gen03", "display_name": "virus.html.gen03", "target": null }, { "id": "BU", "display_name": "BU", "target": null }, { "id": "Trojan:Win32/Presenoker", "display_name": "Trojan:Win32/Presenoker", "target": "/malware/Trojan:Win32/Presenoker" }, { "id": "Trojan:Win32/Swrort", "display_name": "Trojan:Win32/Swrort", "target": "/malware/Trojan:Win32/Swrort" }, { "id": "ALF:PUA:Win32/Funshion", "display_name": "ALF:PUA:Win32/Funshion", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": "652396e713c1ed328a30e252", "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 14, "hostname": 313, "FileHash-MD5": 187, "FileHash-SHA1": 102, "domain": 115, "URL": 134, "FileHash-SHA256": 169, "FilePath": 1, "CIDR": 1 }, "indicator_count": 1036, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "653f1b9d7b8c6e2836f2c1a5", "name": "Ransom:Win32/WannaCrypt", "description": "", "modified": "2023-11-08T04:04:40.217000", "created": "2023-10-30T02:57:33.289000", "tags": [ "heur", "united", "malicious site", "phishing site", "malware", "anonymisation", "ibm xforce", "exchange", "unsafe", "artemis", "formbook", "downloader", "facebook", "bank", "download", "union", "fuery", "team", "qbot", "bankerx", "riskware", "dropper", "nimda", "swrort", "unruy", "adwind", "trojanx", "crack", "win64", "agent", "generic", "alexa top", "million", "team top", "site", "cisco umbrella", "safe site", "malware site", "iframe", "opencandy", "exploit", "zbot", "nircmd", "acint", "downldr", "tiggre", "presenoker", "filetour", "cleaner", "conduit", "wacatac", "quasar rat", "mimikatz", "pony", "funshion", "mywebsearch", "rostpay", "iobit", "mediaget", "systweak", "behav", "genkryptik", "phishing", "alexa", "installpack", "xtrat", "webtoolbar", "trojanspy", "detection list", "blacklist http", "bottom3", "sig10vr3b813", "lcid1033", "smlen", "spn224", "bv7uet92ww", "blacklist", "denver", "s tamarac", "dr ste", "therapists", "centennial", "therahand", "review", "physical", "tomorrow", "hours mon", "dpt", "404", "gettr", "whois record", "referrer", "historical ssl", "contacted", "communicating", "resolutions", "whois whois", "whois ssl", "ssl certificate", "bottom3 http", "FileRepMetagen", "evasive,hyteod,ransomware", "AI_Score_52%", "ATT&CK fonts.gstatic.com", "mitre", "button", "path", "input", "form", "malicious url", "paypal", "team phishing", "filerepmetagen", "azorult", "service", "runescape", "business url", "delivery optout", "superpages url", "us url", "network partner", "google", "windows nt", "khtml", "gecko", "aes128gcm", "gts ca", "europeberlin", "frankfurt", "main", "sign", "people search", "state directory", "join browse", "nail salons", "popular", "the local", "nearby", "strong", "use my", "fakealert", "zpevdo" ], "references": [ "https://www.superpages.com/denver-co/bpp/amp/therahand-472908110", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "Hybrid Analysis via AlienVault OTX Extraction Details", "Extensive research", "Data Analysis", "Comparative Analysis", "Content servers: https://c.ypcdn.com/", "https://www.superpages.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "XRat", "display_name": "XRat", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ALF:JASYP:PUA:Win32/Systweak", "display_name": "ALF:JASYP:PUA:Win32/Systweak", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Worm:Win32/Nimda", "display_name": "Worm:Win32/Nimda", "target": "/malware/Worm:Win32/Nimda" }, { "id": "HackTool:Win32/Crack", "display_name": "HackTool:Win32/Crack", "target": "/malware/HackTool:Win32/Crack" }, { "id": "ALF:PUA:Win32/OpenCandy", "display_name": "ALF:PUA:Win32/OpenCandy", "target": null }, { "id": "Trojan:Win32/Wacatac", "display_name": "Trojan:Win32/Wacatac", "target": "/malware/Trojan:Win32/Wacatac" }, { "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "target": null }, { "id": "HackTool:PowerShell/Mimikatz", "display_name": "HackTool:PowerShell/Mimikatz", "target": "/malware/HackTool:PowerShell/Mimikatz" }, { "id": "ALF:Program:Win32/Mediaget", "display_name": "ALF:Program:Win32/Mediaget", "target": null }, { "id": "Trojan:Win32/Qbot", "display_name": "Trojan:Win32/Qbot", "target": "/malware/Trojan:Win32/Qbot" }, { "id": "Worm:Win32/Acint", "display_name": "Worm:Win32/Acint", "target": "/malware/Worm:Win32/Acint" }, { "id": "Adwind RAT", "display_name": "Adwind RAT", "target": null }, { "id": "Trojan:Win32/Tiggre", "display_name": "Trojan:Win32/Tiggre", "target": "/malware/Trojan:Win32/Tiggre" }, { "id": "Virus:DOS/Better_Tomorrow", "display_name": "Virus:DOS/Better_Tomorrow", "target": "/malware/Virus:DOS/Better_Tomorrow" }, { "id": "Pony", "display_name": "Pony", "target": null }, { "id": "ALF:PUA:Win32/Rostpay", "display_name": "ALF:PUA:Win32/Rostpay", "target": null }, { "id": "NirCmd", "display_name": "NirCmd", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "trojanx", "display_name": "trojanx", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "target": null }, { "id": "Trojan:Win32/Fuery", "display_name": "Trojan:Win32/Fuery", "target": "/malware/Trojan:Win32/Fuery" }, { "id": "Trojan:Win32/Filetour", "display_name": "Trojan:Win32/Filetour", "target": "/malware/Trojan:Win32/Filetour" }, { "id": "ALF:PUA:Win32/IObit", "display_name": "ALF:PUA:Win32/IObit", "target": null }, { "id": "ALF:Cert:InstallPack", "display_name": "ALF:Cert:InstallPack", "target": null }, { "id": "Ransom:Win32/WannaCrypt", "display_name": "Ransom:Win32/WannaCrypt", "target": "/malware/Ransom:Win32/WannaCrypt" }, { "id": "TROJ_FRS.VSN1EA19", "display_name": "TROJ_FRS.VSN1EA19", "target": null }, { "id": "PE.Heur", "display_name": "PE.Heur", "target": null }, { "id": "Slimware.a", "display_name": "Slimware.a", "target": null }, { "id": "PhishingMS.ABC", "display_name": "PhishingMS.ABC", "target": null }, { "id": "FileRepMetagen [PUP]", "display_name": "FileRepMetagen [PUP]", "target": null }, { "id": "malicious.35bb6b", "display_name": "malicious.35bb6b", "target": null }, { "id": "Agent.3132311", "display_name": "Agent.3132311", "target": null }, { "id": "virus.html.gen03", "display_name": "virus.html.gen03", "target": null }, { "id": "BU", "display_name": "BU", "target": null }, { "id": "Trojan:Win32/Presenoker", "display_name": "Trojan:Win32/Presenoker", "target": "/malware/Trojan:Win32/Presenoker" }, { "id": "Trojan:Win32/Swrort", "display_name": "Trojan:Win32/Swrort", "target": "/malware/Trojan:Win32/Swrort" }, { "id": "ALF:PUA:Win32/Funshion", "display_name": "ALF:PUA:Win32/Funshion", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": "6523978d9bc58273e16261a6", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 14, "hostname": 313, "FileHash-MD5": 187, "FileHash-SHA1": 102, "domain": 115, "URL": 134, "FileHash-SHA256": 169, "FilePath": 1, "CIDR": 1 }, "indicator_count": 1036, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "653f1cc68d8465d74f49192f", "name": "Ransom:Win32/WannaCrypt", "description": "", "modified": "2023-11-08T04:04:40.217000", "created": "2023-10-30T03:02:30.391000", "tags": [ "heur", "united", "malicious site", "phishing site", "malware", "anonymisation", "ibm xforce", "exchange", "unsafe", "artemis", "formbook", "downloader", "facebook", "bank", "download", "union", "fuery", "team", "qbot", "bankerx", "riskware", "dropper", "nimda", "swrort", "unruy", "adwind", "trojanx", "crack", "win64", "agent", "generic", "alexa top", "million", "team top", "site", "cisco umbrella", "safe site", "malware site", "iframe", "opencandy", "exploit", "zbot", "nircmd", "acint", "downldr", "tiggre", "presenoker", "filetour", "cleaner", "conduit", "wacatac", "quasar rat", "mimikatz", "pony", "funshion", "mywebsearch", "rostpay", "iobit", "mediaget", "systweak", "behav", "genkryptik", "phishing", "alexa", "installpack", "xtrat", "webtoolbar", "trojanspy", "detection list", "blacklist http", "bottom3", "sig10vr3b813", "lcid1033", "smlen", "spn224", "bv7uet92ww", "blacklist", "denver", "s tamarac", "dr ste", "therapists", "centennial", "therahand", "review", "physical", "tomorrow", "hours mon", "dpt", "404", "gettr", "whois record", "referrer", "historical ssl", "contacted", "communicating", "resolutions", "whois whois", "whois ssl", "ssl certificate", "bottom3 http", "FileRepMetagen", "evasive,hyteod,ransomware", "AI_Score_52%", "ATT&CK fonts.gstatic.com", "mitre", "button", "path", "input", "form", "malicious url", "paypal", "team phishing", "filerepmetagen", "azorult", "service", "runescape", "business url", "delivery optout", "superpages url", "us url", "network partner", "google", "windows nt", "khtml", "gecko", "aes128gcm", "gts ca", "europeberlin", "frankfurt", "main", "sign", "people search", "state directory", "join browse", "nail salons", "popular", "the local", "nearby", "strong", "use my", "fakealert", "zpevdo" ], "references": [ "https://www.superpages.com/denver-co/bpp/amp/therahand-472908110", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "Hybrid Analysis via AlienVault OTX Extraction Details", "Extensive research", "Data Analysis", "Comparative Analysis", "Content servers: https://c.ypcdn.com/", "https://www.superpages.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "XRat", "display_name": "XRat", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ALF:JASYP:PUA:Win32/Systweak", "display_name": "ALF:JASYP:PUA:Win32/Systweak", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Worm:Win32/Nimda", "display_name": "Worm:Win32/Nimda", "target": "/malware/Worm:Win32/Nimda" }, { "id": "HackTool:Win32/Crack", "display_name": "HackTool:Win32/Crack", "target": "/malware/HackTool:Win32/Crack" }, { "id": "ALF:PUA:Win32/OpenCandy", "display_name": "ALF:PUA:Win32/OpenCandy", "target": null }, { "id": "Trojan:Win32/Wacatac", "display_name": "Trojan:Win32/Wacatac", "target": "/malware/Trojan:Win32/Wacatac" }, { "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger", "target": null }, { "id": "HackTool:PowerShell/Mimikatz", "display_name": "HackTool:PowerShell/Mimikatz", "target": "/malware/HackTool:PowerShell/Mimikatz" }, { "id": "ALF:Program:Win32/Mediaget", "display_name": "ALF:Program:Win32/Mediaget", "target": null }, { "id": "Trojan:Win32/Qbot", "display_name": "Trojan:Win32/Qbot", "target": "/malware/Trojan:Win32/Qbot" }, { "id": "Worm:Win32/Acint", "display_name": "Worm:Win32/Acint", "target": "/malware/Worm:Win32/Acint" }, { "id": "Adwind RAT", "display_name": "Adwind RAT", "target": null }, { "id": "Trojan:Win32/Tiggre", "display_name": "Trojan:Win32/Tiggre", "target": "/malware/Trojan:Win32/Tiggre" }, { "id": "Virus:DOS/Better_Tomorrow", "display_name": "Virus:DOS/Better_Tomorrow", "target": "/malware/Virus:DOS/Better_Tomorrow" }, { "id": "Pony", "display_name": "Pony", "target": null }, { "id": "ALF:PUA:Win32/Rostpay", "display_name": "ALF:PUA:Win32/Rostpay", "target": null }, { "id": "NirCmd", "display_name": "NirCmd", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "trojanx", "display_name": "trojanx", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "target": null }, { "id": "Trojan:Win32/Fuery", "display_name": "Trojan:Win32/Fuery", "target": "/malware/Trojan:Win32/Fuery" }, { "id": "Trojan:Win32/Filetour", "display_name": "Trojan:Win32/Filetour", "target": "/malware/Trojan:Win32/Filetour" }, { "id": "ALF:PUA:Win32/IObit", "display_name": "ALF:PUA:Win32/IObit", "target": null }, { "id": "ALF:Cert:InstallPack", "display_name": "ALF:Cert:InstallPack", "target": null }, { "id": "Ransom:Win32/WannaCrypt", "display_name": "Ransom:Win32/WannaCrypt", "target": "/malware/Ransom:Win32/WannaCrypt" }, { "id": "TROJ_FRS.VSN1EA19", "display_name": "TROJ_FRS.VSN1EA19", "target": null }, { "id": "PE.Heur", "display_name": "PE.Heur", "target": null }, { "id": "Slimware.a", "display_name": "Slimware.a", "target": null }, { "id": "PhishingMS.ABC", "display_name": "PhishingMS.ABC", "target": null }, { "id": "FileRepMetagen [PUP]", "display_name": "FileRepMetagen [PUP]", "target": null }, { "id": "malicious.35bb6b", "display_name": "malicious.35bb6b", "target": null }, { "id": "Agent.3132311", "display_name": "Agent.3132311", "target": null }, { "id": "virus.html.gen03", "display_name": "virus.html.gen03", "target": null }, { "id": "BU", "display_name": "BU", "target": null }, { "id": "Trojan:Win32/Presenoker", "display_name": "Trojan:Win32/Presenoker", "target": "/malware/Trojan:Win32/Presenoker" }, { "id": "Trojan:Win32/Swrort", "display_name": "Trojan:Win32/Swrort", "target": "/malware/Trojan:Win32/Swrort" }, { "id": "ALF:PUA:Win32/Funshion", "display_name": "ALF:PUA:Win32/Funshion", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": "6523978d9bc58273e16261a6", "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 14, "hostname": 313, "FileHash-MD5": 187, "FileHash-SHA1": 102, "domain": 115, "URL": 134, "FileHash-SHA256": 169, "FilePath": 1, "CIDR": 1 }, "indicator_count": 1036, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "cloudyoryx.dev", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "cloudyoryx.dev", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780294540.3100557 }