{ "type": "Domain", "indicator": "colocrossing.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/colocrossing.com", "alexa": "http://www.alexa.com/siteinfo/colocrossing.com", "indicator": "colocrossing.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 191445, "indicator": "colocrossing.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 14, "pulses": [ { "id": "69e2cc9ebd63c32d9c0392c6", "name": "Hidden Tear BruteForcer Clone Credit OctoSeek", "description": "", "modified": "2026-04-18T00:13:18.484000", "created": "2026-04-18T00:13:18.484000", "tags": [ "no expiration", "domain", "hostname", "expiration", "filehashsha256", "ipv4", "url http", "url https", "iocs", "filehashsha1", "next", "x509v3", "key", "windows", "write", "whois ssl", "whois whois", "win32", "198-46-194-153-host.colocrossing.com", "a domains", "a nxdomain", "aaaa", "accept", "adapter driver", "address", "address domain", "algorithm", "all octoseek", "cookie", "copy", "core", "domain names", "domain", "dnssec", "discord", "whois record", "cyberstalking", "d417n", "timestamp", "data", "subject", "cyberstalking", "creation date", "ipv4", "ip address", "http identifier", "hostname", "historical ssl", "highly targeted", "high level", "high", "hiddentear", "gmtn", "germany unknown", "location first", "ip files", "files", "false files", "eu data", "entries", "download encrypt", "encrypt", "download", "contacted", "communicating", "coinminer", "code", "cobalt strike", "cname", "click", "ca issuers", "issuers", "as133618", "as24940", "hetzner", "as26710", "icann", "as36352", "as24940 hetzner", "asn as133618", "as26710 icann", "apple as8075", "as47846", "as47995", "key algorithm", "united", "name", "type", "tsara brashears", "trojan", "key identifier", "key info", "land use", "link location", "united tls web", "tls web", "log id", "malvertizing", "malware", "http", "meekserver", "meta", "metasploit", "admin", "subject", "ransomware", "stop ransomware", "certificate status", "metro", "moved", "name servers", "netsupport rat", "number", "nxdomain", "passive dns", "servers", "server", "pegasus", "pingback", "submit", "ransom", "raspberry robin", "subject public", "subject key", "subject billing", "pdf broadcom", "pulse pulses", "pulse submit", "read c", "record value", "redacted referrer", "regbinary", "regdword", "registrant fax", "registrar", "registrar abuse", "registry domain", "registrar of", "registry policy", "regsetvalueexa", "regsetvalueexw", "show", "showing", "search", "urls", "script", "script domains", "scan endpoints", "russia unknown", "reverse dns", "resolutions", "nids", "related nids", "as39494 jsc", "body", "attorney james", "asn as133618", "javascript", "unknown", "url analysis", "unknown url", "url http", "v3 serial", "http", "as40528 icann", "as44273 host", "data center", "hosting", "vps", "reverse dns" ], "references": [ "deviceinbox.com [Malware Hosting - Pegasus]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]", "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]", "103.224.182.253 [Command and Control]", "198.46.194.153 [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia" ], "malware_families": [ { "id": "HiddenTear", "display_name": "HiddenTear", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [ "Civil Society" ], "TLP": "white", "cloned_from": "65b60b85453c45eca795034d", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 77, "FileHash-SHA1": 81, "FileHash-SHA256": 359, "URL": 218, "SSLCertFingerprint": 2, "domain": 1932, "email": 12, "hostname": 528 }, "indicator_count": 3209, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "46 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6958780c8479a9d69920c3d8", "name": "Telnet - Mirai \u2022 Dark Nexus BusyBox iOS Attack", "description": "There\u2019s enough here to cause an outage. I will stop here. Illegal activities to silence victim and block her from financial settlement award for permanent injuries under workers compensation in a premise and healthcare worker assault scenario. Attorneys estimated her case to be above $100 million but knew she\u2019d be tampered with. Mark Montano MD forewarned her but is culpable. Still attacking family of victim.\n[ True- otx auto generated: Adversaries may be able to gain access to a victim's network through a drive-by attack, as well as using a short-term SSL certificate, in order to target the victim.] |||\nPositive:\nT1140 - Deobfuscate/Decode Files or Information\nSuspicious IP Address\n104.21.51.140, 172.67.181.41\nLocation United States ASN\nModif AS13335 cloudflare\nAutomate Nameservers:\nns1.colocrossing.com.", "modified": "2026-02-02T01:02:46.327000", "created": "2026-01-03T01:59:40.530000", "tags": [ "united", "moved", "title", "passive dns", "ipv4 add", "urls", "files", "hosting", "reverse dns", "location united", "hash avast", "avg clamav", "msdefender mar", "read c", "create c", "medium", "search", "memcommit", "high", "checks", "windows", "execution", "dock", "write", "persistence", "capture", "local", "ref b", "wed may", "backdoor", "mtb aug", "next associated", "mtb dec", "twitter", "smoke loader", "malware", "virtool", "hacktool", "data upload", "present dec", "mtb apr", "win32", "trojan", "worm", "lowfi", "cybota", "expiration date", "name servers", "ipv4", "url analysis", "port", "destination", "telnet login", "bad login", "gpl telnet", "suspicious path", "busybox", "tcp syn", "et telnet", "path", "mirai", "filehash", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "file score", "america", "ck id", "name tactics", "suspicious", "informative", "learn", "t1179 hooking", "installs", "t1035 service", "adversaries", "msie", "windows nt", "slcc2", "media center", "y013", "flag", "span", "accept", "core", "february", "hybrid", "malicious", "general", "click", "strings", "roboto", "next", "usa windows", "finished", "queueprogress", "timestamp input", "threat level", "october", "september", "hwp support", "fresh", "win64", "khtml", "gecko", "brand", "microsoft edge", "programfiles", "comspec", "model", "iframe", "form", "listeners", "initial access", "t1590 gather", "victim network", "ssl certificate", "quasi government", "jeffrey reimer", "palantir", "Regis university", "otx hp", "apple", "pegasus", "h5 data center", "florence colorado", "brian sabey", "target : Tsara Brasheaers", "aig", "industry and commerce", "united states", "State of Colorado.", "date", "status", "domain", "hostname add", "pulse pulses", "files ip", "address", "url https", "url http", "hostname", "show", "type indicator", "source hostname", "entries", "Prometheus Intelligence Technology", "pulse submit", "america flag", "body", "dynamicloader", "microsoft azure", "tls issuing", "named pipe", "json", "ascii text", "lredmond", "Apple", "Telnet", "BusyBox", "Pegasus", "Colorado State Fixer: Christopher P. Ahmann", "Hijacker: Brian Sabey", "For: Concentra", "Protecting Assaulter: Jeffrey Reimer", "For: AIG", "For Industry and Commerce", "For: Quasi Government", "For: Workers Compensation", "Authorities", "Law Enforcement Dark", "Silencing", "Tampering with a Victim", "Meta", "Palantir", "Google", "Bing", "Microsoft", "ColoCrossing", "Associates", "hit men" ], "references": [ "ET Telnet | https://www.colocrossing.com | velocity servers", "https://www.endgamesystems.com/\t This is not a game. This is about people\u2019s lives", "TELNET SUSPICIOUS Path to BusyBox\", TELNET login failed\", is__elf \u007fELF dead_host", "Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)", "(legitimate services will remain up-and-running usually) High | ID dead_host", "ELF:Mirai-GH\\ [Trj] , Unix.Trojan.DarkNexus-7679166-0", "IDS Detections SUSPICIOUS Path to BusyBox TELNET login failed Bad Login", "Yara Detections is__elf", "Alerts dead_host network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout", "Yara Detections is__elf , ELFHighEntropy , elf_empty_sections", "http://appleid.apple.com.msg206.site/ http://www.icloud.com.msg206.site/ https://appleid.apple.com.msg206.site/", "https://colocrossing.com/ \u2022 https://www.colocrossing.com/colocation\t l", "https://prometheussteakhouse.lupi.delivery/ Thanks! I\u2019m heavy into Picinha. 2 Brazilian roasts please!", "https://www.colocrossing.com/", "(TLI did you do her that dirty?) Why\u2019SCS\u2019? Pure shame on you.", "In all seriousness. The severity of injuries and outcomes 1 victim had is aligned cyber attacks by Q.Gov", "104.21.51.140, 172.67.181.41", "Detections Win.Packed.ImminentMonitorRAT-9892275-0 , HackTool:MSIL/Boilod.C!bit", "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)", "Alerts: procmem_yara injection_inter_process ransomware_file_modifications stack_pivot", "stealth_file cape_detected_threat injection_process_hollowing antiav_detectfile injection_runpe", "Alerts: cape_extracted_content infostealer_cookies recon_fingerprint powershell_download", "Alerts: dynamic_function_loading ipc_namedpipe createtoolhelp32snapshot_module_enumeration", "IP\u2019s Contacted: 142.250.147.101 88.221.104.56 13.33.141.29 35.186.249.72 151.101.1.192", "IP\u2019s Contacted 178.249.97.99 178.249.97.98 178.249.97.23 84.53.172.74 88.221.104.82", "Domains Contacted: accounts.google.com chrome.cloudflare-dns.com clients2.googleusercontent.com", "This is hard to comprehend or put into indelible words." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Unix.Trojan.DarkNexus-7679166-0", "display_name": "Unix.Trojan.DarkNexus-7679166-0", "target": null }, { "id": "HackTool:MSIL/Boilod.C!bit", "display_name": "HackTool:MSIL/Boilod.C!bit", "target": "/malware/HackTool:MSIL/Boilod.C!bit" } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" }, { "id": "T1098", "name": "Account Manipulation", "display_name": "T1098 - Account Manipulation" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1557", "name": "Man-in-the-Middle", "display_name": "T1557 - Man-in-the-Middle" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1462", "name": "Malicious Software Development Tools", "display_name": "T1462 - Malicious Software Development Tools" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1459", "name": "Device Unlock Code Guessing or Brute Force", "display_name": "T1459 - Device Unlock Code Guessing or Brute Force" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" } ], "industries": [ "Technology", "Healthcare", "Insurance", "Civil Society" ], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6390, "domain": 723, "hostname": 1978, "FileHash-SHA256": 1912, "FileHash-MD5": 410, "FileHash-SHA1": 306, "email": 3, "SSLCertFingerprint": 28, "CVE": 3 }, "indicator_count": 11753, "is_author": false, "is_subscribing": null, "subscriber_count": 146, "modified_text": "121 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6647908c09468f42bc1249f1", "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution", "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com", "modified": "2025-03-01T04:59:57.222000", "created": "2024-05-17T17:14:52.317000", "tags": [ "false", "true", "visible", "application", "microsoft teams", "microsoft azure", "office", "service", "dynamics", "hidden", "android", "explorer", "write", "connector", "test", "sharepoint", "live", "meister", "tools", "desktop", "spark", "front", "enterprise", "designer", "atlas", "premium", "assistant", "allow", "azureadmyorg", "game", "verify", "microsoft power", "channelsurfcli", "mtd1", "file transfer", "magnus", "microsoft crm", "youth" ], "references": [ "All - EnterpriseAppsList.csv", "AppRegistrationList.csv", "https://tria.ge/240517-vc7c1shc62/behavioral1", "https://tria.ge/240517-vdwb5shc71/behavioral1", "https://tria.ge/240517-vqxezaaa33/behavioral1", "https://tria.ge/240517-t9pc2ahb2t", "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary", "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb", "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7", "Thor Scan: S-I9VvMTB6cZU", "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview", "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview", "https://imp0rtp3.wordpress.com/2021/08/12/tetris/", "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview", "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview", "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview", "https://tria.ge/240521-q4s79agb25/static1", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093", "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview", "https://www.filescan.io/uploads/666d69ff6b8dba248b414767", "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3", "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b", "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2", "https://www.hudsonrock.com/search?domain=ualberta.ca", "https://www.criminalip.io/domain/report?scan_id=13798622", "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24", "https://urlscan.io/search/#ualberta.ca", "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs", "https://sitereport.netcraft.com/?url=http://ualberta.ca", "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/", "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll", "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark", "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22", "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22", "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22", "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Healthcare", "Telecommunications", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 7, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1703, "FileHash-SHA256": 90472, "URL": 99185, "domain": 82954, "hostname": 39041, "FileHash-SHA1": 1624, "email": 4658, "CVE": 12 }, "indicator_count": 319649, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "459 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6780c2bbe4bf55e164177223", "name": "Panda C2 domains", "description": "", "modified": "2025-01-10T06:48:27.646000", "created": "2025-01-10T06:48:27.646000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 101 }, "indicator_count": 101, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66c76a410bca940a8cb84f91", "name": "Remote Access - Dynamic DNS | Injection", "description": "Blamed for Botnet exchange, Ddos, ssh, email spamming, brute forcing emails, sending viruses/trojans to countless emails, injection, app installation, gov , bank employee targeting, etc. Listed ALL victim information in downed WikiLeaks website.The list is long, Swipper is still a mystery. The name has been linked to an IT graduate. This doesn't mean much as hackers frame everyone. The [person or links to does link back to subject of hacks against a targeted person. When target researched Swipper EVERYTHING related was cleaned from the Internet.\n\nThe best clue deleted was for IP's in the 152.199.0.0/24 Block. \nThe other was used by Brian Sabey who used service to distribute So much porn (and worse) all with targets name! It was a 'hopto' N\u2205 IP address. It disappeared so fast along with any trace.", "modified": "2024-09-21T14:04:09.409000", "created": "2024-08-22T16:41:37.285000", "tags": [ "referrer", "nanocore rat", "hunting guide", "your apt", "malware", "bitter apt", "using zxxz", "backdoor", "pakistan public", "committee", "ukraine", "maxage7200", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "dynamic dns", "access", "html info", "title remote", "ddns account", "meta tags", "ip address", "trackers amazon", "tag manager", "cookies noipbid", "netrange", "nethandle", "net152", "net1520000", "as1321", "inc orgid", "loudoun county", "parkway city", "postalcode", "content", "utc google", "gtmvfgb", "utc ggg8ybn7flc", "gg8ybn7flc", "samples", "no data", "tag count", "analyzer threat", "ip summary", "summary", "detection list", "heur", "malicious site", "malicious host", "services", "exchange botnet", "command", "control server", "host", "azorult", "pony", "asyncrat", "cobalt strike", "phishing", "team", "dropper", "crypt", "outbreak", "mimikatz", "riskware", "trojanx", "cisco umbrella", "site", "safe site", "redline stealer", "generic pua", "malware site", "utorrent", "generic", "yakes", "agent", "adposhel", "zbot", "cl0p", "managed dns", "strong", "noip", "please", "buy plus", "managed", "free", "service", "already", "read c", "dll read", "function read", "medium", "systemroot", "search", "high", "smtp host", "virustotal", "trojan", "write", "drweb", "vipre", "panda", "phishing", "ransomware", "rat", "swipper", "swipp9", "vj92", "uagdaaeqcqaaaag", "ukgbagaqcqaaaae", "slfrd1", "hostnames", "ukgbagaqcq", "jid1886833764", "jid882556742", "unknown", "as36947", "algeria unknown", "germany unknown", "as37340", "nigeria unknown", "united kingdom", "as200350", "france unknown", "date", "z557338487", "z129433407", "z2111579734", "name servers", "passive dns", "as14627", "scan endpoints", "all scoreblue", "next", "aaaa", "asnone united", "moved", "certificate", "rsa ca", "ipv4", "pulse pulses", "win32", "process32nextw", "onlogon ru", "discovery", "t1057", "discovery t1057", "windows", "post http", "actionhello", "delphi", "dock", "memcommit", "writeconsolea", "nat monitor", "f tn", "delete c", "write c", "create c", "autoit", "look", "suspicious", "as9009 m247", "sri lanka", "domain", "creation date", "hungary unknown", "as36352", "files", "hosting", "reverse dns", "all search", "otx scoreblue", "hostname", "pulse submit", "url analysis", "status", "mtb sep", "record value", "servers", "gmt server", "pecancer", "as15169 google", "mtb apr", "open ports", "trojandropper", "gmt cache", "cashreminder", "philadelphia", "status hostname", "query type", "address first", "seen last", "seen asn", "country unknown", "nxdomain", "a nxdomain", "encrypt", "body", "present mar", "emails", "domain name", "expiration date", "error", "code", "location united", "united states", "malicious.75188e", "united", "icmp traffic", "pe section", "low software", "packing t1045", "t1045", "pe resource", "filehash", "ireland unknown", "as396982 google", "belgium unknown", "as24940 hetzner", "trojan process", "file samples", "files matching", "show", "date hash", "worm features", "related pulses", "malware process", "trojan features", "brute force", "brute forcing emails", "hacking", "logan utah", "ddos attack", "web app attacks", "bad web bot", "cwaf", "verizon enterprise" ], "references": [ "Title: The page title. Remote Access - Dynamic DNS - Create a Free DDNS Account Now - No-IP", "http://hopto.org/colocrossing/192.3.13.56/telco", "N\u2205 IP: https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco", "SLF:Trojan:Win32/Grandoreiro.A - FILEHASH - SHA256 5253cfaec7456b9fe440ab25207b8e1ff948b04fc2f2f34befc2354bf4431d07", "FILEHASH - SHA256 253cfaec7456b9fe440ab25207b8e1ff948b04fc2f2f34befc2354bf4431d07 | IP\u2019s Contacted: 34.117.59.81", "Malicious Antivirus Detections SLF:Trojan:Win32/Grandoreiro.A Yara Detections md5_constants , Delphi ,", "IDS Defections: Possible Cerber Ransomware IP Check Possible ET INFO RealThinClient Session Init", "IDS Defections: Possible External IP Lookup ipinfo.io DNS Query to DynDNS Domain *.ddns .me", "Alerts: network_icmp antianalysis_detectfile antidbg_windows antivm_generic_scsi", "Alerts: sysinternals_tools_usage antivm_vmware_in_instruction persistence_autorun", "Yara Detections: XOR_embeded_exefile_xored_with_round_256_bytes_key", "Malware.Nymeria-6993588-0: FileHash-SHA256 9dddb78cec49c05f2bec6f2583e4d8a663435f5a265a09a5966d5d4bfa866761", "NanoCore RAT CnC 7 : FileHash-SHA256 0031cb925e76f801a0ca2ebbc32029be927687f0d6183777be917878ffd7cd4b", "CVE-2023-23397 | scanning_host IPv4 158.247.7.206 scanning_host IP's: 192.3.13.56 158.247.7.206", "Whois-RWS ; Name, SWIPPER ; Handle, SWIPP9-ARIN ; Company, Verizon ; Street, 22001 Loudoun County Pkwy.", "Whois-RWS ; Name, SWIPPER ; Handle, SWIPP9-ARIN ; Company, Verizon ; Street, 22001", "Is Swipper: pool-70-21-23-161.washdc.fios.verizon.net", "SWIPPER - IP: 152.199.161.19 ISP Edgecast Inc. Content Delivery Network Domain Name edgecast.com Los Angeles, California", "SWIPPER - IP: 152.199.161.19 - Florence, Co related", "SWIPPER - ISP: WS/Acs Inc/Acs Usage Type:University/College/School Domain Name: acs-inc.com Pittsburgh, Pennsylvania", "SWIPPER Behavior: Brute-Force Credential brute-force attacks on webpage logins and services like SSH, FTP, SIP, SMTP, RDP, etc.", "SWIPPER Behavior: Category is seperate from DDoS attacks. Bad Web Bot Web App Attack", "Confirmed Malware: Cl0p QVM41.1.083F.Malware SLF:Trojan:Win32/Grandoreiro VirTool:Win32/Injector", "Confirmed Malware: Trojan:Win/Zombie Trojan:Win32/AutoitInject Trojan:Win32/Glupteba Trojan:Win32/QQpass", "Confirmed Malware: Trojan:Win32/Zbot TrojanDropper:Win32/Muldrop Worm:Win32/Mofksys", "Command and Control: 208.95.112.1 | 34.154.67.14", "https://www.colocrossing.com/", "American Registry for Internet Numbers (ARIN) http://www.arin.net \u203a cgi-bin \u203a Who is RWS", "https://whois.arin.net/rest/net/NET-71-96-0-0-1/pft?s=71.106.106.47" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Cl0p", "display_name": "Cl0p", "target": null }, { "id": "SLF:Trojan:Win32/Grandoreiro", "display_name": "SLF:Trojan:Win32/Grandoreiro", "target": null }, { "id": "QVM41.1.083F.Malware", "display_name": "QVM41.1.083F.Malware", "target": null }, { "id": "Trojan:Win32/Glupteba", "display_name": "Trojan:Win32/Glupteba", "target": "/malware/Trojan:Win32/Glupteba" }, { "id": "Worm:Win32/Mofksys", "display_name": "Worm:Win32/Mofksys", "target": "/malware/Worm:Win32/Mofksys" }, { "id": "TrojanDropper:Win32/Muldrop", "display_name": "TrojanDropper:Win32/Muldrop", "target": "/malware/TrojanDropper:Win32/Muldrop" }, { "id": "Trojan:Win32/Zbot", "display_name": "Trojan:Win32/Zbot", "target": "/malware/Trojan:Win32/Zbot" }, { "id": "Trojan:Win32/QQpass", "display_name": "Trojan:Win32/QQpass", "target": "/malware/Trojan:Win32/QQpass" }, { "id": "Trojan:Win/Zombie", "display_name": "Trojan:Win/Zombie", "target": "/malware/Trojan:Win/Zombie" }, { "id": "Trojan:Win32/AutoitInject", "display_name": "Trojan:Win32/AutoitInject", "target": "/malware/Trojan:Win32/AutoitInject" }, { "id": "VirTool:Win32/Injector", "display_name": "VirTool:Win32/Injector", "target": "/malware/VirTool:Win32/Injector" } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1110.004", "name": "Credential Stuffing", "display_name": "T1110.004 - Credential Stuffing" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1037", "name": "Boot or Logon Initialization Scripts", "display_name": "T1037 - Boot or Logon Initialization Scripts" }, { "id": "T1102.002", "name": "Bidirectional Communication", "display_name": "T1102.002 - Bidirectional Communication" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1444", "name": "Masquerade as Legitimate Application", "display_name": "T1444 - Masquerade as Legitimate Application" }, { "id": "T1037.003", "name": "Network Logon Script", "display_name": "T1037.003 - Network Logon Script" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0008", "name": "Lateral Movement", "display_name": "TA0008 - Lateral Movement" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0010", "name": "Exfiltration", "display_name": "TA0010 - Exfiltration" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1098.002", "name": "Exchange Email Delegate Permissions", "display_name": "T1098.002 - Exchange Email Delegate Permissions" }, { "id": "T1460", "name": "Biometric Spoofing", "display_name": "T1460 - Biometric Spoofing" }, { "id": "T1205.001", "name": "Port Knocking", "display_name": "T1205.001 - Port Knocking" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" } ], "industries": [ "Technology", "Telecommunications", "Civilian Society", "Any" ], "TLP": "green", "cloned_from": null, "export_count": 53, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 546, "FileHash-MD5": 1677, "FileHash-SHA1": 1288, "FileHash-SHA256": 1385, "CVE": 1, "domain": 404, "hostname": 591, "CIDR": 3, "email": 12 }, "indicator_count": 5907, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "619 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b61350252f6fe8709d9ea5", "name": "Matanbuchus Loader", "description": "Matanbuchus (Malware Family)\nAccording to PCrisk, Matanbuchus is a loader-type malicious program offered by its developers as Malware-as-a-Service (MaaS).\nLoader is a new malware-as-a-service created by a threat actor who references demonic themes in software and usernames.\nSuspiciously large espionage campaign targeting a critically injured patient of a physical therapist who has faced no consequences to date. Fear tactics, physical contact, DoS,Avoidance of scandal, negative media, potential for large financial damages, accountability, fuel campaign targeting female. Excessive contact.", "modified": "2024-02-27T08:03:19.373000", "created": "2024-01-28T08:41:52.713000", "tags": [ "ssl certificate", "whois record", "contacted", "apple", "apple ios", "tsara brashears", "lcid1033", "smlen", "referrer", "historical ssl", "execution", "core", "hacktool", "critical", "qakbot", "trojan", "ransomexx", "ransomware", "agent tesla", "matanbuchus", "cobalt strike", "bazarloader", "pegasus", "nso group", "escalated attacks" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Matanbuchus", "display_name": "Matanbuchus", "target": null }, { "id": "Bazarloader", "display_name": "Bazarloader", "target": null }, { "id": "QakBot", "display_name": "QakBot", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "RansomEXX (ELF)", "display_name": "RansomEXX (ELF)", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 209, "URL": 134, "FileHash-MD5": 41, "FileHash-SHA1": 43, "FileHash-SHA256": 377, "domain": 83, "CVE": 1 }, "indicator_count": 888, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "826 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b8089f18e127157ff46d77", "name": "Matanbuchus Loader", "description": "", "modified": "2024-02-27T08:03:19.373000", "created": "2024-01-29T20:20:47.962000", "tags": [ "ssl certificate", "whois record", "contacted", "apple", "apple ios", "tsara brashears", "lcid1033", "smlen", "referrer", "historical ssl", "execution", "core", "hacktool", "critical", "qakbot", "trojan", "ransomexx", "ransomware", "agent tesla", "matanbuchus", "cobalt strike", "bazarloader", "pegasus", "nso group", "escalated attacks" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Matanbuchus", "display_name": "Matanbuchus", "target": null }, { "id": "Bazarloader", "display_name": "Bazarloader", "target": null }, { "id": "QakBot", "display_name": "QakBot", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "RansomEXX (ELF)", "display_name": "RansomEXX (ELF)", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65b61350252f6fe8709d9ea5", "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 209, "URL": 134, "FileHash-MD5": 41, "FileHash-SHA1": 43, "FileHash-SHA256": 377, "domain": 83, "CVE": 1 }, "indicator_count": 888, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "826 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b60b85453c45eca795034d", "name": "Hidden Tear BruteForcer", "description": "\u2022 The Hidden Tear BruteForcer is a program created by Michael Gillespie that can be used to brute force the password for ransomware infections. A ransomware-like file crypter sample which can be modified for specific purposes. Features. Uses AES algorithm to encrypt files. Can be downloaded for free for anyone to download in GitHub. Many cyber criminals, lawyers, investigators and governments use this project.\n\u2022 Raspberry Robin is an activity cluster spread by external drives that leverages Windows Installer.", "modified": "2024-02-27T06:04:19.663000", "created": "2024-01-28T08:08:37.586000", "tags": [ "no expiration", "domain", "hostname", "expiration", "filehashsha256", "ipv4", "url http", "url https", "iocs", "filehashsha1", "next", "x509v3", "key", "windows", "write", "whois ssl", "whois whois", "win32", "198-46-194-153-host.colocrossing.com", "a domains", "a nxdomain", "aaaa", "accept", "adapter driver", "address", "address domain", "algorithm", "all octoseek", "cookie", "copy", "core", "domain names", "domain", "dnssec", "discord", "whois record", "cyberstalking", "d417n", "timestamp", "data", "subject", "cyberstalking", "creation date", "ipv4", "ip address", "http identifier", "hostname", "historical ssl", "highly targeted", "high level", "high", "hiddentear", "gmtn", "germany unknown", "location first", "ip files", "files", "false files", "eu data", "entries", "download encrypt", "encrypt", "download", "contacted", "communicating", "coinminer", "code", "cobalt strike", "cname", "click", "ca issuers", "issuers", "as133618", "as24940", "hetzner", "as26710", "icann", "as36352", "as24940 hetzner", "asn as133618", "as26710 icann", "apple as8075", "as47846", "as47995", "key algorithm", "united", "name", "type", "tsara brashears", "trojan", "key identifier", "key info", "land use", "link location", "united tls web", "tls web", "log id", "malvertizing", "malware", "http", "meekserver", "meta", "metasploit", "admin", "subject", "ransomware", "stop ransomware", "certificate status", "metro", "moved", "name servers", "netsupport rat", "number", "nxdomain", "passive dns", "servers", "server", "pegasus", "pingback", "submit", "ransom", "raspberry robin", "subject public", "subject key", "subject billing", "pdf broadcom", "pulse pulses", "pulse submit", "read c", "record value", "redacted referrer", "regbinary", "regdword", "registrant fax", "registrar", "registrar abuse", "registry domain", "registrar of", "registry policy", "regsetvalueexa", "regsetvalueexw", "show", "showing", "search", "urls", "script", "script domains", "scan endpoints", "russia unknown", "reverse dns", "resolutions", "nids", "related nids", "as39494 jsc", "body", "attorney james", "asn as133618", "javascript", "unknown", "url analysis", "unknown url", "url http", "v3 serial", "http", "as40528 icann", "as44273 host", "data center", "hosting", "vps", "reverse dns" ], "references": [ "deviceinbox.com [Malware Hosting - Pegasus]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]", "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]", "103.224.182.253 [Command and Control]", "198.46.194.153 [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia" ], "malware_families": [ { "id": "HiddenTear", "display_name": "HiddenTear", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [ "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 77, "FileHash-SHA1": 81, "FileHash-SHA256": 359, "URL": 218, "SSLCertFingerprint": 2, "domain": 1932, "email": 12, "hostname": 528 }, "indicator_count": 3209, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "827 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b8086a651e881715b3fc47", "name": "Hidden Tear BruteForcer", "description": "", "modified": "2024-02-27T06:04:19.663000", "created": "2024-01-29T20:19:54.173000", "tags": [ "no expiration", "domain", "hostname", "expiration", "filehashsha256", "ipv4", "url http", "url https", "iocs", "filehashsha1", "next", "x509v3", "key", "windows", "write", "whois ssl", "whois whois", "win32", "198-46-194-153-host.colocrossing.com", "a domains", "a nxdomain", "aaaa", "accept", "adapter driver", "address", "address domain", "algorithm", "all octoseek", "cookie", "copy", "core", "domain names", "domain", "dnssec", "discord", "whois record", "cyberstalking", "d417n", "timestamp", "data", "subject", "cyberstalking", "creation date", "ipv4", "ip address", "http identifier", "hostname", "historical ssl", "highly targeted", "high level", "high", "hiddentear", "gmtn", "germany unknown", "location first", "ip files", "files", "false files", "eu data", "entries", "download encrypt", "encrypt", "download", "contacted", "communicating", "coinminer", "code", "cobalt strike", "cname", "click", "ca issuers", "issuers", "as133618", "as24940", "hetzner", "as26710", "icann", "as36352", "as24940 hetzner", "asn as133618", "as26710 icann", "apple as8075", "as47846", "as47995", "key algorithm", "united", "name", "type", "tsara brashears", "trojan", "key identifier", "key info", "land use", "link location", "united tls web", "tls web", "log id", "malvertizing", "malware", "http", "meekserver", "meta", "metasploit", "admin", "subject", "ransomware", "stop ransomware", "certificate status", "metro", "moved", "name servers", "netsupport rat", "number", "nxdomain", "passive dns", "servers", "server", "pegasus", "pingback", "submit", "ransom", "raspberry robin", "subject public", "subject key", "subject billing", "pdf broadcom", "pulse pulses", "pulse submit", "read c", "record value", "redacted referrer", "regbinary", "regdword", "registrant fax", "registrar", "registrar abuse", "registry domain", "registrar of", "registry policy", "regsetvalueexa", "regsetvalueexw", "show", "showing", "search", "urls", "script", "script domains", "scan endpoints", "russia unknown", "reverse dns", "resolutions", "nids", "related nids", "as39494 jsc", "body", "attorney james", "asn as133618", "javascript", "unknown", "url analysis", "unknown url", "url http", "v3 serial", "http", "as40528 icann", "as44273 host", "data center", "hosting", "vps", "reverse dns" ], "references": [ "deviceinbox.com [Malware Hosting - Pegasus]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]", "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]", "103.224.182.253 [Command and Control]", "198.46.194.153 [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia" ], "malware_families": [ { "id": "HiddenTear", "display_name": "HiddenTear", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [ "Civil Society" ], "TLP": "white", "cloned_from": "65b60b85453c45eca795034d", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 77, "FileHash-SHA1": 81, "FileHash-SHA256": 359, "URL": 218, "SSLCertFingerprint": 2, "domain": 1932, "email": 12, "hostname": 528 }, "indicator_count": 3209, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "827 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b0558f71f7a001ff5ff7bc", "name": "Guardicore - 23-01-2024", "description": "", "modified": "2024-02-23T00:00:09.449000", "created": "2024-01-24T00:10:55.696000", "tags": [], "references": [ "https://threatintelligence.guardicore.com/download-guardicore-cyber-threat-intelligence-data.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 37, "hostname": 5 }, "indicator_count": 42, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "831 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65adb2c0dd307a1e3e911e4a", "name": "Guardicore - 21-01-2024", "description": "", "modified": "2024-02-21T00:05:32.076000", "created": "2024-01-22T00:11:44.839000", "tags": [], "references": [ "https://threatintelligence.guardicore.com/download-guardicore-cyber-threat-intelligence-data.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 14, "hostname": 2 }, "indicator_count": 16, "is_author": false, "is_subscribing": null, "subscriber_count": 1625, "modified_text": "833 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "655d47fb128a006a7d06afa2", "name": "Guardicore - 21-11-2023", "description": "", "modified": "2023-12-22T00:01:04.661000", "created": "2023-11-22T00:14:51.357000", "tags": [], "references": [ "https://threatintelligence.guardicore.com/download-guardicore-cyber-threat-intelligence-data.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 42, "hostname": 5 }, "indicator_count": 47, "is_author": false, "is_subscribing": null, "subscriber_count": 1626, "modified_text": "894 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65345a75e56ecbcda8e90c94", "name": "Guardicore - 21-10-2023", "description": "", "modified": "2023-11-20T23:00:23.112000", "created": "2023-10-21T23:10:45.809000", "tags": [], "references": [ "https://threatintelligence.guardicore.com/download-guardicore-cyber-threat-intelligence-data.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 32, "hostname": 3 }, "indicator_count": 35, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "925 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6525d9f3bbe086a8b6b8a55a", "name": "Guardicore - 10-10-2023", "description": "", "modified": "2023-11-09T23:00:12.133000", "created": "2023-10-10T23:10:43.042000", "tags": [], "references": [ "https://threatintelligence.guardicore.com/download-guardicore-cyber-threat-intelligence-data.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 42, "hostname": 7 }, "indicator_count": 49, "is_author": false, "is_subscribing": null, "subscriber_count": 1625, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be", "https://tria.ge/240517-vqxezaaa33/behavioral1", "(legitimate services will remain up-and-running usually) High | ID dead_host", "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview", "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll", "SWIPPER Behavior: Brute-Force Credential brute-force attacks on webpage logins and services like SSH, FTP, SIP, SMTP, RDP, etc.", "deviceinbox.com [Malware Hosting - Pegasus]", "Malicious Antivirus Detections SLF:Trojan:Win32/Grandoreiro.A Yara Detections md5_constants , Delphi ,", "https://www.criminalip.io/domain/report?scan_id=13798622", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2", "N\u2205 IP: https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco", "Malware.Nymeria-6993588-0: FileHash-SHA256 9dddb78cec49c05f2bec6f2583e4d8a663435f5a265a09a5966d5d4bfa866761", "198.46.194.153 [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph", "SWIPPER - ISP: WS/Acs Inc/Acs Usage Type:University/College/School Domain Name: acs-inc.com Pittsburgh, Pennsylvania", "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb", "SWIPPER - IP: 152.199.161.19 - Florence, Co related", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b", "Title: The page title. Remote Access - Dynamic DNS - Create a Free DDNS Account Now - No-IP", "Confirmed Malware: Trojan:Win/Zombie Trojan:Win32/AutoitInject Trojan:Win32/Glupteba Trojan:Win32/QQpass", "https://imp0rtp3.wordpress.com/2021/08/12/tetris/", "https://threatintelligence.guardicore.com/download-guardicore-cyber-threat-intelligence-data.html", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2", "Yara Detections: XOR_embeded_exefile_xored_with_round_256_bytes_key", "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****", "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview", "Whois-RWS ; Name, SWIPPER ; Handle, SWIPP9-ARIN ; Company, Verizon ; Street, 22001", "AppRegistrationList.csv", "103.224.182.253 [Command and Control]", "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a", "Command and Control: 208.95.112.1 | 34.154.67.14", "Thor Scan: S-I9VvMTB6cZU", "Confirmed Malware: Trojan:Win32/Zbot TrojanDropper:Win32/Muldrop Worm:Win32/Mofksys", "Alerts: procmem_yara injection_inter_process ransomware_file_modifications stack_pivot", "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/", "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7", "SLF:Trojan:Win32/Grandoreiro.A - FILEHASH - SHA256 5253cfaec7456b9fe440ab25207b8e1ff948b04fc2f2f34befc2354bf4431d07", "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]", "https://www.endgamesystems.com/\t This is not a game. This is about people\u2019s lives", "Alerts: sysinternals_tools_usage antivm_vmware_in_instruction persistence_autorun", "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview", "SWIPPER - IP: 152.199.161.19 ISP Edgecast Inc. Content Delivery Network Domain Name edgecast.com Los Angeles, California", "IDS Defections: Possible Cerber Ransomware IP Check Possible ET INFO RealThinClient Session Init", "https://colocrossing.com/ \u2022 https://www.colocrossing.com/colocation\t l", "Domains Contacted: accounts.google.com chrome.cloudflare-dns.com clients2.googleusercontent.com", "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark", "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22", "Alerts dead_host network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout", "Yara Detections is__elf", "(TLI did you do her that dirty?) Why\u2019SCS\u2019? Pure shame on you.", "Alerts: dynamic_function_loading ipc_namedpipe createtoolhelp32snapshot_module_enumeration", "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24", "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22", "https://prometheussteakhouse.lupi.delivery/ Thanks! I\u2019m heavy into Picinha. 2 Brazilian roasts please!", "stealth_file cape_detected_threat injection_process_hollowing antiav_detectfile injection_runpe", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a", "TELNET SUSPICIOUS Path to BusyBox\", TELNET login failed\", is__elf \u007fELF dead_host", "ELF:Mirai-GH\\ [Trj] , Unix.Trojan.DarkNexus-7679166-0", "NanoCore RAT CnC 7 : FileHash-SHA256 0031cb925e76f801a0ca2ebbc32029be927687f0d6183777be917878ffd7cd4b", "https://www.filescan.io/uploads/666d69ff6b8dba248b414767", "http://appleid.apple.com.msg206.site/ http://www.icloud.com.msg206.site/ https://appleid.apple.com.msg206.site/", "https://tria.ge/240517-vdwb5shc71/behavioral1", "https://www.colocrossing.com/", "https://whois.arin.net/rest/net/NET-71-96-0-0-1/pft?s=71.106.106.47", "ET Telnet | https://www.colocrossing.com | velocity servers", "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs", "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark", "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List", "FILEHASH - SHA256 253cfaec7456b9fe440ab25207b8e1ff948b04fc2f2f34befc2354bf4431d07 | IP\u2019s Contacted: 34.117.59.81", "IP\u2019s Contacted 178.249.97.99 178.249.97.98 178.249.97.23 84.53.172.74 88.221.104.82", "https://urlscan.io/search/#ualberta.ca", "http://hopto.org/colocrossing/192.3.13.56/telco", "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6", "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22", "This is hard to comprehend or put into indelible words.", "https://tria.ge/240517-vc7c1shc62/behavioral1", "IDS Defections: Possible External IP Lookup ipinfo.io DNS Query to DynDNS Domain *.ddns .me", "https://sitereport.netcraft.com/?url=http://ualberta.ca", "SWIPPER Behavior: Category is seperate from DDoS attacks. Bad Web Bot Web App Attack", "IDS Detections SUSPICIOUS Path to BusyBox TELNET login failed Bad Login", "https://tria.ge/240517-t9pc2ahb2t", "Alerts: cape_extracted_content infostealer_cookies recon_fingerprint powershell_download", "Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary", "In all seriousness. The severity of injuries and outcomes 1 victim had is aligned cyber attacks by Q.Gov", "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview", "American Registry for Internet Numbers (ARIN) http://www.arin.net \u203a cgi-bin \u203a Who is RWS", "All - EnterpriseAppsList.csv", "Is Swipper: pool-70-21-23-161.washdc.fios.verizon.net", "https://tria.ge/240521-q4s79agb25/static1", "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22", "Yara Detections is__elf , ELFHighEntropy , elf_empty_sections", "Alerts: network_icmp antianalysis_detectfile antidbg_windows antivm_generic_scsi", "IP\u2019s Contacted: 142.250.147.101 88.221.104.56 13.33.141.29 35.186.249.72 151.101.1.192", "Detections Win.Packed.ImminentMonitorRAT-9892275-0 , HackTool:MSIL/Boilod.C!bit", "104.21.51.140, 172.67.181.41", "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3", "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview", "CVE-2023-23397 | scanning_host IPv4 158.247.7.206 scanning_host IP's: 192.3.13.56 158.247.7.206", "https://www.hudsonrock.com/search?domain=ualberta.ca", "Whois-RWS ; Name, SWIPPER ; Handle, SWIPP9-ARIN ; Company, Verizon ; Street, 22001 Loudoun County Pkwy.", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]", "Confirmed Malware: Cl0p QVM41.1.083F.Malware SLF:Trojan:Win32/Grandoreiro VirTool:Win32/Injector" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Bazarloader", "Hacktool:msil/boilod.c!bit", "Trojandropper:win32/muldrop", "Trojan:win32/qqpass", "Virtool:win32/injector", "Trojan:win32/zbot", "Slf:trojan:win32/grandoreiro", "Mirai", "Ransomexx (elf)", "Qakbot", "Unix.trojan.darknexus-7679166-0", "Trojan:win32/glupteba", "Trojan:win32/autoitinject", "Trojan:win/zombie", "Worm:win32/mofksys", "Hiddentear", "Matanbuchus", "Qvm41.1.083f.malware", "Cobalt strike", "Hacktool", "Cl0p" ], "industries": [ "Civil society", "Any", "Telecommunications", "Technology", "Healthcare", "Insurance", "Education", "Government", "Civilian society" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 14, "pulses": [ { "id": "69e2cc9ebd63c32d9c0392c6", "name": "Hidden Tear BruteForcer Clone Credit OctoSeek", "description": "", "modified": "2026-04-18T00:13:18.484000", "created": "2026-04-18T00:13:18.484000", "tags": [ "no expiration", "domain", "hostname", "expiration", "filehashsha256", "ipv4", "url http", "url https", "iocs", "filehashsha1", "next", "x509v3", "key", "windows", "write", "whois ssl", "whois whois", "win32", "198-46-194-153-host.colocrossing.com", "a domains", "a nxdomain", "aaaa", "accept", "adapter driver", "address", "address domain", "algorithm", "all octoseek", "cookie", "copy", "core", "domain names", "domain", "dnssec", "discord", "whois record", "cyberstalking", "d417n", "timestamp", "data", "subject", "cyberstalking", "creation date", "ipv4", "ip address", "http identifier", "hostname", "historical ssl", "highly targeted", "high level", "high", "hiddentear", "gmtn", "germany unknown", "location first", "ip files", "files", "false files", "eu data", "entries", "download encrypt", "encrypt", "download", "contacted", "communicating", "coinminer", "code", "cobalt strike", "cname", "click", "ca issuers", "issuers", "as133618", "as24940", "hetzner", "as26710", "icann", "as36352", "as24940 hetzner", "asn as133618", "as26710 icann", "apple as8075", "as47846", "as47995", "key algorithm", "united", "name", "type", "tsara brashears", "trojan", "key identifier", "key info", "land use", "link location", "united tls web", "tls web", "log id", "malvertizing", "malware", "http", "meekserver", "meta", "metasploit", "admin", "subject", "ransomware", "stop ransomware", "certificate status", "metro", "moved", "name servers", "netsupport rat", "number", "nxdomain", "passive dns", "servers", "server", "pegasus", "pingback", "submit", "ransom", "raspberry robin", "subject public", "subject key", "subject billing", "pdf broadcom", "pulse pulses", "pulse submit", "read c", "record value", "redacted referrer", "regbinary", "regdword", "registrant fax", "registrar", "registrar abuse", "registry domain", "registrar of", "registry policy", "regsetvalueexa", "regsetvalueexw", "show", "showing", "search", "urls", "script", "script domains", "scan endpoints", "russia unknown", "reverse dns", "resolutions", "nids", "related nids", "as39494 jsc", "body", "attorney james", "asn as133618", "javascript", "unknown", "url analysis", "unknown url", "url http", "v3 serial", "http", "as40528 icann", "as44273 host", "data center", "hosting", "vps", "reverse dns" ], "references": [ "deviceinbox.com [Malware Hosting - Pegasus]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]", "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]", "103.224.182.253 [Command and Control]", "198.46.194.153 [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia" ], "malware_families": [ { "id": "HiddenTear", "display_name": "HiddenTear", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [ "Civil Society" ], "TLP": "white", "cloned_from": "65b60b85453c45eca795034d", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 77, "FileHash-SHA1": 81, "FileHash-SHA256": 359, "URL": 218, "SSLCertFingerprint": 2, "domain": 1932, "email": 12, "hostname": 528 }, "indicator_count": 3209, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "46 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6958780c8479a9d69920c3d8", "name": "Telnet - Mirai \u2022 Dark Nexus BusyBox iOS Attack", "description": "There\u2019s enough here to cause an outage. I will stop here. Illegal activities to silence victim and block her from financial settlement award for permanent injuries under workers compensation in a premise and healthcare worker assault scenario. Attorneys estimated her case to be above $100 million but knew she\u2019d be tampered with. Mark Montano MD forewarned her but is culpable. Still attacking family of victim.\n[ True- otx auto generated: Adversaries may be able to gain access to a victim's network through a drive-by attack, as well as using a short-term SSL certificate, in order to target the victim.] |||\nPositive:\nT1140 - Deobfuscate/Decode Files or Information\nSuspicious IP Address\n104.21.51.140, 172.67.181.41\nLocation United States ASN\nModif AS13335 cloudflare\nAutomate Nameservers:\nns1.colocrossing.com.", "modified": "2026-02-02T01:02:46.327000", "created": "2026-01-03T01:59:40.530000", "tags": [ "united", "moved", "title", "passive dns", "ipv4 add", "urls", "files", "hosting", "reverse dns", "location united", "hash avast", "avg clamav", "msdefender mar", "read c", "create c", "medium", "search", "memcommit", "high", "checks", "windows", "execution", "dock", "write", "persistence", "capture", "local", "ref b", "wed may", "backdoor", "mtb aug", "next associated", "mtb dec", "twitter", "smoke loader", "malware", "virtool", "hacktool", "data upload", "present dec", "mtb apr", "win32", "trojan", "worm", "lowfi", "cybota", "expiration date", "name servers", "ipv4", "url analysis", "port", "destination", "telnet login", "bad login", "gpl telnet", "suspicious path", "busybox", "tcp syn", "et telnet", "path", "mirai", "filehash", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "file score", "america", "ck id", "name tactics", "suspicious", "informative", "learn", "t1179 hooking", "installs", "t1035 service", "adversaries", "msie", "windows nt", "slcc2", "media center", "y013", "flag", "span", "accept", "core", "february", "hybrid", "malicious", "general", "click", "strings", "roboto", "next", "usa windows", "finished", "queueprogress", "timestamp input", "threat level", "october", "september", "hwp support", "fresh", "win64", "khtml", "gecko", "brand", "microsoft edge", "programfiles", "comspec", "model", "iframe", "form", "listeners", "initial access", "t1590 gather", "victim network", "ssl certificate", "quasi government", "jeffrey reimer", "palantir", "Regis university", "otx hp", "apple", "pegasus", "h5 data center", "florence colorado", "brian sabey", "target : Tsara Brasheaers", "aig", "industry and commerce", "united states", "State of Colorado.", "date", "status", "domain", "hostname add", "pulse pulses", "files ip", "address", "url https", "url http", "hostname", "show", "type indicator", "source hostname", "entries", "Prometheus Intelligence Technology", "pulse submit", "america flag", "body", "dynamicloader", "microsoft azure", "tls issuing", "named pipe", "json", "ascii text", "lredmond", "Apple", "Telnet", "BusyBox", "Pegasus", "Colorado State Fixer: Christopher P. Ahmann", "Hijacker: Brian Sabey", "For: Concentra", "Protecting Assaulter: Jeffrey Reimer", "For: AIG", "For Industry and Commerce", "For: Quasi Government", "For: Workers Compensation", "Authorities", "Law Enforcement Dark", "Silencing", "Tampering with a Victim", "Meta", "Palantir", "Google", "Bing", "Microsoft", "ColoCrossing", "Associates", "hit men" ], "references": [ "ET Telnet | https://www.colocrossing.com | velocity servers", "https://www.endgamesystems.com/\t This is not a game. This is about people\u2019s lives", "TELNET SUSPICIOUS Path to BusyBox\", TELNET login failed\", is__elf \u007fELF dead_host", "Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)", "(legitimate services will remain up-and-running usually) High | ID dead_host", "ELF:Mirai-GH\\ [Trj] , Unix.Trojan.DarkNexus-7679166-0", "IDS Detections SUSPICIOUS Path to BusyBox TELNET login failed Bad Login", "Yara Detections is__elf", "Alerts dead_host network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout", "Yara Detections is__elf , ELFHighEntropy , elf_empty_sections", "http://appleid.apple.com.msg206.site/ http://www.icloud.com.msg206.site/ https://appleid.apple.com.msg206.site/", "https://colocrossing.com/ \u2022 https://www.colocrossing.com/colocation\t l", "https://prometheussteakhouse.lupi.delivery/ Thanks! I\u2019m heavy into Picinha. 2 Brazilian roasts please!", "https://www.colocrossing.com/", "(TLI did you do her that dirty?) Why\u2019SCS\u2019? Pure shame on you.", "In all seriousness. The severity of injuries and outcomes 1 victim had is aligned cyber attacks by Q.Gov", "104.21.51.140, 172.67.181.41", "Detections Win.Packed.ImminentMonitorRAT-9892275-0 , HackTool:MSIL/Boilod.C!bit", "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)", "Alerts: procmem_yara injection_inter_process ransomware_file_modifications stack_pivot", "stealth_file cape_detected_threat injection_process_hollowing antiav_detectfile injection_runpe", "Alerts: cape_extracted_content infostealer_cookies recon_fingerprint powershell_download", "Alerts: dynamic_function_loading ipc_namedpipe createtoolhelp32snapshot_module_enumeration", "IP\u2019s Contacted: 142.250.147.101 88.221.104.56 13.33.141.29 35.186.249.72 151.101.1.192", "IP\u2019s Contacted 178.249.97.99 178.249.97.98 178.249.97.23 84.53.172.74 88.221.104.82", "Domains Contacted: accounts.google.com chrome.cloudflare-dns.com clients2.googleusercontent.com", "This is hard to comprehend or put into indelible words." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Unix.Trojan.DarkNexus-7679166-0", "display_name": "Unix.Trojan.DarkNexus-7679166-0", "target": null }, { "id": "HackTool:MSIL/Boilod.C!bit", "display_name": "HackTool:MSIL/Boilod.C!bit", "target": "/malware/HackTool:MSIL/Boilod.C!bit" } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" }, { "id": "T1098", "name": "Account Manipulation", "display_name": "T1098 - Account Manipulation" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1557", "name": "Man-in-the-Middle", "display_name": "T1557 - Man-in-the-Middle" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1462", "name": "Malicious Software Development Tools", "display_name": "T1462 - Malicious Software Development Tools" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1459", "name": "Device Unlock Code Guessing or Brute Force", "display_name": "T1459 - Device Unlock Code Guessing or Brute Force" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" } ], "industries": [ "Technology", "Healthcare", "Insurance", "Civil Society" ], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6390, "domain": 723, "hostname": 1978, "FileHash-SHA256": 1912, "FileHash-MD5": 410, "FileHash-SHA1": 306, "email": 3, "SSLCertFingerprint": 28, "CVE": 3 }, "indicator_count": 11753, "is_author": false, "is_subscribing": null, "subscriber_count": 146, "modified_text": "121 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6647908c09468f42bc1249f1", "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution", "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com", "modified": "2025-03-01T04:59:57.222000", "created": "2024-05-17T17:14:52.317000", "tags": [ "false", "true", "visible", "application", "microsoft teams", "microsoft azure", "office", "service", "dynamics", "hidden", "android", "explorer", "write", "connector", "test", "sharepoint", "live", "meister", "tools", "desktop", "spark", "front", "enterprise", "designer", "atlas", "premium", "assistant", "allow", "azureadmyorg", "game", "verify", "microsoft power", "channelsurfcli", "mtd1", "file transfer", "magnus", "microsoft crm", "youth" ], "references": [ "All - EnterpriseAppsList.csv", "AppRegistrationList.csv", "https://tria.ge/240517-vc7c1shc62/behavioral1", "https://tria.ge/240517-vdwb5shc71/behavioral1", "https://tria.ge/240517-vqxezaaa33/behavioral1", "https://tria.ge/240517-t9pc2ahb2t", "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary", "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb", "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7", "Thor Scan: S-I9VvMTB6cZU", "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview", "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview", "https://imp0rtp3.wordpress.com/2021/08/12/tetris/", "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview", "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview", "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview", "https://tria.ge/240521-q4s79agb25/static1", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093", "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview", "https://www.filescan.io/uploads/666d69ff6b8dba248b414767", "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3", "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b", "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2", "https://www.hudsonrock.com/search?domain=ualberta.ca", "https://www.criminalip.io/domain/report?scan_id=13798622", "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24", "https://urlscan.io/search/#ualberta.ca", "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs", "https://sitereport.netcraft.com/?url=http://ualberta.ca", "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/", "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll", "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark", "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22", "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22", "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22", "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Healthcare", "Telecommunications", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 7, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1703, "FileHash-SHA256": 90472, "URL": 99185, "domain": 82954, "hostname": 39041, "FileHash-SHA1": 1624, "email": 4658, "CVE": 12 }, "indicator_count": 319649, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "459 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6780c2bbe4bf55e164177223", "name": "Panda C2 domains", "description": "", "modified": "2025-01-10T06:48:27.646000", "created": "2025-01-10T06:48:27.646000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 101 }, "indicator_count": 101, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66c76a410bca940a8cb84f91", "name": "Remote Access - Dynamic DNS | Injection", "description": "Blamed for Botnet exchange, Ddos, ssh, email spamming, brute forcing emails, sending viruses/trojans to countless emails, injection, app installation, gov , bank employee targeting, etc. Listed ALL victim information in downed WikiLeaks website.The list is long, Swipper is still a mystery. The name has been linked to an IT graduate. This doesn't mean much as hackers frame everyone. The [person or links to does link back to subject of hacks against a targeted person. When target researched Swipper EVERYTHING related was cleaned from the Internet.\n\nThe best clue deleted was for IP's in the 152.199.0.0/24 Block. \nThe other was used by Brian Sabey who used service to distribute So much porn (and worse) all with targets name! It was a 'hopto' N\u2205 IP address. It disappeared so fast along with any trace.", "modified": "2024-09-21T14:04:09.409000", "created": "2024-08-22T16:41:37.285000", "tags": [ "referrer", "nanocore rat", "hunting guide", "your apt", "malware", "bitter apt", "using zxxz", "backdoor", "pakistan public", "committee", "ukraine", "maxage7200", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "dynamic dns", "access", "html info", "title remote", "ddns account", "meta tags", "ip address", "trackers amazon", "tag manager", "cookies noipbid", "netrange", "nethandle", "net152", "net1520000", "as1321", "inc orgid", "loudoun county", "parkway city", "postalcode", "content", "utc google", "gtmvfgb", "utc ggg8ybn7flc", "gg8ybn7flc", "samples", "no data", "tag count", "analyzer threat", "ip summary", "summary", "detection list", "heur", "malicious site", "malicious host", "services", "exchange botnet", "command", "control server", "host", "azorult", "pony", "asyncrat", "cobalt strike", "phishing", "team", "dropper", "crypt", "outbreak", "mimikatz", "riskware", "trojanx", "cisco umbrella", "site", "safe site", "redline stealer", "generic pua", "malware site", "utorrent", "generic", "yakes", "agent", "adposhel", "zbot", "cl0p", "managed dns", "strong", "noip", "please", "buy plus", "managed", "free", "service", "already", "read c", "dll read", "function read", "medium", "systemroot", "search", "high", "smtp host", "virustotal", "trojan", "write", "drweb", "vipre", "panda", "phishing", "ransomware", "rat", "swipper", "swipp9", "vj92", "uagdaaeqcqaaaag", "ukgbagaqcqaaaae", "slfrd1", "hostnames", "ukgbagaqcq", "jid1886833764", "jid882556742", "unknown", "as36947", "algeria unknown", "germany unknown", "as37340", "nigeria unknown", "united kingdom", "as200350", "france unknown", "date", "z557338487", "z129433407", "z2111579734", "name servers", "passive dns", "as14627", "scan endpoints", "all scoreblue", "next", "aaaa", "asnone united", "moved", "certificate", "rsa ca", "ipv4", "pulse pulses", "win32", "process32nextw", "onlogon ru", "discovery", "t1057", "discovery t1057", "windows", "post http", "actionhello", "delphi", "dock", "memcommit", "writeconsolea", "nat monitor", "f tn", "delete c", "write c", "create c", "autoit", "look", "suspicious", "as9009 m247", "sri lanka", "domain", "creation date", "hungary unknown", "as36352", "files", "hosting", "reverse dns", "all search", "otx scoreblue", "hostname", "pulse submit", "url analysis", "status", "mtb sep", "record value", "servers", "gmt server", "pecancer", "as15169 google", "mtb apr", "open ports", "trojandropper", "gmt cache", "cashreminder", "philadelphia", "status hostname", "query type", "address first", "seen last", "seen asn", "country unknown", "nxdomain", "a nxdomain", "encrypt", "body", "present mar", "emails", "domain name", "expiration date", "error", "code", "location united", "united states", "malicious.75188e", "united", "icmp traffic", "pe section", "low software", "packing t1045", "t1045", "pe resource", "filehash", "ireland unknown", "as396982 google", "belgium unknown", "as24940 hetzner", "trojan process", "file samples", "files matching", "show", "date hash", "worm features", "related pulses", "malware process", "trojan features", "brute force", "brute forcing emails", "hacking", "logan utah", "ddos attack", "web app attacks", "bad web bot", "cwaf", "verizon enterprise" ], "references": [ "Title: The page title. Remote Access - Dynamic DNS - Create a Free DDNS Account Now - No-IP", "http://hopto.org/colocrossing/192.3.13.56/telco", "N\u2205 IP: https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco", "SLF:Trojan:Win32/Grandoreiro.A - FILEHASH - SHA256 5253cfaec7456b9fe440ab25207b8e1ff948b04fc2f2f34befc2354bf4431d07", "FILEHASH - SHA256 253cfaec7456b9fe440ab25207b8e1ff948b04fc2f2f34befc2354bf4431d07 | IP\u2019s Contacted: 34.117.59.81", "Malicious Antivirus Detections SLF:Trojan:Win32/Grandoreiro.A Yara Detections md5_constants , Delphi ,", "IDS Defections: Possible Cerber Ransomware IP Check Possible ET INFO RealThinClient Session Init", "IDS Defections: Possible External IP Lookup ipinfo.io DNS Query to DynDNS Domain *.ddns .me", "Alerts: network_icmp antianalysis_detectfile antidbg_windows antivm_generic_scsi", "Alerts: sysinternals_tools_usage antivm_vmware_in_instruction persistence_autorun", "Yara Detections: XOR_embeded_exefile_xored_with_round_256_bytes_key", "Malware.Nymeria-6993588-0: FileHash-SHA256 9dddb78cec49c05f2bec6f2583e4d8a663435f5a265a09a5966d5d4bfa866761", "NanoCore RAT CnC 7 : FileHash-SHA256 0031cb925e76f801a0ca2ebbc32029be927687f0d6183777be917878ffd7cd4b", "CVE-2023-23397 | scanning_host IPv4 158.247.7.206 scanning_host IP's: 192.3.13.56 158.247.7.206", "Whois-RWS ; Name, SWIPPER ; Handle, SWIPP9-ARIN ; Company, Verizon ; Street, 22001 Loudoun County Pkwy.", "Whois-RWS ; Name, SWIPPER ; Handle, SWIPP9-ARIN ; Company, Verizon ; Street, 22001", "Is Swipper: pool-70-21-23-161.washdc.fios.verizon.net", "SWIPPER - IP: 152.199.161.19 ISP Edgecast Inc. Content Delivery Network Domain Name edgecast.com Los Angeles, California", "SWIPPER - IP: 152.199.161.19 - Florence, Co related", "SWIPPER - ISP: WS/Acs Inc/Acs Usage Type:University/College/School Domain Name: acs-inc.com Pittsburgh, Pennsylvania", "SWIPPER Behavior: Brute-Force Credential brute-force attacks on webpage logins and services like SSH, FTP, SIP, SMTP, RDP, etc.", "SWIPPER Behavior: Category is seperate from DDoS attacks. Bad Web Bot Web App Attack", "Confirmed Malware: Cl0p QVM41.1.083F.Malware SLF:Trojan:Win32/Grandoreiro VirTool:Win32/Injector", "Confirmed Malware: Trojan:Win/Zombie Trojan:Win32/AutoitInject Trojan:Win32/Glupteba Trojan:Win32/QQpass", "Confirmed Malware: Trojan:Win32/Zbot TrojanDropper:Win32/Muldrop Worm:Win32/Mofksys", "Command and Control: 208.95.112.1 | 34.154.67.14", "https://www.colocrossing.com/", "American Registry for Internet Numbers (ARIN) http://www.arin.net \u203a cgi-bin \u203a Who is RWS", "https://whois.arin.net/rest/net/NET-71-96-0-0-1/pft?s=71.106.106.47" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Cl0p", "display_name": "Cl0p", "target": null }, { "id": "SLF:Trojan:Win32/Grandoreiro", "display_name": "SLF:Trojan:Win32/Grandoreiro", "target": null }, { "id": "QVM41.1.083F.Malware", "display_name": "QVM41.1.083F.Malware", "target": null }, { "id": "Trojan:Win32/Glupteba", "display_name": "Trojan:Win32/Glupteba", "target": "/malware/Trojan:Win32/Glupteba" }, { "id": "Worm:Win32/Mofksys", "display_name": "Worm:Win32/Mofksys", "target": "/malware/Worm:Win32/Mofksys" }, { "id": "TrojanDropper:Win32/Muldrop", "display_name": "TrojanDropper:Win32/Muldrop", "target": "/malware/TrojanDropper:Win32/Muldrop" }, { "id": "Trojan:Win32/Zbot", "display_name": "Trojan:Win32/Zbot", "target": "/malware/Trojan:Win32/Zbot" }, { "id": "Trojan:Win32/QQpass", "display_name": "Trojan:Win32/QQpass", "target": "/malware/Trojan:Win32/QQpass" }, { "id": "Trojan:Win/Zombie", "display_name": "Trojan:Win/Zombie", "target": "/malware/Trojan:Win/Zombie" }, { "id": "Trojan:Win32/AutoitInject", "display_name": "Trojan:Win32/AutoitInject", "target": "/malware/Trojan:Win32/AutoitInject" }, { "id": "VirTool:Win32/Injector", "display_name": "VirTool:Win32/Injector", "target": "/malware/VirTool:Win32/Injector" } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1110.004", "name": "Credential Stuffing", "display_name": "T1110.004 - Credential Stuffing" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1037", "name": "Boot or Logon Initialization Scripts", "display_name": "T1037 - Boot or Logon Initialization Scripts" }, { "id": "T1102.002", "name": "Bidirectional Communication", "display_name": "T1102.002 - Bidirectional Communication" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1444", "name": "Masquerade as Legitimate Application", "display_name": "T1444 - Masquerade as Legitimate Application" }, { "id": "T1037.003", "name": "Network Logon Script", "display_name": "T1037.003 - Network Logon Script" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0008", "name": "Lateral Movement", "display_name": "TA0008 - Lateral Movement" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0010", "name": "Exfiltration", "display_name": "TA0010 - Exfiltration" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1098.002", "name": "Exchange Email Delegate Permissions", "display_name": "T1098.002 - Exchange Email Delegate Permissions" }, { "id": "T1460", "name": "Biometric Spoofing", "display_name": "T1460 - Biometric Spoofing" }, { "id": "T1205.001", "name": "Port Knocking", "display_name": "T1205.001 - Port Knocking" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" } ], "industries": [ "Technology", "Telecommunications", "Civilian Society", "Any" ], "TLP": "green", "cloned_from": null, "export_count": 53, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 546, "FileHash-MD5": 1677, "FileHash-SHA1": 1288, "FileHash-SHA256": 1385, "CVE": 1, "domain": 404, "hostname": 591, "CIDR": 3, "email": 12 }, "indicator_count": 5907, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "619 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b61350252f6fe8709d9ea5", "name": "Matanbuchus Loader", "description": "Matanbuchus (Malware Family)\nAccording to PCrisk, Matanbuchus is a loader-type malicious program offered by its developers as Malware-as-a-Service (MaaS).\nLoader is a new malware-as-a-service created by a threat actor who references demonic themes in software and usernames.\nSuspiciously large espionage campaign targeting a critically injured patient of a physical therapist who has faced no consequences to date. Fear tactics, physical contact, DoS,Avoidance of scandal, negative media, potential for large financial damages, accountability, fuel campaign targeting female. Excessive contact.", "modified": "2024-02-27T08:03:19.373000", "created": "2024-01-28T08:41:52.713000", "tags": [ "ssl certificate", "whois record", "contacted", "apple", "apple ios", "tsara brashears", "lcid1033", "smlen", "referrer", "historical ssl", "execution", "core", "hacktool", "critical", "qakbot", "trojan", "ransomexx", "ransomware", "agent tesla", "matanbuchus", "cobalt strike", "bazarloader", "pegasus", "nso group", "escalated attacks" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Matanbuchus", "display_name": "Matanbuchus", "target": null }, { "id": "Bazarloader", "display_name": "Bazarloader", "target": null }, { "id": "QakBot", "display_name": "QakBot", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "RansomEXX (ELF)", "display_name": "RansomEXX (ELF)", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 209, "URL": 134, "FileHash-MD5": 41, "FileHash-SHA1": 43, "FileHash-SHA256": 377, "domain": 83, "CVE": 1 }, "indicator_count": 888, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "826 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b8089f18e127157ff46d77", "name": "Matanbuchus Loader", "description": "", "modified": "2024-02-27T08:03:19.373000", "created": "2024-01-29T20:20:47.962000", "tags": [ "ssl certificate", "whois record", "contacted", "apple", "apple ios", "tsara brashears", "lcid1033", "smlen", "referrer", "historical ssl", "execution", "core", "hacktool", "critical", "qakbot", "trojan", "ransomexx", "ransomware", "agent tesla", "matanbuchus", "cobalt strike", "bazarloader", "pegasus", "nso group", "escalated attacks" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Matanbuchus", "display_name": "Matanbuchus", "target": null }, { "id": "Bazarloader", "display_name": "Bazarloader", "target": null }, { "id": "QakBot", "display_name": "QakBot", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "RansomEXX (ELF)", "display_name": "RansomEXX (ELF)", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65b61350252f6fe8709d9ea5", "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 209, "URL": 134, "FileHash-MD5": 41, "FileHash-SHA1": 43, "FileHash-SHA256": 377, "domain": 83, "CVE": 1 }, "indicator_count": 888, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "826 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b60b85453c45eca795034d", "name": "Hidden Tear BruteForcer", "description": "\u2022 The Hidden Tear BruteForcer is a program created by Michael Gillespie that can be used to brute force the password for ransomware infections. A ransomware-like file crypter sample which can be modified for specific purposes. Features. Uses AES algorithm to encrypt files. Can be downloaded for free for anyone to download in GitHub. Many cyber criminals, lawyers, investigators and governments use this project.\n\u2022 Raspberry Robin is an activity cluster spread by external drives that leverages Windows Installer.", "modified": "2024-02-27T06:04:19.663000", "created": "2024-01-28T08:08:37.586000", "tags": [ "no expiration", "domain", "hostname", "expiration", "filehashsha256", "ipv4", "url http", "url https", "iocs", "filehashsha1", "next", "x509v3", "key", "windows", "write", "whois ssl", "whois whois", "win32", "198-46-194-153-host.colocrossing.com", "a domains", "a nxdomain", "aaaa", "accept", "adapter driver", "address", "address domain", "algorithm", "all octoseek", "cookie", "copy", "core", "domain names", "domain", "dnssec", "discord", "whois record", "cyberstalking", "d417n", "timestamp", "data", "subject", "cyberstalking", "creation date", "ipv4", "ip address", "http identifier", "hostname", "historical ssl", "highly targeted", "high level", "high", "hiddentear", "gmtn", "germany unknown", "location first", "ip files", "files", "false files", "eu data", "entries", "download encrypt", "encrypt", "download", "contacted", "communicating", "coinminer", "code", "cobalt strike", "cname", "click", "ca issuers", "issuers", "as133618", "as24940", "hetzner", "as26710", "icann", "as36352", "as24940 hetzner", "asn as133618", "as26710 icann", "apple as8075", "as47846", "as47995", "key algorithm", "united", "name", "type", "tsara brashears", "trojan", "key identifier", "key info", "land use", "link location", "united tls web", "tls web", "log id", "malvertizing", "malware", "http", "meekserver", "meta", "metasploit", "admin", "subject", "ransomware", "stop ransomware", "certificate status", "metro", "moved", "name servers", "netsupport rat", "number", "nxdomain", "passive dns", "servers", "server", "pegasus", "pingback", "submit", "ransom", "raspberry robin", "subject public", "subject key", "subject billing", "pdf broadcom", "pulse pulses", "pulse submit", "read c", "record value", "redacted referrer", "regbinary", "regdword", "registrant fax", "registrar", "registrar abuse", "registry domain", "registrar of", "registry policy", "regsetvalueexa", "regsetvalueexw", "show", "showing", "search", "urls", "script", "script domains", "scan endpoints", "russia unknown", "reverse dns", "resolutions", "nids", "related nids", "as39494 jsc", "body", "attorney james", "asn as133618", "javascript", "unknown", "url analysis", "unknown url", "url http", "v3 serial", "http", "as40528 icann", "as44273 host", "data center", "hosting", "vps", "reverse dns" ], "references": [ "deviceinbox.com [Malware Hosting - Pegasus]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]", "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]", "103.224.182.253 [Command and Control]", "198.46.194.153 [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia" ], "malware_families": [ { "id": "HiddenTear", "display_name": "HiddenTear", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [ "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 77, "FileHash-SHA1": 81, "FileHash-SHA256": 359, "URL": 218, "SSLCertFingerprint": 2, "domain": 1932, "email": 12, "hostname": 528 }, "indicator_count": 3209, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "827 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b8086a651e881715b3fc47", "name": "Hidden Tear BruteForcer", "description": "", "modified": "2024-02-27T06:04:19.663000", "created": "2024-01-29T20:19:54.173000", "tags": [ "no expiration", "domain", "hostname", "expiration", "filehashsha256", "ipv4", "url http", "url https", "iocs", "filehashsha1", "next", "x509v3", "key", "windows", "write", "whois ssl", "whois whois", "win32", "198-46-194-153-host.colocrossing.com", "a domains", "a nxdomain", "aaaa", "accept", "adapter driver", "address", "address domain", "algorithm", "all octoseek", "cookie", "copy", "core", "domain names", "domain", "dnssec", "discord", "whois record", "cyberstalking", "d417n", "timestamp", "data", "subject", "cyberstalking", "creation date", "ipv4", "ip address", "http identifier", "hostname", "historical ssl", "highly targeted", "high level", "high", "hiddentear", "gmtn", "germany unknown", "location first", "ip files", "files", "false files", "eu data", "entries", "download encrypt", "encrypt", "download", "contacted", "communicating", "coinminer", "code", "cobalt strike", "cname", "click", "ca issuers", "issuers", "as133618", "as24940", "hetzner", "as26710", "icann", "as36352", "as24940 hetzner", "asn as133618", "as26710 icann", "apple as8075", "as47846", "as47995", "key algorithm", "united", "name", "type", "tsara brashears", "trojan", "key identifier", "key info", "land use", "link location", "united tls web", "tls web", "log id", "malvertizing", "malware", "http", "meekserver", "meta", "metasploit", "admin", "subject", "ransomware", "stop ransomware", "certificate status", "metro", "moved", "name servers", "netsupport rat", "number", "nxdomain", "passive dns", "servers", "server", "pegasus", "pingback", "submit", "ransom", "raspberry robin", "subject public", "subject key", "subject billing", "pdf broadcom", "pulse pulses", "pulse submit", "read c", "record value", "redacted referrer", "regbinary", "regdword", "registrant fax", "registrar", "registrar abuse", "registry domain", "registrar of", "registry policy", "regsetvalueexa", "regsetvalueexw", "show", "showing", "search", "urls", "script", "script domains", "scan endpoints", "russia unknown", "reverse dns", "resolutions", "nids", "related nids", "as39494 jsc", "body", "attorney james", "asn as133618", "javascript", "unknown", "url analysis", "unknown url", "url http", "v3 serial", "http", "as40528 icann", "as44273 host", "data center", "hosting", "vps", "reverse dns" ], "references": [ "deviceinbox.com [Malware Hosting - Pegasus]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]", "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]", "103.224.182.253 [Command and Control]", "198.46.194.153 [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia" ], "malware_families": [ { "id": "HiddenTear", "display_name": "HiddenTear", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [ "Civil Society" ], "TLP": "white", "cloned_from": "65b60b85453c45eca795034d", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 77, "FileHash-SHA1": 81, "FileHash-SHA256": 359, "URL": 218, "SSLCertFingerprint": 2, "domain": 1932, "email": 12, "hostname": 528 }, "indicator_count": 3209, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "827 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b0558f71f7a001ff5ff7bc", "name": "Guardicore - 23-01-2024", "description": "", "modified": "2024-02-23T00:00:09.449000", "created": "2024-01-24T00:10:55.696000", "tags": [], "references": [ "https://threatintelligence.guardicore.com/download-guardicore-cyber-threat-intelligence-data.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 37, "hostname": 5 }, "indicator_count": 42, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "831 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "colocrossing.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "colocrossing.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780468107.0112362 }