{ "type": "Domain", "indicator": "comdevanywhere.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/comdevanywhere.com", "alexa": "http://www.alexa.com/siteinfo/comdevanywhere.com", "indicator": "comdevanywhere.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3232595856, "indicator": "comdevanywhere.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 13, "pulses": [ { "id": "6952fbca42c1b0da7431e6a7", "name": "Pegasus / Pegacloud - Infiltration (10-2013 or 2014 to Current/ Ongoing) ", "description": "", "modified": "2025-12-29T22:08:10.280000", "created": "2025-12-29T22:08:10.280000", "tags": [ "backdoor", "cyprus", "trojan", "mtb sep", "passive dns", "ddos", "mtb oct", "mtb aug", "ipv4 add", "smokeloader", "trojandropper", "extraction", "se extraction", "failed", "data upload", "enter s", "enter sc", "data u", "extrac please", "prop", "extre data", "type", "extr data", "include review", "exclude", "find s", "typ data", "source tir", "extri", "exclude sugges", "se type", "extra", "include data", "exclude review", "show", "showinil tvnes", "dom dom", "sc cat959", "drop", "pulse pulses", "worm", "files show", "date hash", "avast avg", "win32", "susp", "cyprus showing", "entries", "next associated", "urls show", "date checked", "url hostname", "server response", "ip address", "google safe", "server", "registrar abuse", "iana id", "contact phone", "dnssec", "domain status", "registrar url", "registrar whois", "date", "registrar", "se cre", "pul use", "url list", "status http", "linkid182227", "linkid151642", "first", "domain list", "ii llc", "sc data", "ukl extract", "hiloti style", "msle", "win3 data", "onio", "observea", "data data", "stop data", "monitored target", "tsara", "pegasus", "social engineering" ], "references": [ "http://fakejuko.site40/", "pegacloud.net", "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers", "IDS: Win32/Ibashade CnC Beacon", "IDS: Win32.Scar.hhrw POST", "IDS: Trojan.Win32.Cosmu.cdqg Checkin", "IDS: OnionDuke CnC Beacon 1", "IDS: Observed Suspicious UA (Mozilla/5.0)", "IDS: Data POST to an image file (jpg)", "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win32:WormX-gen [Wrm]", "display_name": "Win32:WormX-gen [Wrm]", "target": null }, { "id": "Worm:Win32:Drolnux", "display_name": "Worm:Win32:Drolnux", "target": null }, { "id": "Pegasus - MOB-S0005", "display_name": "Pegasus - MOB-S0005", "target": null } ], "attack_ids": [], "industries": [ "Technology", "Telecommunications", "Government" ], "TLP": "white", "cloned_from": "6877422df67773a07ef450c2", "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1630, "URL": 4078, "FileHash-MD5": 245, "FileHash-SHA1": 246, "FileHash-SHA256": 2561, "CVE": 2, "domain": 1307, "email": 1 }, "indicator_count": 10070, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "111 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6877422df67773a07ef450c2", "name": "Pegasus / Pegacloud - Infiltration", "description": "Pegasus IoC\u2019s found in the periphery of research. Appears target contacted a \u2018fake host\u2019 after finding name in multiple highly malicious domains. May have appeared between 12/2013 - 11-2014. Target was contacted by telephone and asked \u2018 have you checked Googled yourself\u2019, to which target answered \u2018Not really\u2019. Target was told \u2018you really should Google yourself\u2019. Target, upset about content clicked and began a takedown effort with host.\n\nThis seems to be at the start of many malicious campaigns. Requires further investigation.", "modified": "2025-08-15T05:01:22.570000", "created": "2025-07-16T06:09:49.704000", "tags": [ "backdoor", "cyprus", "trojan", "mtb sep", "passive dns", "ddos", "mtb oct", "mtb aug", "ipv4 add", "smokeloader", "trojandropper", "extraction", "se extraction", "failed", "data upload", "enter s", "enter sc", "data u", "extrac please", "prop", "extre data", "type", "extr data", "include review", "exclude", "find s", "typ data", "source tir", "extri", "exclude sugges", "se type", "extra", "include data", "exclude review", "show", "showinil tvnes", "dom dom", "sc cat959", "drop", "pulse pulses", "worm", "files show", "date hash", "avast avg", "win32", "susp", "cyprus showing", "entries", "next associated", "urls show", "date checked", "url hostname", "server response", "ip address", "google safe", "server", "registrar abuse", "iana id", "contact phone", "dnssec", "domain status", "registrar url", "registrar whois", "date", "registrar", "se cre", "pul use", "url list", "status http", "linkid182227", "linkid151642", "first", "domain list", "ii llc", "sc data", "ukl extract", "hiloti style", "msle", "win3 data", "onio", "observea", "data data", "stop data", "monitored target", "tsara", "pegasus", "social engineering" ], "references": [ "http://fakejuko.site40/", "pegacloud.net", "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers", "IDS: Win32/Ibashade CnC Beacon", "IDS: Win32.Scar.hhrw POST", "IDS: Trojan.Win32.Cosmu.cdqg Checkin", "IDS: OnionDuke CnC Beacon 1", "IDS: Observed Suspicious UA (Mozilla/5.0)", "IDS: Data POST to an image file (jpg)", "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win32:WormX-gen [Wrm]", "display_name": "Win32:WormX-gen [Wrm]", "target": null }, { "id": "Worm:Win32:Drolnux", "display_name": "Worm:Win32:Drolnux", "target": null }, { "id": "Pegasus - MOB-S0005", "display_name": "Pegasus - MOB-S0005", "target": null } ], "attack_ids": [], "industries": [ "Technology", "Telecommunications", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1630, "URL": 4078, "FileHash-MD5": 245, "FileHash-SHA1": 246, "FileHash-SHA256": 2561, "CVE": 2, "domain": 1307, "email": 1 }, "indicator_count": 10070, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "247 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d167a8cf2e7966af16a671", "name": "Mirai \u2022 Emotet \u2022 Injection VT & AlienVault reports deleted & modified", "description": "Remote actor uses injection, brute force and remote logins to delete incriminating pulse , virustotal and otx.alienvault pulses, nodes and/or graphs.\n\u2192https://myaccount.uscis.gov/- Immigration (DHS) Login. For years many tactics, social engineering and fraudulent activities persisted. Contact is made to American born citizens, to get in touch. A website is provided, homepage on affected devices is bogus, you have to call to address bogus government concern. Target calls redirected to a call center where they're told they have reached immigration, to verify PII, next told it's a mistake as they are not in the system. At some point meritless notification of Patriot Act violation is received. Identity theft occurs. Credit, bank and other accounts are cancelled. Likely away to gain legal access to spy on targets.", "modified": "2024-03-18T21:03:15.841000", "created": "2024-02-18T02:12:56.143000", "tags": [ "ssl certificate", "resolutions", "communicating", "historical ssl", "referrer", "united", "unknown", "passive dns", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "win32", "body", "read c", "write c", "show", "delete", "msie", "windows nt", "search", "read", "write", "default", "malware", "copy", "contacted", "execution", "contacted urls", "whois sslcert", "emotet", "creation date", "meta", "cookie", "pragma", "mozilla", "ms windows", "intel", "regsetvalueexa", "nsisinetc", "pe32", "class", "persistence", "code", "explorer", "toolbar", "next", "self", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "httponly", "html info", "us citizenship", "meta tags", "citizenship", "immigration", "trackers new", "relic na", "utc google", "tag manager", "gtm5h8hdq3", "ids detections", "title", "date", "entries", "content type", "a domains", "gmt server", "apache x", "path", "win32dh", "as46606", "slcc2", "media center", "temple", "port", "destination", "as29873 newfold", "digital", "as15169 google", "otx telemetry", "trojandropper", "trojan", "backdoor", "wabot", "apanas", "south korea", "as9318 sk", "as3786 lg", "china as4134", "get hello", "as4766 korea", "dlink router", "dsl2750b rce", "exploit", "mirai", "as21928", "china as4837", "gafgyt", "strings", "high priority", "pulses", "related tags", "file type", "sysv", "external", "virustotal", "as39962 pretecs", "canada unknown", "moved", "present dec", "server", "lifeweb server", "lifeweb", "encrypt", "accept", "malware infection", "yara detections", "icmp traffic", "top source", "top destination", "source source", "policy http", "client body", "wordpress login", "brain sabey", "hall render", "government", "https://myaccount.uscis.gov/", "attempted brute forcing", "remote handler", "junk data stuffing", "cyber threat", "human rights threat", "basic human rights", "collision", "collusion", "cultureneutral", "et trojan", "known hostile", "etpro trojan", "possible virut", "error", "stream", "vitro", "delphi", "form", "canvas" ], "references": [ "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022", "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/", "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331", "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine", "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection", "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com", "Yara Detections: GlassesCode" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Ireland", "Cyprus", "Sweden", "Australia", "Canada", "Hong Kong", "India", "Japan" ], "malware_families": [ { "id": "Win.Trojan.6977536-1", "display_name": "Win.Trojan.6977536-1", "target": null }, { "id": "Nebuler/Dialer.qn", "display_name": "Nebuler/Dialer.qn", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "NSIS", "display_name": "NSIS", "target": null }, { "id": "Win32/DH{gVIJAw?}", "display_name": "Win32/DH{gVIJAw?}", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null }, { "id": "DDoS:Linux/Mirai", "display_name": "DDoS:Linux/Mirai", "target": "/malware/DDoS:Linux/Mirai" }, { "id": "Trojan:Win32/Tinba!rfn", "display_name": "Trojan:Win32/Tinba!rfn", "target": "/malware/Trojan:Win32/Tinba!rfn" }, { "id": "Win32:Emotet-AI\\ [Trj]", "display_name": "Win32:Emotet-AI\\ [Trj]", "target": null }, { "id": "Win.Trojan.Generic-6333842-0", "display_name": "Win.Trojan.Generic-6333842-0", "target": null }, { "id": "Win32/CMSBrute/Pifagor", "display_name": "Win32/CMSBrute/Pifagor", "target": null }, { "id": "Win32:Trojan-gen", "display_name": "Win32:Trojan-gen", "target": null }, { "id": "Win32:Vitro", "display_name": "Win32:Vitro", "target": null } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [ "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 7636, "URL": 4080, "domain": 3917, "hostname": 1617, "FileHash-MD5": 1284, "FileHash-SHA1": 1213, "SSLCertFingerprint": 3, "CVE": 1 }, "indicator_count": 19751, "is_author": false, "is_subscribing": null, "subscriber_count": 234, "modified_text": "762 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d167a9c59fe757dc56b395", "name": "Mirai \u2022 Emotet \u2022 Injection VT & AlienVault reports deleted & modified", "description": "Remote actor uses injection, brute force and remote logins to delete incriminating pulse , virustotal and otx.alienvault pulses, nodes and/or graphs.\n\u2192https://myaccount.uscis.gov/- Immigration (DHS) Login. For years many tactics, social engineering and fraudulent activities persisted. Contact is made to American born citizens, to get in touch. A website is provided, homepage on affected devices is bogus, you have to call to address bogus government concern. Target calls redirected to a call center where they're told they have reached immigration, to verify PII, next told it's a mistake as they are not in the system. At some point meritless notification of Patriot Act violation is received. Identity theft occurs. Credit, bank and other accounts are cancelled. Likely away to gain legal access to spy on targets.", "modified": "2024-03-18T21:03:15.841000", "created": "2024-02-18T02:12:57.917000", "tags": [ "ssl certificate", "resolutions", "communicating", "historical ssl", "referrer", "united", "unknown", "passive dns", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "win32", "body", "read c", "write c", "show", "delete", "msie", "windows nt", "search", "read", "write", "default", "malware", "copy", "contacted", "execution", "contacted urls", "whois sslcert", "emotet", "creation date", "meta", "cookie", "pragma", "mozilla", "ms windows", "intel", "regsetvalueexa", "nsisinetc", "pe32", "class", "persistence", "code", "explorer", "toolbar", "next", "self", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "httponly", "html info", "us citizenship", "meta tags", "citizenship", "immigration", "trackers new", "relic na", "utc google", "tag manager", "gtm5h8hdq3", "ids detections", "title", "date", "entries", "content type", "a domains", "gmt server", "apache x", "path", "win32dh", "as46606", "slcc2", "media center", "temple", "port", "destination", "as29873 newfold", "digital", "as15169 google", "otx telemetry", "trojandropper", "trojan", "backdoor", "wabot", "apanas", "south korea", "as9318 sk", "as3786 lg", "china as4134", "get hello", "as4766 korea", "dlink router", "dsl2750b rce", "exploit", "mirai", "as21928", "china as4837", "gafgyt", "strings", "high priority", "pulses", "related tags", "file type", "sysv", "external", "virustotal", "as39962 pretecs", "canada unknown", "moved", "present dec", "server", "lifeweb server", "lifeweb", "encrypt", "accept", "malware infection", "yara detections", "icmp traffic", "top source", "top destination", "source source", "policy http", "client body", "wordpress login", "brain sabey", "hall render", "government", "https://myaccount.uscis.gov/", "attempted brute forcing", "remote handler", "junk data stuffing", "cyber threat", "human rights threat", "basic human rights", "collision", "collusion", "cultureneutral", "et trojan", "known hostile", "etpro trojan", "possible virut", "error", "stream", "vitro", "delphi", "form", "canvas" ], "references": [ "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022", "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/", "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331", "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine", "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection", "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com", "Yara Detections: GlassesCode" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Ireland", "Cyprus", "Sweden", "Australia", "Canada", "Hong Kong", "India", "Japan" ], "malware_families": [ { "id": "Win.Trojan.6977536-1", "display_name": "Win.Trojan.6977536-1", "target": null }, { "id": "Nebuler/Dialer.qn", "display_name": "Nebuler/Dialer.qn", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "NSIS", "display_name": "NSIS", "target": null }, { "id": "Win32/DH{gVIJAw?}", "display_name": "Win32/DH{gVIJAw?}", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null }, { "id": "DDoS:Linux/Mirai", "display_name": "DDoS:Linux/Mirai", "target": "/malware/DDoS:Linux/Mirai" }, { "id": "Trojan:Win32/Tinba!rfn", "display_name": "Trojan:Win32/Tinba!rfn", "target": "/malware/Trojan:Win32/Tinba!rfn" }, { "id": "Win32:Emotet-AI\\ [Trj]", "display_name": "Win32:Emotet-AI\\ [Trj]", "target": null }, { "id": "Win.Trojan.Generic-6333842-0", "display_name": "Win.Trojan.Generic-6333842-0", "target": null }, { "id": "Win32/CMSBrute/Pifagor", "display_name": "Win32/CMSBrute/Pifagor", "target": null }, { "id": "Win32:Trojan-gen", "display_name": "Win32:Trojan-gen", "target": null }, { "id": "Win32:Vitro", "display_name": "Win32:Vitro", "target": null } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [ "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 7636, "URL": 4080, "domain": 3917, "hostname": 1617, "FileHash-MD5": 1284, "FileHash-SHA1": 1213, "SSLCertFingerprint": 3, "CVE": 1 }, "indicator_count": 19751, "is_author": false, "is_subscribing": null, "subscriber_count": 234, "modified_text": "762 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d3ae057e25854811cc1395", "name": "Mirai \u2022 Injection VT & AlienVault reports deleted & modified", "description": "", "modified": "2024-03-18T21:03:15.841000", "created": "2024-02-19T19:37:41.208000", "tags": [ "ssl certificate", "resolutions", "communicating", "historical ssl", "referrer", "united", "unknown", "passive dns", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "win32", "body", "read c", "write c", "show", "delete", "msie", "windows nt", "search", "read", "write", "default", "malware", "copy", "contacted", "execution", "contacted urls", "whois sslcert", "emotet", "creation date", "meta", "cookie", "pragma", "mozilla", "ms windows", "intel", "regsetvalueexa", "nsisinetc", "pe32", "class", "persistence", "code", "explorer", "toolbar", "next", "self", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "httponly", "html info", "us citizenship", "meta tags", "citizenship", "immigration", "trackers new", "relic na", "utc google", "tag manager", "gtm5h8hdq3", "ids detections", "title", "date", "entries", "content type", "a domains", "gmt server", "apache x", "path", "win32dh", "as46606", "slcc2", "media center", "temple", "port", "destination", "as29873 newfold", "digital", "as15169 google", "otx telemetry", "trojandropper", "trojan", "backdoor", "wabot", "apanas", "south korea", "as9318 sk", "as3786 lg", "china as4134", "get hello", "as4766 korea", "dlink router", "dsl2750b rce", "exploit", "mirai", "as21928", "china as4837", "gafgyt", "strings", "high priority", "pulses", "related tags", "file type", "sysv", "external", "virustotal", "as39962 pretecs", "canada unknown", "moved", "present dec", "server", "lifeweb server", "lifeweb", "encrypt", "accept", "malware infection", "yara detections", "icmp traffic", "top source", "top destination", "source source", "policy http", "client body", "wordpress login", "brain sabey", "hall render", "government", "https://myaccount.uscis.gov/", "attempted brute forcing", "remote handler", "junk data stuffing", "cyber threat", "human rights threat", "basic human rights", "collision", "collusion", "cultureneutral", "et trojan", "known hostile", "etpro trojan", "possible virut", "error", "stream", "vitro", "delphi", "form", "canvas" ], "references": [ "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022", "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/", "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331", "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine", "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection", "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com", "Yara Detections: GlassesCode" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Ireland", "Cyprus", "Sweden", "Australia", "Canada", "Hong Kong", "India", "Japan" ], "malware_families": [ { "id": "Win.Trojan.6977536-1", "display_name": "Win.Trojan.6977536-1", "target": null }, { "id": "Nebuler/Dialer.qn", "display_name": "Nebuler/Dialer.qn", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "NSIS", "display_name": "NSIS", "target": null }, { "id": "Win32/DH{gVIJAw?}", "display_name": "Win32/DH{gVIJAw?}", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null }, { "id": "DDoS:Linux/Mirai", "display_name": "DDoS:Linux/Mirai", "target": "/malware/DDoS:Linux/Mirai" }, { "id": "Trojan:Win32/Tinba!rfn", "display_name": "Trojan:Win32/Tinba!rfn", "target": "/malware/Trojan:Win32/Tinba!rfn" }, { "id": "Win32:Emotet-AI\\ [Trj]", "display_name": "Win32:Emotet-AI\\ [Trj]", "target": null }, { "id": "Win.Trojan.Generic-6333842-0", "display_name": "Win.Trojan.Generic-6333842-0", "target": null }, { "id": "Win32/CMSBrute/Pifagor", "display_name": "Win32/CMSBrute/Pifagor", "target": null }, { "id": "Win32:Trojan-gen", "display_name": "Win32:Trojan-gen", "target": null }, { "id": "Win32:Vitro", "display_name": "Win32:Vitro", "target": null } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [ "Civil Society" ], "TLP": "white", "cloned_from": "65d167a9c59fe757dc56b395", "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 7636, "URL": 4080, "domain": 3917, "hostname": 1617, "FileHash-MD5": 1284, "FileHash-SHA1": 1213, "SSLCertFingerprint": 3, "CVE": 1 }, "indicator_count": 19751, "is_author": false, "is_subscribing": null, "subscriber_count": 233, "modified_text": "762 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570914fe73d6efb17198812", "name": "https://areyou1or0.com/ - just like a lucky dip", "description": "", "modified": "2023-12-06T15:20:47.515000", "created": "2023-12-06T15:20:47.515000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "hostname": 496, "FileHash-SHA256": 351, "FileHash-MD5": 56, "FileHash-SHA1": 50, "URL": 2028, "domain": 711, "email": 1 }, "indicator_count": 3695, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "657089a4538a6eb3a87d0377", "name": "123hp.com", "description": "", "modified": "2023-12-06T14:48:04.767000", "created": "2023-12-06T14:48:04.767000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-SHA256": 919, "domain": 1558, "URL": 3705, "hostname": 767, "email": 1, "FileHash-MD5": 6, "FileHash-SHA1": 21 }, "indicator_count": 6979, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707f2ff383a8d5315e9928", "name": "www.trump-email.com", "description": "", "modified": "2023-12-06T14:03:27.350000", "created": "2023-12-06T14:03:27.350000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 412, "URL": 2034, "domain": 630, "hostname": 565 }, "indicator_count": 3642, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707dbbb0493c03ba107643", "name": "loggly.com and pstv.com/ supernetforme.com live malware", "description": "", "modified": "2023-12-06T13:57:15.377000", "created": "2023-12-06T13:57:15.377000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 1933, "domain": 1302, "hostname": 805, "URL": 3593, "FileHash-MD5": 1 }, "indicator_count": 7635, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62f578d9bd71fef18276273b", "name": "https://areyou1or0.com/ - just like a lucky dip", "description": "", "modified": "2022-09-10T00:03:24.542000", "created": "2022-08-11T21:47:05.669000", "tags": [ "https://areyou1or0.com/", "http://direct.digitallanding.com/javascript/9.5.11.0/en-US/strin" ], "references": [ "g09925ed356e14431a1e64a663b9575c0939804b376704d96b75c2aea4245b05d.json", "http://direct.digitallanding.com/javascript/9.5.11.0/en-US/strings.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2047, "FileHash-SHA256": 351, "hostname": 503, "domain": 724, "CVE": 2, "FileHash-MD5": 56, "FileHash-SHA1": 50, "email": 1 }, "indicator_count": 3734, "is_author": false, "is_subscribing": null, "subscriber_count": 394, "modified_text": "1317 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6235f184c7c0b2c41f66c020", "name": "123hp.com", "description": "", "modified": "2022-04-18T00:07:16.048000", "created": "2022-03-19T15:06:44.592000", "tags": [ "server", "registrar abuse", "iana id", "contact phone", "domain status", "registrar url", "registrar whois", "date", "contact email", "llc domain", "dns replication", "subdomains", "comodo valkyrie", "verdict", "rank value", "ingestion time", "statvoo", "utc alexa", "utc cisco", "umbrella", "123HP.com", "ludevices.com" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 767, "URL": 3705, "domain": 1558, "FileHash-SHA256": 919, "CVE": 2, "email": 1, "FileHash-MD5": 6, "FileHash-SHA1": 21 }, "indicator_count": 6979, "is_author": false, "is_subscribing": null, "subscriber_count": 408, "modified_text": "1462 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "621865c382f1d7c17c3bf770", "name": "www.trump-email.com", "description": "", "modified": "2022-03-26T00:05:56.150000", "created": "2022-02-25T05:14:43.463000", "tags": [ "whois record", "whois", "ssl certificate" ], "references": [ "https://www.virustotal.com/graph/g66bac96efd184e35bc0a8a1be9dbeba87d6ffc3d3ca24fd7b207cee525b2b800" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 565, "URL": 2034, "domain": 630, "FileHash-SHA256": 412, "CVE": 1 }, "indicator_count": 3642, "is_author": false, "is_subscribing": null, "subscriber_count": 408, "modified_text": "1485 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f9b4b2c6c645e9839112b2", "name": "loggly.com and pstv.com/ supernetforme.com live malware", "description": "www.logs-01.loggly.com\ncallplus.loggly.com\npopcap.loggly.com\nwiki.loggly.com", "modified": "2022-03-04T00:00:56.902000", "created": "2022-02-01T22:31:14.017000", "tags": [ "irst seen", "date", "file sha256", "network related", "malicious", "found" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3593, "FileHash-SHA256": 1933, "hostname": 805, "domain": 1302, "FileHash-MD5": 1, "CVE": 1 }, "indicator_count": 7635, "is_author": false, "is_subscribing": null, "subscriber_count": 397, "modified_text": "1507 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "http://fakejuko.site40/", "g09925ed356e14431a1e64a663b9575c0939804b376704d96b75c2aea4245b05d.json", "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/", "IDS: Trojan.Win32.Cosmu.cdqg Checkin", "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214", "http://direct.digitallanding.com/javascript/9.5.11.0/en-US/strings.js", "Yara Detections: GlassesCode", "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022", "IDS: Observed Suspicious UA (Mozilla/5.0)", "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com", "IDS: Win32/Ibashade CnC Beacon", "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine", "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection", "IDS: Data POST to an image file (jpg)", "IDS: OnionDuke CnC Beacon 1", "IDS: Win32.Scar.hhrw POST", "https://www.virustotal.com/graph/g66bac96efd184e35bc0a8a1be9dbeba87d6ffc3d3ca24fd7b207cee525b2b800", "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers", "pegacloud.net", "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Win.trojan.generic-6333842-0", "Pegasus - mob-s0005", "Win32:vitro", "Win32:emotet-ai\\ [trj]", "Nebuler/dialer.qn", "Win.trojan.6977536-1", "Nsis", "Et", "Win32:wormx-gen [wrm]", "Win32/dh{gvijaw?}", "Elf:ddos-y\\ [trj]", "Trojan:win32/tinba!rfn", "Win32:trojan-gen", "Worm:win32:drolnux", "Ddos:linux/mirai", "Win32/cmsbrute/pifagor" ], "industries": [ "Telecommunications", "Civil society", "Government", "Technology" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 13, "pulses": [ { "id": "6952fbca42c1b0da7431e6a7", "name": "Pegasus / Pegacloud - Infiltration (10-2013 or 2014 to Current/ Ongoing) ", "description": "", "modified": "2025-12-29T22:08:10.280000", "created": "2025-12-29T22:08:10.280000", "tags": [ "backdoor", "cyprus", "trojan", "mtb sep", "passive dns", "ddos", "mtb oct", "mtb aug", "ipv4 add", "smokeloader", "trojandropper", "extraction", "se extraction", "failed", "data upload", "enter s", "enter sc", "data u", "extrac please", "prop", "extre data", "type", "extr data", "include review", "exclude", "find s", "typ data", "source tir", "extri", "exclude sugges", "se type", "extra", "include data", "exclude review", "show", "showinil tvnes", "dom dom", "sc cat959", "drop", "pulse pulses", "worm", "files show", "date hash", "avast avg", "win32", "susp", "cyprus showing", "entries", "next associated", "urls show", "date checked", "url hostname", "server response", "ip address", "google safe", "server", "registrar abuse", "iana id", "contact phone", "dnssec", "domain status", "registrar url", "registrar whois", "date", "registrar", "se cre", "pul use", "url list", "status http", "linkid182227", "linkid151642", "first", "domain list", "ii llc", "sc data", "ukl extract", "hiloti style", "msle", "win3 data", "onio", "observea", "data data", "stop data", "monitored target", "tsara", "pegasus", "social engineering" ], "references": [ "http://fakejuko.site40/", "pegacloud.net", "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers", "IDS: Win32/Ibashade CnC Beacon", "IDS: Win32.Scar.hhrw POST", "IDS: Trojan.Win32.Cosmu.cdqg Checkin", "IDS: OnionDuke CnC Beacon 1", "IDS: Observed Suspicious UA (Mozilla/5.0)", "IDS: Data POST to an image file (jpg)", "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win32:WormX-gen [Wrm]", "display_name": "Win32:WormX-gen [Wrm]", "target": null }, { "id": "Worm:Win32:Drolnux", "display_name": "Worm:Win32:Drolnux", "target": null }, { "id": "Pegasus - MOB-S0005", "display_name": "Pegasus - MOB-S0005", "target": null } ], "attack_ids": [], "industries": [ "Technology", "Telecommunications", "Government" ], "TLP": "white", "cloned_from": "6877422df67773a07ef450c2", "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1630, "URL": 4078, "FileHash-MD5": 245, "FileHash-SHA1": 246, "FileHash-SHA256": 2561, "CVE": 2, "domain": 1307, "email": 1 }, "indicator_count": 10070, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "111 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6877422df67773a07ef450c2", "name": "Pegasus / Pegacloud - Infiltration", "description": "Pegasus IoC\u2019s found in the periphery of research. Appears target contacted a \u2018fake host\u2019 after finding name in multiple highly malicious domains. May have appeared between 12/2013 - 11-2014. Target was contacted by telephone and asked \u2018 have you checked Googled yourself\u2019, to which target answered \u2018Not really\u2019. Target was told \u2018you really should Google yourself\u2019. Target, upset about content clicked and began a takedown effort with host.\n\nThis seems to be at the start of many malicious campaigns. Requires further investigation.", "modified": "2025-08-15T05:01:22.570000", "created": "2025-07-16T06:09:49.704000", "tags": [ "backdoor", "cyprus", "trojan", "mtb sep", "passive dns", "ddos", "mtb oct", "mtb aug", "ipv4 add", "smokeloader", "trojandropper", "extraction", "se extraction", "failed", "data upload", "enter s", "enter sc", "data u", "extrac please", "prop", "extre data", "type", "extr data", "include review", "exclude", "find s", "typ data", "source tir", "extri", "exclude sugges", "se type", "extra", "include data", "exclude review", "show", "showinil tvnes", "dom dom", "sc cat959", "drop", "pulse pulses", "worm", "files show", "date hash", "avast avg", "win32", "susp", "cyprus showing", "entries", "next associated", "urls show", "date checked", "url hostname", "server response", "ip address", "google safe", "server", "registrar abuse", "iana id", "contact phone", "dnssec", "domain status", "registrar url", "registrar whois", "date", "registrar", "se cre", "pul use", "url list", "status http", "linkid182227", "linkid151642", "first", "domain list", "ii llc", "sc data", "ukl extract", "hiloti style", "msle", "win3 data", "onio", "observea", "data data", "stop data", "monitored target", "tsara", "pegasus", "social engineering" ], "references": [ "http://fakejuko.site40/", "pegacloud.net", "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers", "IDS: Win32/Ibashade CnC Beacon", "IDS: Win32.Scar.hhrw POST", "IDS: Trojan.Win32.Cosmu.cdqg Checkin", "IDS: OnionDuke CnC Beacon 1", "IDS: Observed Suspicious UA (Mozilla/5.0)", "IDS: Data POST to an image file (jpg)", "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win32:WormX-gen [Wrm]", "display_name": "Win32:WormX-gen [Wrm]", "target": null }, { "id": "Worm:Win32:Drolnux", "display_name": "Worm:Win32:Drolnux", "target": null }, { "id": "Pegasus - MOB-S0005", "display_name": "Pegasus - MOB-S0005", "target": null } ], "attack_ids": [], "industries": [ "Technology", "Telecommunications", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1630, "URL": 4078, "FileHash-MD5": 245, "FileHash-SHA1": 246, "FileHash-SHA256": 2561, "CVE": 2, "domain": 1307, "email": 1 }, "indicator_count": 10070, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "247 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d167a8cf2e7966af16a671", "name": "Mirai \u2022 Emotet \u2022 Injection VT & AlienVault reports deleted & modified", "description": "Remote actor uses injection, brute force and remote logins to delete incriminating pulse , virustotal and otx.alienvault pulses, nodes and/or graphs.\n\u2192https://myaccount.uscis.gov/- Immigration (DHS) Login. For years many tactics, social engineering and fraudulent activities persisted. Contact is made to American born citizens, to get in touch. A website is provided, homepage on affected devices is bogus, you have to call to address bogus government concern. Target calls redirected to a call center where they're told they have reached immigration, to verify PII, next told it's a mistake as they are not in the system. At some point meritless notification of Patriot Act violation is received. Identity theft occurs. Credit, bank and other accounts are cancelled. Likely away to gain legal access to spy on targets.", "modified": "2024-03-18T21:03:15.841000", "created": "2024-02-18T02:12:56.143000", "tags": [ "ssl certificate", "resolutions", "communicating", "historical ssl", "referrer", "united", "unknown", "passive dns", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "win32", "body", "read c", "write c", "show", "delete", "msie", "windows nt", "search", "read", "write", "default", "malware", "copy", "contacted", "execution", "contacted urls", "whois sslcert", "emotet", "creation date", "meta", "cookie", "pragma", "mozilla", "ms windows", "intel", "regsetvalueexa", "nsisinetc", "pe32", "class", "persistence", "code", "explorer", "toolbar", "next", "self", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "httponly", "html info", "us citizenship", "meta tags", "citizenship", "immigration", "trackers new", "relic na", "utc google", "tag manager", "gtm5h8hdq3", "ids detections", "title", "date", "entries", "content type", "a domains", "gmt server", "apache x", "path", "win32dh", "as46606", "slcc2", "media center", "temple", "port", "destination", "as29873 newfold", "digital", "as15169 google", "otx telemetry", "trojandropper", "trojan", "backdoor", "wabot", "apanas", "south korea", "as9318 sk", "as3786 lg", "china as4134", "get hello", "as4766 korea", "dlink router", "dsl2750b rce", "exploit", "mirai", "as21928", "china as4837", "gafgyt", "strings", "high priority", "pulses", "related tags", "file type", "sysv", "external", "virustotal", "as39962 pretecs", "canada unknown", "moved", "present dec", "server", "lifeweb server", "lifeweb", "encrypt", "accept", "malware infection", "yara detections", "icmp traffic", "top source", "top destination", "source source", "policy http", "client body", "wordpress login", "brain sabey", "hall render", "government", "https://myaccount.uscis.gov/", "attempted brute forcing", "remote handler", "junk data stuffing", "cyber threat", "human rights threat", "basic human rights", "collision", "collusion", "cultureneutral", "et trojan", "known hostile", "etpro trojan", "possible virut", "error", "stream", "vitro", "delphi", "form", "canvas" ], "references": [ "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022", "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/", "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331", "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine", "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection", "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com", "Yara Detections: GlassesCode" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Ireland", "Cyprus", "Sweden", "Australia", "Canada", "Hong Kong", "India", "Japan" ], "malware_families": [ { "id": "Win.Trojan.6977536-1", "display_name": "Win.Trojan.6977536-1", "target": null }, { "id": "Nebuler/Dialer.qn", "display_name": "Nebuler/Dialer.qn", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "NSIS", "display_name": "NSIS", "target": null }, { "id": "Win32/DH{gVIJAw?}", "display_name": "Win32/DH{gVIJAw?}", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null }, { "id": "DDoS:Linux/Mirai", "display_name": "DDoS:Linux/Mirai", "target": "/malware/DDoS:Linux/Mirai" }, { "id": "Trojan:Win32/Tinba!rfn", "display_name": "Trojan:Win32/Tinba!rfn", "target": "/malware/Trojan:Win32/Tinba!rfn" }, { "id": "Win32:Emotet-AI\\ [Trj]", "display_name": "Win32:Emotet-AI\\ [Trj]", "target": null }, { "id": "Win.Trojan.Generic-6333842-0", "display_name": "Win.Trojan.Generic-6333842-0", "target": null }, { "id": "Win32/CMSBrute/Pifagor", "display_name": "Win32/CMSBrute/Pifagor", "target": null }, { "id": "Win32:Trojan-gen", "display_name": "Win32:Trojan-gen", "target": null }, { "id": "Win32:Vitro", "display_name": "Win32:Vitro", "target": null } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [ "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 7636, "URL": 4080, "domain": 3917, "hostname": 1617, "FileHash-MD5": 1284, "FileHash-SHA1": 1213, "SSLCertFingerprint": 3, "CVE": 1 }, "indicator_count": 19751, "is_author": false, "is_subscribing": null, "subscriber_count": 234, "modified_text": "762 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d167a9c59fe757dc56b395", "name": "Mirai \u2022 Emotet \u2022 Injection VT & AlienVault reports deleted & modified", "description": "Remote actor uses injection, brute force and remote logins to delete incriminating pulse , virustotal and otx.alienvault pulses, nodes and/or graphs.\n\u2192https://myaccount.uscis.gov/- Immigration (DHS) Login. For years many tactics, social engineering and fraudulent activities persisted. Contact is made to American born citizens, to get in touch. A website is provided, homepage on affected devices is bogus, you have to call to address bogus government concern. Target calls redirected to a call center where they're told they have reached immigration, to verify PII, next told it's a mistake as they are not in the system. At some point meritless notification of Patriot Act violation is received. Identity theft occurs. Credit, bank and other accounts are cancelled. Likely away to gain legal access to spy on targets.", "modified": "2024-03-18T21:03:15.841000", "created": "2024-02-18T02:12:57.917000", "tags": [ "ssl certificate", "resolutions", "communicating", "historical ssl", "referrer", "united", "unknown", "passive dns", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "win32", "body", "read c", "write c", "show", "delete", "msie", "windows nt", "search", "read", "write", "default", "malware", "copy", "contacted", "execution", "contacted urls", "whois sslcert", "emotet", "creation date", "meta", "cookie", "pragma", "mozilla", "ms windows", "intel", "regsetvalueexa", "nsisinetc", "pe32", "class", "persistence", "code", "explorer", "toolbar", "next", "self", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "httponly", "html info", "us citizenship", "meta tags", "citizenship", "immigration", "trackers new", "relic na", "utc google", "tag manager", "gtm5h8hdq3", "ids detections", "title", "date", "entries", "content type", "a domains", "gmt server", "apache x", "path", "win32dh", "as46606", "slcc2", "media center", "temple", "port", "destination", "as29873 newfold", "digital", "as15169 google", "otx telemetry", "trojandropper", "trojan", "backdoor", "wabot", "apanas", "south korea", "as9318 sk", "as3786 lg", "china as4134", "get hello", "as4766 korea", "dlink router", "dsl2750b rce", "exploit", "mirai", "as21928", "china as4837", "gafgyt", "strings", "high priority", "pulses", "related tags", "file type", "sysv", "external", "virustotal", "as39962 pretecs", "canada unknown", "moved", "present dec", "server", "lifeweb server", "lifeweb", "encrypt", "accept", "malware infection", "yara detections", "icmp traffic", "top source", "top destination", "source source", "policy http", "client body", "wordpress login", "brain sabey", "hall render", "government", "https://myaccount.uscis.gov/", "attempted brute forcing", "remote handler", "junk data stuffing", "cyber threat", "human rights threat", "basic human rights", "collision", "collusion", "cultureneutral", "et trojan", "known hostile", "etpro trojan", "possible virut", "error", "stream", "vitro", "delphi", "form", "canvas" ], "references": [ "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022", "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/", "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331", "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine", "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection", "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com", "Yara Detections: GlassesCode" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Ireland", "Cyprus", "Sweden", "Australia", "Canada", "Hong Kong", "India", "Japan" ], "malware_families": [ { "id": "Win.Trojan.6977536-1", "display_name": "Win.Trojan.6977536-1", "target": null }, { "id": "Nebuler/Dialer.qn", "display_name": "Nebuler/Dialer.qn", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "NSIS", "display_name": "NSIS", "target": null }, { "id": "Win32/DH{gVIJAw?}", "display_name": "Win32/DH{gVIJAw?}", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null }, { "id": "DDoS:Linux/Mirai", "display_name": "DDoS:Linux/Mirai", "target": "/malware/DDoS:Linux/Mirai" }, { "id": "Trojan:Win32/Tinba!rfn", "display_name": "Trojan:Win32/Tinba!rfn", "target": "/malware/Trojan:Win32/Tinba!rfn" }, { "id": "Win32:Emotet-AI\\ [Trj]", "display_name": "Win32:Emotet-AI\\ [Trj]", "target": null }, { "id": "Win.Trojan.Generic-6333842-0", "display_name": "Win.Trojan.Generic-6333842-0", "target": null }, { "id": "Win32/CMSBrute/Pifagor", "display_name": "Win32/CMSBrute/Pifagor", "target": null }, { "id": "Win32:Trojan-gen", "display_name": "Win32:Trojan-gen", "target": null }, { "id": "Win32:Vitro", "display_name": "Win32:Vitro", "target": null } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [ "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 7636, "URL": 4080, "domain": 3917, "hostname": 1617, "FileHash-MD5": 1284, "FileHash-SHA1": 1213, "SSLCertFingerprint": 3, "CVE": 1 }, "indicator_count": 19751, "is_author": false, "is_subscribing": null, "subscriber_count": 234, "modified_text": "762 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d3ae057e25854811cc1395", "name": "Mirai \u2022 Injection VT & AlienVault reports deleted & modified", "description": "", "modified": "2024-03-18T21:03:15.841000", "created": "2024-02-19T19:37:41.208000", "tags": [ "ssl certificate", "resolutions", "communicating", "historical ssl", "referrer", "united", "unknown", "passive dns", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "win32", "body", "read c", "write c", "show", "delete", "msie", "windows nt", "search", "read", "write", "default", "malware", "copy", "contacted", "execution", "contacted urls", "whois sslcert", "emotet", "creation date", "meta", "cookie", "pragma", "mozilla", "ms windows", "intel", "regsetvalueexa", "nsisinetc", "pe32", "class", "persistence", "code", "explorer", "toolbar", "next", "self", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "httponly", "html info", "us citizenship", "meta tags", "citizenship", "immigration", "trackers new", "relic na", "utc google", "tag manager", "gtm5h8hdq3", "ids detections", "title", "date", "entries", "content type", "a domains", "gmt server", "apache x", "path", "win32dh", "as46606", "slcc2", "media center", "temple", "port", "destination", "as29873 newfold", "digital", "as15169 google", "otx telemetry", "trojandropper", "trojan", "backdoor", "wabot", "apanas", "south korea", "as9318 sk", "as3786 lg", "china as4134", "get hello", "as4766 korea", "dlink router", "dsl2750b rce", "exploit", "mirai", "as21928", "china as4837", "gafgyt", "strings", "high priority", "pulses", "related tags", "file type", "sysv", "external", "virustotal", "as39962 pretecs", "canada unknown", "moved", "present dec", "server", "lifeweb server", "lifeweb", "encrypt", "accept", "malware infection", "yara detections", "icmp traffic", "top source", "top destination", "source source", "policy http", "client body", "wordpress login", "brain sabey", "hall render", "government", "https://myaccount.uscis.gov/", "attempted brute forcing", "remote handler", "junk data stuffing", "cyber threat", "human rights threat", "basic human rights", "collision", "collusion", "cultureneutral", "et trojan", "known hostile", "etpro trojan", "possible virut", "error", "stream", "vitro", "delphi", "form", "canvas" ], "references": [ "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022", "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/", "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331", "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine", "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection", "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com", "Yara Detections: GlassesCode" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Ireland", "Cyprus", "Sweden", "Australia", "Canada", "Hong Kong", "India", "Japan" ], "malware_families": [ { "id": "Win.Trojan.6977536-1", "display_name": "Win.Trojan.6977536-1", "target": null }, { "id": "Nebuler/Dialer.qn", "display_name": "Nebuler/Dialer.qn", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "NSIS", "display_name": "NSIS", "target": null }, { "id": "Win32/DH{gVIJAw?}", "display_name": "Win32/DH{gVIJAw?}", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null }, { "id": "DDoS:Linux/Mirai", "display_name": "DDoS:Linux/Mirai", "target": "/malware/DDoS:Linux/Mirai" }, { "id": "Trojan:Win32/Tinba!rfn", "display_name": "Trojan:Win32/Tinba!rfn", "target": "/malware/Trojan:Win32/Tinba!rfn" }, { "id": "Win32:Emotet-AI\\ [Trj]", "display_name": "Win32:Emotet-AI\\ [Trj]", "target": null }, { "id": "Win.Trojan.Generic-6333842-0", "display_name": "Win.Trojan.Generic-6333842-0", "target": null }, { "id": "Win32/CMSBrute/Pifagor", "display_name": "Win32/CMSBrute/Pifagor", "target": null }, { "id": "Win32:Trojan-gen", "display_name": "Win32:Trojan-gen", "target": null }, { "id": "Win32:Vitro", "display_name": "Win32:Vitro", "target": null } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [ "Civil Society" ], "TLP": "white", "cloned_from": "65d167a9c59fe757dc56b395", "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 7636, "URL": 4080, "domain": 3917, "hostname": 1617, "FileHash-MD5": 1284, "FileHash-SHA1": 1213, "SSLCertFingerprint": 3, "CVE": 1 }, "indicator_count": 19751, "is_author": false, "is_subscribing": null, "subscriber_count": 233, "modified_text": "762 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570914fe73d6efb17198812", "name": "https://areyou1or0.com/ - just like a lucky dip", "description": "", "modified": "2023-12-06T15:20:47.515000", "created": "2023-12-06T15:20:47.515000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "hostname": 496, "FileHash-SHA256": 351, "FileHash-MD5": 56, "FileHash-SHA1": 50, "URL": 2028, "domain": 711, "email": 1 }, "indicator_count": 3695, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "657089a4538a6eb3a87d0377", "name": "123hp.com", "description": "", "modified": "2023-12-06T14:48:04.767000", "created": "2023-12-06T14:48:04.767000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-SHA256": 919, "domain": 1558, "URL": 3705, "hostname": 767, "email": 1, "FileHash-MD5": 6, "FileHash-SHA1": 21 }, "indicator_count": 6979, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707f2ff383a8d5315e9928", "name": "www.trump-email.com", "description": "", "modified": "2023-12-06T14:03:27.350000", "created": "2023-12-06T14:03:27.350000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 412, "URL": 2034, "domain": 630, "hostname": 565 }, "indicator_count": 3642, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707dbbb0493c03ba107643", "name": "loggly.com and pstv.com/ supernetforme.com live malware", "description": "", "modified": "2023-12-06T13:57:15.377000", "created": "2023-12-06T13:57:15.377000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 1933, "domain": 1302, "hostname": 805, "URL": 3593, "FileHash-MD5": 1 }, "indicator_count": 7635, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62f578d9bd71fef18276273b", "name": "https://areyou1or0.com/ - just like a lucky dip", "description": "", "modified": "2022-09-10T00:03:24.542000", "created": "2022-08-11T21:47:05.669000", "tags": [ "https://areyou1or0.com/", "http://direct.digitallanding.com/javascript/9.5.11.0/en-US/strin" ], "references": [ "g09925ed356e14431a1e64a663b9575c0939804b376704d96b75c2aea4245b05d.json", "http://direct.digitallanding.com/javascript/9.5.11.0/en-US/strings.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2047, "FileHash-SHA256": 351, "hostname": 503, "domain": 724, "CVE": 2, "FileHash-MD5": 56, "FileHash-SHA1": 50, "email": 1 }, "indicator_count": 3734, "is_author": false, "is_subscribing": null, "subscriber_count": 394, "modified_text": "1317 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "comdevanywhere.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "comdevanywhere.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1776639706.0194435 }