{ "type": "Domain", "indicator": "ctrl-verse.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/ctrl-verse.com", "alexa": "http://www.alexa.com/siteinfo/ctrl-verse.com", "indicator": "ctrl-verse.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3896565037, "indicator": "ctrl-verse.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 7, "pulses": [ { "id": "66246ff49ed29ea9bb2bf122", "name": "S\u0105d Rejonowy w Jeleniej Gorze POLAND", "description": "Przechowywania lub dost\u0119pu do plik\u00f3w cookies w Twojej przegl\u0105darce\nhttps://www.virustotal.com/gui/domain/jelenia-gora.sr.gov.pl/relations", "modified": "2025-05-14T21:18:36.989000", "created": "2024-04-21T01:46:28.554000", "tags": [ "jeleniej grze", "aktualnoci", "informacje", "jednostka", "rejonowy", "konkurs", "najczciej", "sd rejonowy", "przejd", "czytaj", "click", "sdzia jarosaw", "wydziau", "sdzia grzegorz", "katarzyna", "rudnicka dane", "kontaktowe sd", "jelenia gra", "mickiewicza", "zawarto", "html", "nazwa meta", "robotw", "telefon", "brak", "skala", "ua zgodna", "head body", "zasb", "cname", "kod odpowiedzi", "kodowanie treci", "wygasa", "gmt serwer", "pragma", "kontrola pamici", "podrcznej", "data", "gmt kontrola", "dostpuzezwl na", "czytaj wicej", "sd okrgowy", "jednostki", "okrgowy", "ogoszenia", "sha256", "vhash", "ssdeep", "https odcisk", "palca jarma", "https dane", "v3 numer", "odcisk palca", "tworzy katalog", "tworzy pliki", "typ pliku", "json", "ascii", "windows", "sqlite", "foxpro fpt", "links typ", "mapa", "152 x", "sqlite w", "sha1", "sha512", "file size", "b file", "testing", "komornik sdowy", "sdzie rejonowym", "tomasz rodacki", "obwieszczenie", "komornicze", "tumacza migam", "tumacz czynny", "zamknite", "wiadczenia", "schedule", "error", "javascript", "bakers hall", "ixaction", "script", "ixchatlauncher", "compatibility", "com dla", "t1055 pewno", "unikanie obrony", "t1036 maskarada", "t1082 pewno", "informacje o", "nazwa pliku", "dokument pdf", "rozmiar pliku", "zapowied", "type", "iii dbt", "utf8", "dziennik" ], "references": [ "S?d Rejonowy w Jeleniej G\u00f3rze.htm", "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm", "http://www.jelenia-gora.so.gov.pl/", "https://www.jelenia-gora.so.gov.pl/", "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze", "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora", "https://www.jelenia-gora.sr.gov.pl/spacer", "https://waf.intelix.pl/957476/Chat/Script/Compatibility" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "", "display_name": "", "target": null }, { "id": "serwer", "display_name": "serwer", "target": null } ], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "email": 71, "domain": 7651, "hostname": 7680, "IPv4": 331, "FileHash-SHA256": 16168, "URL": 10399, "FileHash-MD5": 3639, "FileHash-SHA1": 3468, "CIDR": 4, "CVE": 89, "YARA": 521, "SSLCertFingerprint": 25, "JA3": 1, "IPv6": 5813 }, "indicator_count": 55860, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "339 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66f235b9a7a94a6a61acd651", "name": "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan", "description": "This pulse represents a 'scattered sample' of data extracted from 'submissions of interest' made to virustotal, filescan_itsec, HybridAnalysis, anyrun_app, DynamiteLab, and triage (over a period of two months) which were submitted to urlscanio & subsequently GreyNoiseIO (which I've come across both from live samples and also those from offlined data). I don't particularly anticipate this will correlate w. anything specific - but at least will be put in one more place for further analysis & increased visibility.", "modified": "2025-03-07T08:38:08.584000", "created": "2024-09-24T03:44:57.902000", "tags": [ "geoip", "public url", "as16509", "amazon02", "as20940", "akamaiasn1", "as8075", "as15169", "google", "akamaias", "facebook", "telecom", "twitter", "media", "win64", "level3", "mini", "ukraine", "proton", "ghost", "win32", "cuba", "mexico", "indonesia", "seznam", "as3359", "as852" ], "references": [ "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1", "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c", "https://n0paste.eu/UH6n5pD/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada", "Anguilla", "Poland", "Aruba", "Australia", "Barbados", "Costa Rica", "Guatemala", "Philippines", "Panama", "Sint Maarten (Dutch part)", "Saint Martin (French part)", "Cayman Islands", "Cura\u00e7ao", "Mexico", "Saint Vincent and the Grenadines", "Saint Kitts and Nevis", "Tanzania, United Republic of", "Netherlands", "Ukraine", "Trinidad and Tobago", "Japan", "Bahamas", "United Kingdom of Great Britain and Northern Ireland", "Georgia" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Government", "Telecommunications", "Healthcare" ], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1, "CIDR": 1186, "CVE": 4, "FileHash-MD5": 29, "FileHash-SHA1": 3, "URL": 25493, "domain": 5396, "email": 10, "hostname": 10770 }, "indicator_count": 42892, "is_author": false, "is_subscribing": null, "subscriber_count": 147, "modified_text": "408 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65f3e394bcf868816a29c2dc", "name": "Google Pixel 7a Devices - Telus ISP devices 'protected' by Norton", "description": "Exactly as above. I mean, out of all of the phones these ones make phonecalls (most of the time can send & receive calls). Can be a little tricky. Incomplete - it be doing it's own thing downloading/uploading stuff and heading down the 'way all the other phones went' route.", "modified": "2024-11-02T15:05:54.240000", "created": "2024-03-15T05:58:44.839000", "tags": [ "ISP", "Google", "Telus", "Norton", "Pixel" ], "references": [ "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/summary", "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/iocs", "https://www.virustotal.com/graph/embed/ga590434b8e274dc99fd39dd298c8c786abff51132c8d4646bb3fb3f1f4c3d100?theme=dark", "https://www.virustotal.com/graph/embed/g16457cd5ead246d99d2ecf37b965641b258cffddb8374ad194cdea194868d1ec?theme=dark", "https://www.virustotal.com/graph/embed/g2ef035cd31754a649909336c174aa141b9cca7e431994d12969e0d9d73a01b71?theme=dark", "https://www.virustotal.com/graph/embed/g1ea71614909243c1a291970fa39651a2d169deef25b7418fab2f0299221eb152?theme=dark", "https://www.virustotal.com/graph/embed/g20d14d97883a4127a500c45fcfb6e3e4961a30ef4bf74db7ab918bcbdb3f476b?theme=dark", "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/graph", "", "https://www.filescan.io/uploads/66feb74d83903120b70c820f/reports/0a3a6c27-a872-4e0c-86a4-0fc690fb5ecd/details", "https://tip.neiki.dev/file/fb0b66efe3b780270db0693b6df42dd08068428b86fc1a579fe5117d4ae76e07/network", "http://www.hybrid-analysis.com/file-collection/66febb8ee0244a7af5014d61" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Telecommunications", "Technology", "Government" ], "TLP": "green", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1231, "FileHash-SHA1": 1215, "FileHash-SHA256": 99653, "URL": 158638, "domain": 49468, "hostname": 77233, "email": 6, "CIDR": 5450, "CVE": 55 }, "indicator_count": 392949, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "533 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6696f4f69476edc8e4273991", "name": "Logs - iOS SE2, SE3 & iOS 15 Pro Max & iPadOS Air 4 & Apple Macbook Air (A1466 - test device)", "description": "The following is a partial set of logs & leftovers from the Apple Family of Devices", "modified": "2024-09-03T00:02:13.980000", "created": "2024-07-16T22:32:21.627000", "tags": [ "please", "javascript", "entity", "rogers", "repstefanik", "myrakez", "polizeiberlin", "kaishhhhhh", "emilemando22", "uwmlife", "secblinken", "thomaskralow", "miaxdx" ], "references": [ "https://www.virustotal.com/gui/collection/8f896c9d4bbc5f488d41616e169d253f9caa43644a13a94a5f42df5e2cf9cc75/summary", "https://www.virustotal.com/graph/embed/gaa065e3cc130494ea44b292fa15ad0b3bda2259393974adf8fed22bbdbfcecf5?theme=dark", "https://www.virustotal.com/gui/collection/8f896c9d4bbc5f488d41616e169d253f9caa43644a13a94a5f42df5e2cf9cc75/iocs", "https://www.virustotal.com/gui/collection/8f896c9d4bbc5f488d41616e169d253f9caa43644a13a94a5f42df5e2cf9cc75/graph", "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9", "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9/iocs", "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9/graph", "https://www.virustotal.com/graph/embed/ga0f29bb3fd4a4235b62a2031e5fbc57ca39fc314565d43f28cbc0d096cc7d19a?theme=dark", "https://www.virustotal.com/gui/collection/eb8b56887a4e8962925ce3e96050303382deb55d5e602caa1cfbb81b6297ba2e", "https://www.virustotal.com/gui/collection/eb8b56887a4e8962925ce3e96050303382deb55d5e602caa1cfbb81b6297ba2e/iocs", "https://www.virustotal.com/gui/collection/eb8b56887a4e8962925ce3e96050303382deb55d5e602caa1cfbb81b6297ba2e/graph", "https://viz.greynoise.io/analysis/ba31ba2b-4967-4d39-ac24-143d9c66136b", "https://www.virustotal.com/gui/collection/3955f19b42e4ed4d4af0bb416ee463d8a6190cdcc4b1de29a0bf795d2dc18a97/summary", "https://www.virustotal.com/graph/embed/g1f620b321385470f9e0172dc878e371620e6bb704edc421ca6ef9b709db0fb59?theme=dark", "https://www.virustotal.com/gui/collection/3955f19b42e4ed4d4af0bb416ee463d8a6190cdcc4b1de29a0bf795d2dc18a97/iocs" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America", "Panama", "Guatemala", "Costa Rica", "Mexico", "Aruba" ], "malware_families": [], "attack_ids": [], "industries": [ "Healthcare", "Government", "Education", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 19, "FileHash-SHA1": 32, "FileHash-SHA256": 2179, "URL": 1365, "domain": 397, "hostname": 419 }, "indicator_count": 4411, "is_author": false, "is_subscribing": null, "subscriber_count": 132, "modified_text": "593 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "669ad504a491593b3092d20c", "name": "Apple Stuff Combined", "description": "Description: IOCs derived from downed Apple Fleet logs\nCommon IOCs from Apple-Related Products - extracted from Apple Logs/Reports", "modified": "2024-09-03T00:02:13.980000", "created": "2024-07-19T21:05:08.808000", "tags": [ "contains-zip", "contains-apk", "upx", "pecompact", "contains-elf", "attachment", "as-protect", "contains-pe", "aspack", "telock", "downloads-zip", "nsis", "downloads-pe", "base64-embedded", "bobsoft", "opendir" ], "references": [ "https://viz.greynoise.io/analysis/c8416853-215d-48d0-9420-b6f43cdb1aaf", "https://www.virustotal.com/graph/embed/g266c7267d27a42b494f80bfa327d9a47a182ff352a4843c69c655a09e131dd49?theme=dark", "https://www.virustotal.com/gui/collection/3955f19b42e4ed4d4af0bb416ee463d8a6190cdcc4b1de29a0bf795d2dc18a97/iocs", "https://viz.greynoise.io/analysis/0746f250-b49a-4017-9e80-b0c9ce1993d6", "cve-2015-2414, 2016-0101, 2006-3869, 2004-0790, 2004-0566, 2005-0068, 2009-1122, 2017-17215, 2017-11882, 2017-0199, 2002-0013, 2016-2569, 2014-8361, 1999-0016, 2008-2257, 2009-1535, 2022-30190, 2008-2938, 2014-6345, 2002-0012", "https://www.filescan.io/uploads/669fffb84c5c17942a7c1d3f/reports/c881cbc5-750f-4b35-a43d-084844d036e6/overview", "https://www.filescan.io/uploads/66a001cb3ba51bb345a32569/reports/34b4aa58-68cb-4045-8653-ccfd3a1fb3dd/overview", "https://urlscan.io/user/submit/", "https://viz.greynoise.io/analysis/cb9811dd-809d-4a25-bb28-512d2c2b3393", "https://www.virustotal.com/gui/collection/3955f19b42e4ed4d4af0bb416ee463d8a6190cdcc4b1de29a0bf795d2dc18a97/summary", "07.19.24: IPs, Greynoise: https://viz.greynoise.io/analysis/ba31ba2b-4967-4d39-ac24-143d9c66136b", "https://viz.greynoise.io/analysis/3fbd45fa-08a2-423a-98b9-e6b37ea05e8a" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Telecommunications", "Government", "Healthcare", "Education" ], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10067, "FileHash-SHA256": 6080, "hostname": 1957, "domain": 1445, "CVE": 20 }, "indicator_count": 19569, "is_author": false, "is_subscribing": null, "subscriber_count": 132, "modified_text": "593 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66540f16406788219bb4acab", "name": "iPadOS - iPad Air 4", "description": "Logs, Privacy Reports from a compromised iPad air 4 (Lockdown Mode & Hardware Key) - 3 different Apple IDs", "modified": "2024-08-06T16:02:05.410000", "created": "2024-05-27T04:41:58.185000", "tags": [ "please", "javascript", "Apple", "iPadOS" ], "references": [ "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9/iocs", "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9/graph", "https://viz.greynoise.io/analysis/91e32f0c-55b1-4b61-bf38-deee3033f6cc" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Telecommunications", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 20, "FileHash-SHA1": 80, "FileHash-SHA256": 1185, "URL": 190, "hostname": 121, "domain": 255 }, "indicator_count": 1851, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "621 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6656e6dbbe018a2dcb28a8e0", "name": "advancedstream.net - Acquired Apple iOS infrastructure, DNS,", "description": "Apple iOS service modifier.", "modified": "2024-06-28T08:01:11.978000", "created": "2024-05-29T08:27:07.009000", "tags": [ "reverse dns", "location united", "america flag", "lakewood", "united", "america asn", "dns resolutions", "domain", "domain status", "server", "algorithm", "key usage", "xcitium verdict", "cloud", "popularity", "rank position", "info", "date", "registrar abuse", "iana id", "contact phone", "dnssec", "registrar url", "registrar whois", "llc registry", "expiry date", "first", "law firm", "fort wayne", "co", "referrer", "historical ssl", "name verdict", "falcon sandbox", "sha256", "ascii text", "sha1", "size", "pattern match", "et tor", "known tor", "relayrouter", "exit", "node traffic", "span", "hybrid", "body", "footer", "contact", "local", "encrypt", "click", "facebook", "strings", "meta", "district", "generator", "code", "service", "bill", "nemtih", "sredrum", "co lp", "dynamicloader", "default", "medium", "show", "http request", "http", "delete", "ids detections", "yara detections", "copy", "powershell", "win64", "write", "malware", "download", "malware", "trojan", "windows", "shellexecuteexw", "search", "entries", "writeconsolew", "registry", "t1031", "modify existing", "dock", "win32" ], "references": [ "Reverse DNS: advancedstream.net Location: United States of America - Lakewood, Colorado United States of America", "ASN AS30170 isomedia inc. DNS Resolutions 1 Domain", "spamgateway.advancedstream.net", "smtpha.momentumtelecom.com", "cityoffortwayne.org | detect.cityoffortwayne.org | https://engage.cityoffortwayne.org/", "https://utilities.cityoffortwayne.org/wp-content/uploads/2023/05/2023-Biosolids-Info-Sheet.pdf", "podcast.hallco.org hmmm? Who could it be.", "IDS Detections: PE EXE or DLL Windows file download HTTP | SUSPICIOUS Dotted Quad Host MZ Response | Packed Executable Download", "IDS Detectionsa: Executable Download from dotted-quad Host | Terse alphanumeric executable downloader high likelihood of being hostile", "Yara Detections: ConventionEngine_Term_Desktop , ConventionEngine_Term_Users", "Alerts: network_ip_exe network_questionable_http_path suricata_alert", "Alerts: dynamic_function_loading powershell_download powershell_request network_cnc_http network_http", "Alerts: dead_connect antivm_network_adapters", "https://otx.alienvault.com/indicator/file/a909dd4960d4da51de82e4dfff0a5aa60e35da6b2845680716ad832dc1d8b010", "http://www.leechburg.k12.pa.us/cms/lib09/PA01916522/Centricity/Domain/4/Mr.%20Ritzel%20obituary.pdf", "https://ato.gov.au.69741db048f4bdd03a6dad409e702ab4.grantelgin.com/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ALF:JASYP:TrojanDownloader:Win32/SmallAgent!atmn", "display_name": "ALF:JASYP:TrojanDownloader:Win32/SmallAgent!atmn", "target": null }, { "id": "Win32:Malware-gen", "display_name": "Win32:Malware-gen", "target": null }, { "id": "Win32:CoinminerX-gen\\ [Trj]", "display_name": "Win32:CoinminerX-gen\\ [Trj]", "target": null }, { "id": "Win.Malware.Tofsee-6958935-0", "display_name": "Win.Malware.Tofsee-6958935-0", "target": null }, { "id": "Trojan:Win32/SmokeLoader.YL", "display_name": "Trojan:Win32/SmokeLoader.YL", "target": "/malware/Trojan:Win32/SmokeLoader.YL" } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" } ], "industries": [ "Civil Society", "Telecommunications" ], "TLP": "green", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 338, "FileHash-SHA1": 77, "email": 2, "hostname": 497, "URL": 928, "FileHash-SHA256": 572, "FileHash-MD5": 76, "SSLCertFingerprint": 6 }, "indicator_count": 2496, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "660 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "", "https://www.virustotal.com/graph/embed/gaa065e3cc130494ea44b292fa15ad0b3bda2259393974adf8fed22bbdbfcecf5?theme=dark", "https://www.filescan.io/uploads/66a001cb3ba51bb345a32569/reports/34b4aa58-68cb-4045-8653-ccfd3a1fb3dd/overview", "https://viz.greynoise.io/analysis/ba31ba2b-4967-4d39-ac24-143d9c66136b", "07.19.24: IPs, Greynoise: https://viz.greynoise.io/analysis/ba31ba2b-4967-4d39-ac24-143d9c66136b", "IDS Detections: PE EXE or DLL Windows file download HTTP | SUSPICIOUS Dotted Quad Host MZ Response | Packed Executable Download", "https://www.jelenia-gora.so.gov.pl/", "https://www.virustotal.com/graph/embed/g266c7267d27a42b494f80bfa327d9a47a182ff352a4843c69c655a09e131dd49?theme=dark", "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/graph", "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9/graph", "http://www.leechburg.k12.pa.us/cms/lib09/PA01916522/Centricity/Domain/4/Mr.%20Ritzel%20obituary.pdf", "cityoffortwayne.org | detect.cityoffortwayne.org | https://engage.cityoffortwayne.org/", "https://otx.alienvault.com/indicator/file/a909dd4960d4da51de82e4dfff0a5aa60e35da6b2845680716ad832dc1d8b010", "https://waf.intelix.pl/957476/Chat/Script/Compatibility", "IDS Detectionsa: Executable Download from dotted-quad Host | Terse alphanumeric executable downloader high likelihood of being hostile", "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm", "https://www.virustotal.com/gui/collection/8f896c9d4bbc5f488d41616e169d253f9caa43644a13a94a5f42df5e2cf9cc75/graph", "https://viz.greynoise.io/analysis/91e32f0c-55b1-4b61-bf38-deee3033f6cc", "https://www.virustotal.com/graph/embed/g1ea71614909243c1a291970fa39651a2d169deef25b7418fab2f0299221eb152?theme=dark", "https://n0paste.eu/UH6n5pD/", "S?d Rejonowy w Jeleniej G\u00f3rze.htm", "https://www.virustotal.com/graph/embed/g2ef035cd31754a649909336c174aa141b9cca7e431994d12969e0d9d73a01b71?theme=dark", "http://www.hybrid-analysis.com/file-collection/66febb8ee0244a7af5014d61", "https://www.virustotal.com/gui/collection/eb8b56887a4e8962925ce3e96050303382deb55d5e602caa1cfbb81b6297ba2e/iocs", "https://www.virustotal.com/graph/embed/g1f620b321385470f9e0172dc878e371620e6bb704edc421ca6ef9b709db0fb59?theme=dark", "https://viz.greynoise.io/analysis/c8416853-215d-48d0-9420-b6f43cdb1aaf", "https://www.filescan.io/uploads/669fffb84c5c17942a7c1d3f/reports/c881cbc5-750f-4b35-a43d-084844d036e6/overview", "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9/iocs", "https://www.jelenia-gora.sr.gov.pl/spacer", "https://www.virustotal.com/gui/collection/3955f19b42e4ed4d4af0bb416ee463d8a6190cdcc4b1de29a0bf795d2dc18a97/iocs", "https://ato.gov.au.69741db048f4bdd03a6dad409e702ab4.grantelgin.com/", "https://tip.neiki.dev/file/fb0b66efe3b780270db0693b6df42dd08068428b86fc1a579fe5117d4ae76e07/network", "https://www.virustotal.com/gui/collection/8f896c9d4bbc5f488d41616e169d253f9caa43644a13a94a5f42df5e2cf9cc75/iocs", "Alerts: network_ip_exe network_questionable_http_path suricata_alert", "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1", "smtpha.momentumtelecom.com", "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9", "Yara Detections: ConventionEngine_Term_Desktop , ConventionEngine_Term_Users", "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora", "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/summary", "https://www.virustotal.com/graph/embed/g16457cd5ead246d99d2ecf37b965641b258cffddb8374ad194cdea194868d1ec?theme=dark", "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze", "Alerts: dead_connect antivm_network_adapters", "https://viz.greynoise.io/analysis/cb9811dd-809d-4a25-bb28-512d2c2b3393", "cve-2015-2414, 2016-0101, 2006-3869, 2004-0790, 2004-0566, 2005-0068, 2009-1122, 2017-17215, 2017-11882, 2017-0199, 2002-0013, 2016-2569, 2014-8361, 1999-0016, 2008-2257, 2009-1535, 2022-30190, 2008-2938, 2014-6345, 2002-0012", "https://utilities.cityoffortwayne.org/wp-content/uploads/2023/05/2023-Biosolids-Info-Sheet.pdf", "https://www.virustotal.com/gui/collection/eb8b56887a4e8962925ce3e96050303382deb55d5e602caa1cfbb81b6297ba2e/graph", "ASN AS30170 isomedia inc. DNS Resolutions 1 Domain", "https://urlscan.io/user/submit/", "https://www.virustotal.com/gui/collection/3955f19b42e4ed4d4af0bb416ee463d8a6190cdcc4b1de29a0bf795d2dc18a97/summary", "https://www.virustotal.com/gui/collection/8f896c9d4bbc5f488d41616e169d253f9caa43644a13a94a5f42df5e2cf9cc75/summary", "https://www.filescan.io/uploads/66feb74d83903120b70c820f/reports/0a3a6c27-a872-4e0c-86a4-0fc690fb5ecd/details", "Alerts: dynamic_function_loading powershell_download powershell_request network_cnc_http network_http", "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c", "https://www.virustotal.com/graph/embed/ga590434b8e274dc99fd39dd298c8c786abff51132c8d4646bb3fb3f1f4c3d100?theme=dark", "Reverse DNS: advancedstream.net Location: United States of America - Lakewood, Colorado United States of America", "spamgateway.advancedstream.net", "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/iocs", "https://www.virustotal.com/graph/embed/ga0f29bb3fd4a4235b62a2031e5fbc57ca39fc314565d43f28cbc0d096cc7d19a?theme=dark", "https://www.virustotal.com/graph/embed/g20d14d97883a4127a500c45fcfb6e3e4961a30ef4bf74db7ab918bcbdb3f476b?theme=dark", "https://viz.greynoise.io/analysis/0746f250-b49a-4017-9e80-b0c9ce1993d6", "https://www.virustotal.com/gui/collection/eb8b56887a4e8962925ce3e96050303382deb55d5e602caa1cfbb81b6297ba2e", "https://viz.greynoise.io/analysis/3fbd45fa-08a2-423a-98b9-e6b37ea05e8a", "podcast.hallco.org hmmm? Who could it be.", "http://www.jelenia-gora.so.gov.pl/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "", "Win32:coinminerx-gen\\ [trj]", "Serwer", "Win.malware.tofsee-6958935-0", "Alf:jasyp:trojandownloader:win32/smallagent!atmn", "Trojan:win32/smokeloader.yl", "Win32:malware-gen" ], "industries": [ "Technology", "Telecommunications", "Government", "Civil society", "Healthcare", "Education" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 7, "pulses": [ { "id": "66246ff49ed29ea9bb2bf122", "name": "S\u0105d Rejonowy w Jeleniej Gorze POLAND", "description": "Przechowywania lub dost\u0119pu do plik\u00f3w cookies w Twojej przegl\u0105darce\nhttps://www.virustotal.com/gui/domain/jelenia-gora.sr.gov.pl/relations", "modified": "2025-05-14T21:18:36.989000", "created": "2024-04-21T01:46:28.554000", "tags": [ "jeleniej grze", "aktualnoci", "informacje", "jednostka", "rejonowy", "konkurs", "najczciej", "sd rejonowy", "przejd", "czytaj", "click", "sdzia jarosaw", "wydziau", "sdzia grzegorz", "katarzyna", "rudnicka dane", "kontaktowe sd", "jelenia gra", "mickiewicza", "zawarto", "html", "nazwa meta", "robotw", "telefon", "brak", "skala", "ua zgodna", "head body", "zasb", "cname", "kod odpowiedzi", "kodowanie treci", "wygasa", "gmt serwer", "pragma", "kontrola pamici", "podrcznej", "data", "gmt kontrola", "dostpuzezwl na", "czytaj wicej", "sd okrgowy", "jednostki", "okrgowy", "ogoszenia", "sha256", "vhash", "ssdeep", "https odcisk", "palca jarma", "https dane", "v3 numer", "odcisk palca", "tworzy katalog", "tworzy pliki", "typ pliku", "json", "ascii", "windows", "sqlite", "foxpro fpt", "links typ", "mapa", "152 x", "sqlite w", "sha1", "sha512", "file size", "b file", "testing", "komornik sdowy", "sdzie rejonowym", "tomasz rodacki", "obwieszczenie", "komornicze", "tumacza migam", "tumacz czynny", "zamknite", "wiadczenia", "schedule", "error", "javascript", "bakers hall", "ixaction", "script", "ixchatlauncher", "compatibility", "com dla", "t1055 pewno", "unikanie obrony", "t1036 maskarada", "t1082 pewno", "informacje o", "nazwa pliku", "dokument pdf", "rozmiar pliku", "zapowied", "type", "iii dbt", "utf8", "dziennik" ], "references": [ "S?d Rejonowy w Jeleniej G\u00f3rze.htm", "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm", "http://www.jelenia-gora.so.gov.pl/", "https://www.jelenia-gora.so.gov.pl/", "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze", "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora", "https://www.jelenia-gora.sr.gov.pl/spacer", "https://waf.intelix.pl/957476/Chat/Script/Compatibility" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "", "display_name": "", "target": null }, { "id": "serwer", "display_name": "serwer", "target": null } ], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "email": 71, "domain": 7651, "hostname": 7680, "IPv4": 331, "FileHash-SHA256": 16168, "URL": 10399, "FileHash-MD5": 3639, "FileHash-SHA1": 3468, "CIDR": 4, "CVE": 89, "YARA": 521, "SSLCertFingerprint": 25, "JA3": 1, "IPv6": 5813 }, "indicator_count": 55860, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "339 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66f235b9a7a94a6a61acd651", "name": "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan", "description": "This pulse represents a 'scattered sample' of data extracted from 'submissions of interest' made to virustotal, filescan_itsec, HybridAnalysis, anyrun_app, DynamiteLab, and triage (over a period of two months) which were submitted to urlscanio & subsequently GreyNoiseIO (which I've come across both from live samples and also those from offlined data). I don't particularly anticipate this will correlate w. anything specific - but at least will be put in one more place for further analysis & increased visibility.", "modified": "2025-03-07T08:38:08.584000", "created": "2024-09-24T03:44:57.902000", "tags": [ "geoip", "public url", "as16509", "amazon02", "as20940", "akamaiasn1", "as8075", "as15169", "google", "akamaias", "facebook", "telecom", "twitter", "media", "win64", "level3", "mini", "ukraine", "proton", "ghost", "win32", "cuba", "mexico", "indonesia", "seznam", "as3359", "as852" ], "references": [ "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1", "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c", "https://n0paste.eu/UH6n5pD/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada", "Anguilla", "Poland", "Aruba", "Australia", "Barbados", "Costa Rica", "Guatemala", "Philippines", "Panama", "Sint Maarten (Dutch part)", "Saint Martin (French part)", "Cayman Islands", "Cura\u00e7ao", "Mexico", "Saint Vincent and the Grenadines", "Saint Kitts and Nevis", "Tanzania, United Republic of", "Netherlands", "Ukraine", "Trinidad and Tobago", "Japan", "Bahamas", "United Kingdom of Great Britain and Northern Ireland", "Georgia" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Government", "Telecommunications", "Healthcare" ], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1, "CIDR": 1186, "CVE": 4, "FileHash-MD5": 29, "FileHash-SHA1": 3, "URL": 25493, "domain": 5396, "email": 10, "hostname": 10770 }, "indicator_count": 42892, "is_author": false, "is_subscribing": null, "subscriber_count": 147, "modified_text": "408 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65f3e394bcf868816a29c2dc", "name": "Google Pixel 7a Devices - Telus ISP devices 'protected' by Norton", "description": "Exactly as above. I mean, out of all of the phones these ones make phonecalls (most of the time can send & receive calls). Can be a little tricky. Incomplete - it be doing it's own thing downloading/uploading stuff and heading down the 'way all the other phones went' route.", "modified": "2024-11-02T15:05:54.240000", "created": "2024-03-15T05:58:44.839000", "tags": [ "ISP", "Google", "Telus", "Norton", "Pixel" ], "references": [ "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/summary", "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/iocs", "https://www.virustotal.com/graph/embed/ga590434b8e274dc99fd39dd298c8c786abff51132c8d4646bb3fb3f1f4c3d100?theme=dark", "https://www.virustotal.com/graph/embed/g16457cd5ead246d99d2ecf37b965641b258cffddb8374ad194cdea194868d1ec?theme=dark", "https://www.virustotal.com/graph/embed/g2ef035cd31754a649909336c174aa141b9cca7e431994d12969e0d9d73a01b71?theme=dark", "https://www.virustotal.com/graph/embed/g1ea71614909243c1a291970fa39651a2d169deef25b7418fab2f0299221eb152?theme=dark", "https://www.virustotal.com/graph/embed/g20d14d97883a4127a500c45fcfb6e3e4961a30ef4bf74db7ab918bcbdb3f476b?theme=dark", "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/graph", "", "https://www.filescan.io/uploads/66feb74d83903120b70c820f/reports/0a3a6c27-a872-4e0c-86a4-0fc690fb5ecd/details", "https://tip.neiki.dev/file/fb0b66efe3b780270db0693b6df42dd08068428b86fc1a579fe5117d4ae76e07/network", "http://www.hybrid-analysis.com/file-collection/66febb8ee0244a7af5014d61" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Telecommunications", "Technology", "Government" ], "TLP": "green", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1231, "FileHash-SHA1": 1215, "FileHash-SHA256": 99653, "URL": 158638, "domain": 49468, "hostname": 77233, "email": 6, "CIDR": 5450, "CVE": 55 }, "indicator_count": 392949, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "533 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6696f4f69476edc8e4273991", "name": "Logs - iOS SE2, SE3 & iOS 15 Pro Max & iPadOS Air 4 & Apple Macbook Air (A1466 - test device)", "description": "The following is a partial set of logs & leftovers from the Apple Family of Devices", "modified": "2024-09-03T00:02:13.980000", "created": "2024-07-16T22:32:21.627000", "tags": [ "please", "javascript", "entity", "rogers", "repstefanik", "myrakez", "polizeiberlin", "kaishhhhhh", "emilemando22", "uwmlife", "secblinken", "thomaskralow", "miaxdx" ], "references": [ "https://www.virustotal.com/gui/collection/8f896c9d4bbc5f488d41616e169d253f9caa43644a13a94a5f42df5e2cf9cc75/summary", "https://www.virustotal.com/graph/embed/gaa065e3cc130494ea44b292fa15ad0b3bda2259393974adf8fed22bbdbfcecf5?theme=dark", "https://www.virustotal.com/gui/collection/8f896c9d4bbc5f488d41616e169d253f9caa43644a13a94a5f42df5e2cf9cc75/iocs", "https://www.virustotal.com/gui/collection/8f896c9d4bbc5f488d41616e169d253f9caa43644a13a94a5f42df5e2cf9cc75/graph", "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9", "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9/iocs", "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9/graph", "https://www.virustotal.com/graph/embed/ga0f29bb3fd4a4235b62a2031e5fbc57ca39fc314565d43f28cbc0d096cc7d19a?theme=dark", "https://www.virustotal.com/gui/collection/eb8b56887a4e8962925ce3e96050303382deb55d5e602caa1cfbb81b6297ba2e", "https://www.virustotal.com/gui/collection/eb8b56887a4e8962925ce3e96050303382deb55d5e602caa1cfbb81b6297ba2e/iocs", "https://www.virustotal.com/gui/collection/eb8b56887a4e8962925ce3e96050303382deb55d5e602caa1cfbb81b6297ba2e/graph", "https://viz.greynoise.io/analysis/ba31ba2b-4967-4d39-ac24-143d9c66136b", "https://www.virustotal.com/gui/collection/3955f19b42e4ed4d4af0bb416ee463d8a6190cdcc4b1de29a0bf795d2dc18a97/summary", "https://www.virustotal.com/graph/embed/g1f620b321385470f9e0172dc878e371620e6bb704edc421ca6ef9b709db0fb59?theme=dark", "https://www.virustotal.com/gui/collection/3955f19b42e4ed4d4af0bb416ee463d8a6190cdcc4b1de29a0bf795d2dc18a97/iocs" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America", "Panama", "Guatemala", "Costa Rica", "Mexico", "Aruba" ], "malware_families": [], "attack_ids": [], "industries": [ "Healthcare", "Government", "Education", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 19, "FileHash-SHA1": 32, "FileHash-SHA256": 2179, "URL": 1365, "domain": 397, "hostname": 419 }, "indicator_count": 4411, "is_author": false, "is_subscribing": null, "subscriber_count": 132, "modified_text": "593 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "669ad504a491593b3092d20c", "name": "Apple Stuff Combined", "description": "Description: IOCs derived from downed Apple Fleet logs\nCommon IOCs from Apple-Related Products - extracted from Apple Logs/Reports", "modified": "2024-09-03T00:02:13.980000", "created": "2024-07-19T21:05:08.808000", "tags": [ "contains-zip", "contains-apk", "upx", "pecompact", "contains-elf", "attachment", "as-protect", "contains-pe", "aspack", "telock", "downloads-zip", "nsis", "downloads-pe", "base64-embedded", "bobsoft", "opendir" ], "references": [ "https://viz.greynoise.io/analysis/c8416853-215d-48d0-9420-b6f43cdb1aaf", "https://www.virustotal.com/graph/embed/g266c7267d27a42b494f80bfa327d9a47a182ff352a4843c69c655a09e131dd49?theme=dark", "https://www.virustotal.com/gui/collection/3955f19b42e4ed4d4af0bb416ee463d8a6190cdcc4b1de29a0bf795d2dc18a97/iocs", "https://viz.greynoise.io/analysis/0746f250-b49a-4017-9e80-b0c9ce1993d6", "cve-2015-2414, 2016-0101, 2006-3869, 2004-0790, 2004-0566, 2005-0068, 2009-1122, 2017-17215, 2017-11882, 2017-0199, 2002-0013, 2016-2569, 2014-8361, 1999-0016, 2008-2257, 2009-1535, 2022-30190, 2008-2938, 2014-6345, 2002-0012", "https://www.filescan.io/uploads/669fffb84c5c17942a7c1d3f/reports/c881cbc5-750f-4b35-a43d-084844d036e6/overview", "https://www.filescan.io/uploads/66a001cb3ba51bb345a32569/reports/34b4aa58-68cb-4045-8653-ccfd3a1fb3dd/overview", "https://urlscan.io/user/submit/", "https://viz.greynoise.io/analysis/cb9811dd-809d-4a25-bb28-512d2c2b3393", "https://www.virustotal.com/gui/collection/3955f19b42e4ed4d4af0bb416ee463d8a6190cdcc4b1de29a0bf795d2dc18a97/summary", "07.19.24: IPs, Greynoise: https://viz.greynoise.io/analysis/ba31ba2b-4967-4d39-ac24-143d9c66136b", "https://viz.greynoise.io/analysis/3fbd45fa-08a2-423a-98b9-e6b37ea05e8a" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Telecommunications", "Government", "Healthcare", "Education" ], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10067, "FileHash-SHA256": 6080, "hostname": 1957, "domain": 1445, "CVE": 20 }, "indicator_count": 19569, "is_author": false, "is_subscribing": null, "subscriber_count": 132, "modified_text": "593 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66540f16406788219bb4acab", "name": "iPadOS - iPad Air 4", "description": "Logs, Privacy Reports from a compromised iPad air 4 (Lockdown Mode & Hardware Key) - 3 different Apple IDs", "modified": "2024-08-06T16:02:05.410000", "created": "2024-05-27T04:41:58.185000", "tags": [ "please", "javascript", "Apple", "iPadOS" ], "references": [ "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9/iocs", "https://www.virustotal.com/gui/collection/a19bfa2ad298cf90f570d7cdf51d20aa0623af71636f4811d44a782f780d85d9/graph", "https://viz.greynoise.io/analysis/91e32f0c-55b1-4b61-bf38-deee3033f6cc" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Telecommunications", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 20, "FileHash-SHA1": 80, "FileHash-SHA256": 1185, "URL": 190, "hostname": 121, "domain": 255 }, "indicator_count": 1851, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "621 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6656e6dbbe018a2dcb28a8e0", "name": "advancedstream.net - Acquired Apple iOS infrastructure, DNS,", "description": "Apple iOS service modifier.", "modified": "2024-06-28T08:01:11.978000", "created": "2024-05-29T08:27:07.009000", "tags": [ "reverse dns", "location united", "america flag", "lakewood", "united", "america asn", "dns resolutions", "domain", "domain status", "server", "algorithm", "key usage", "xcitium verdict", "cloud", "popularity", "rank position", "info", "date", "registrar abuse", "iana id", "contact phone", "dnssec", "registrar url", "registrar whois", "llc registry", "expiry date", "first", "law firm", "fort wayne", "co", "referrer", "historical ssl", "name verdict", "falcon sandbox", "sha256", "ascii text", "sha1", "size", "pattern match", "et tor", "known tor", "relayrouter", "exit", "node traffic", "span", "hybrid", "body", "footer", "contact", "local", "encrypt", "click", "facebook", "strings", "meta", "district", "generator", "code", "service", "bill", "nemtih", "sredrum", "co lp", "dynamicloader", "default", "medium", "show", "http request", "http", "delete", "ids detections", "yara detections", "copy", "powershell", "win64", "write", "malware", "download", "malware", "trojan", "windows", "shellexecuteexw", "search", "entries", "writeconsolew", "registry", "t1031", "modify existing", "dock", "win32" ], "references": [ "Reverse DNS: advancedstream.net Location: United States of America - Lakewood, Colorado United States of America", "ASN AS30170 isomedia inc. DNS Resolutions 1 Domain", "spamgateway.advancedstream.net", "smtpha.momentumtelecom.com", "cityoffortwayne.org | detect.cityoffortwayne.org | https://engage.cityoffortwayne.org/", "https://utilities.cityoffortwayne.org/wp-content/uploads/2023/05/2023-Biosolids-Info-Sheet.pdf", "podcast.hallco.org hmmm? Who could it be.", "IDS Detections: PE EXE or DLL Windows file download HTTP | SUSPICIOUS Dotted Quad Host MZ Response | Packed Executable Download", "IDS Detectionsa: Executable Download from dotted-quad Host | Terse alphanumeric executable downloader high likelihood of being hostile", "Yara Detections: ConventionEngine_Term_Desktop , ConventionEngine_Term_Users", "Alerts: network_ip_exe network_questionable_http_path suricata_alert", "Alerts: dynamic_function_loading powershell_download powershell_request network_cnc_http network_http", "Alerts: dead_connect antivm_network_adapters", "https://otx.alienvault.com/indicator/file/a909dd4960d4da51de82e4dfff0a5aa60e35da6b2845680716ad832dc1d8b010", "http://www.leechburg.k12.pa.us/cms/lib09/PA01916522/Centricity/Domain/4/Mr.%20Ritzel%20obituary.pdf", "https://ato.gov.au.69741db048f4bdd03a6dad409e702ab4.grantelgin.com/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ALF:JASYP:TrojanDownloader:Win32/SmallAgent!atmn", "display_name": "ALF:JASYP:TrojanDownloader:Win32/SmallAgent!atmn", "target": null }, { "id": "Win32:Malware-gen", "display_name": "Win32:Malware-gen", "target": null }, { "id": "Win32:CoinminerX-gen\\ [Trj]", "display_name": "Win32:CoinminerX-gen\\ [Trj]", "target": null }, { "id": "Win.Malware.Tofsee-6958935-0", "display_name": "Win.Malware.Tofsee-6958935-0", "target": null }, { "id": "Trojan:Win32/SmokeLoader.YL", "display_name": "Trojan:Win32/SmokeLoader.YL", "target": "/malware/Trojan:Win32/SmokeLoader.YL" } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" } ], "industries": [ "Civil Society", "Telecommunications" ], "TLP": "green", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 338, "FileHash-SHA1": 77, "email": 2, "hostname": 497, "URL": 928, "FileHash-SHA256": 572, "FileHash-MD5": 76, "SSLCertFingerprint": 6 }, "indicator_count": 2496, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "660 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "ctrl-verse.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "ctrl-verse.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1776616781.8834743 }