{ "type": "Domain", "indicator": "eresmas.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/eresmas.com", "alexa": "http://www.alexa.com/siteinfo/eresmas.com", "indicator": "eresmas.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2131962770, "indicator": "eresmas.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 9, "pulses": [ { "id": "6878ab97e659d23d965452ac", "name": "Yandex - Tofsee.AX | Malvertising Hub for US", "description": "Win32/Tofsee.AX google.com connectivity check\n Can\u2019t access all malware files.\n\nYandex has long been a malvertising Hub for US and other non- Russian threat actors.", "modified": "2025-08-16T07:00:49.321000", "created": "2025-07-17T07:51:51.799000", "tags": [ "status", "russia", "creation date", "passive dns", "urls", "date", "hostname add", "pulse pulses", "files", "verdict", "present jul", "certificate", "ip address", "search", "record value", "showing", "xml title", "present jan", "present sep", "present oct", "whois", "urlvoid", "related", "https", "expiration", "http", "months ago", "expiration http", "url http", "report spam", "smear", "brian sabey", "sabey", "data upload", "extraction", "url https", "type indicator", "role title", "added active", "related pulses", "entries", "tbmvid", "sourcelnms", "zx1724209326040", "hostname", "trojan", "delete c", "united", "grum", "show", "cape", "tofsee", "high", "total", "copy", "write", "malware", "patched", "next", "class", "failed", "indicator role", "title added", "active related", "filehashmd5", "filehashsha1", "filehashsha256" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "display_name": "T1190 - Exploit Public-Facing Application" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1472", "name": "Generate Fraudulent Advertising Revenue", "display_name": "T1472 - Generate Fraudulent Advertising Revenue" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1586", "name": "Compromise Accounts", "display_name": "T1586 - Compromise Accounts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2337, "hostname": 833, "email": 4, "domain": 357, "FileHash-MD5": 113, "FileHash-SHA256": 1551, "FileHash-SHA1": 108, "SSLCertFingerprint": 1 }, "indicator_count": 5304, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "288 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6854082f2edb40c1c80b0831", "name": "JSDdelivr blocklist", "description": "", "modified": "2025-06-19T14:28:09.610000", "created": "2025-06-19T12:53:03.734000", "tags": [], "references": [ "https://cdn.jsdelivr.net/gh/salaryman-technologies/quickpick@refs/heads/main/blocklist.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 5675, "hostname": 171 }, "indicator_count": 5846, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "346 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65c4b7b44b63ea6ea0c503d8", "name": "Sabey targeting | Gains access to premier Denver Recording Studio", "description": "Intellectual property accessed and distributed. \nSabey and company have access, storage and at will control. Ransomware. Active threat. Likelihood of Pegasus abuse.. Critical alert. Reckless predatory type with motives, tools, knowledge, and colleagues continue cyberstalking and in person contact with SA survivor. Carelessly attacking systems of business and facilities target likely to use, This behavior puts others at risk.", "modified": "2024-03-09T10:04:19.572000", "created": "2024-02-08T11:15:00.329000", "tags": [ "malware", "scan endpoints", "all search", "otx octoseek", "report spam", "author", "cyber espionage", "studio created", "minutes ago", "white goldmax", "sibot", "goldfinder", "python", "indicator role", "title added", "active related", "pulses url", "entries", "url http", "pulses cve", "threat analyzer", "threat", "paste", "iocs", "analyze", "hostnames", "urls http", "sample", "urls https", "filehashsha1", "filehashmd5", "ipv4", "types of", "united kingdom", "united", "india", "china", "search", "pega type", "united states", "url https", "added active", "related pulses", "backdoor type", "discovery", "command", "all octoseek", "formbook", "goldmax", "ransomware", "njrat", "hacktool", "maui ransomware", "worm", "next", "type indicator", "role title", "go", "sabey", "tulach", "targeting tsara brashears", "utah", "whois record", "contacted", "ssl certificate", "referrer", "whois whois", "resolutions", "collections", "bundled", "execution", "lokibot", "tracer tool", "c2", "command and control", "sabey", "targeting", "hacking apple" ], "references": [ "https://side3.com/ | webdisk.side3.com | (http://koshishmarketing.com/mo8igygw3uv/t4z68181/ | malware hosting)", "https://sabeydatacenters.com/", "sabeydatacenters.com", "4jslg.sabeydatacenters.com", "https://sabeydatacenters.com/", "ProflWiz.exe | 1993173153b9112833140c61f28232bd8af7df7a4891fa4796378a6647fe95e0", "https://tulach.cc/ | [phishing | malware engineering]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing | data collection | property theft | target]", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [password decryption]", "nr-data.net [Apple Private Data Collection]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "Go", "display_name": "Go", "target": null }, { "id": "NjRAT", "display_name": "NjRAT", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Sabey", "display_name": "Sabey", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Maui Ransomware", "display_name": "Maui Ransomware", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1094", "name": "Custom Command and Control Protocol", "display_name": "T1094 - Custom Command and Control Protocol" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1215", "name": "Kernel Modules and Extensions", "display_name": "T1215 - Kernel Modules and Extensions" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [ "Entertainment", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 422, "domain": 240, "hostname": 495, "CVE": 1, "FileHash-MD5": 75, "FileHash-SHA1": 73, "FileHash-SHA256": 843, "email": 2 }, "indicator_count": 2151, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "813 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65c4a099f6a2c8fc2bb85d4b", "name": "Cyber espionage & ransomware attacks Denver Recording Studio", "description": "GoldMax is used by UNC2452 as a command-and-control backdoor. It is written in the Go programming language. To hide its activities, it generates dummy traffic.\n\nSibot is a VBScript-based malware that allows attackers to download and run payloads from a remote command-and-control server. It uses file names that are similar to those used in Windows for masquerading. The VBScript is executed through a scheduled task.\n\nGoldFinder is another Go malware used by attackers to access a hardcoded command-and-control (C2) server by logging the route or hops that a packet takes like an HTTP tracer tool.", "modified": "2024-03-09T09:02:09.950000", "created": "2024-02-08T09:36:25.114000", "tags": [ "ssl certificate", "contacted", "historical ssl", "february", "referrer", "threat roundup", "apple ios", "goldfinder", "sibot", "goldmax", "hacktool", "malicious", "formbook", "contacted urls", "resolutions", "malware", "njrat", "ransomware", "open", "cyber criminal", "record type", "ttl value", "dropped", "execution", "hashes hashes", "hashes", "network", "communicating", "maui ransomware", "type name", "jpeg", "ms word", "document", "whois record", "january", "october", "december", "april", "august", "crypto", "awful", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "self", "march", "urls http", "threat network", "problems", "whois whois", "probe", "startpage", "premium", "snatch", "first", "utc submissions", "submitters", "cloudflarenet", "gvb gelimed", "com laude", "mb super", "optimizer", "amazonaes", "summary iocs", "twitter", "united", "as20940", "aaaa", "as714 apple", "as16625 akamai", "win32mydoom feb", "name servers", "trojan", "as6185 apple", "creation date", "virtool", "worm", "date", "win32", "urls", "search", "servers", "targeting", "target", "tsara brashears", "united kingdom", "whitelisted", "as6453 tata", "passive dns", "domain", "as46606", "scan endpoints", "all search", "otx octoseek", "pulse submit", "url analysis", "as54113", "entries", "moved", "body", "unknown", "found", "files", "backdoor", "expiration date", "hallrender", "tulach", "all octoseek", "url http", "pulse pulses", "http", "related pulses", "none related", "tags none", "file type", "as62597 nsone", "as62729", "showing", "next", "as2914 ntt", "ireland unknown", "germany unknown", "as6461 zayo", "as7843 charter", "as3257 gtt", "ip address", "location united", "for privacy", "record value", "as54990", "bouvet island", "encrypt", "show", "filehash", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "june", "copy", "as15169 google", "domains ii", "sality", "ck id", "ck matrix", "intellectual property theft", "malicious file transfers", "scheme", "threat", "paste", "iocs", "hostnames", "urls https", "urls url", "j490s6lkpppw", "lfqprnkje8dni0" ], "references": [ "https://side3.com/", "https://www.side3.com", "http://koshishmarketing.com/mo8igygw3uv/t4z68181/ [malware_hosting]", "http://l2filesget.com/horyuclassic/updater/Launcher_Horyu_Classic.exe [malware_hosting]", "http://fillmark.net/index.php [phishing]", "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [phishing]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]", "www-temp.metrobyt-mobile.com [malicious | data collection]", "www.icloud.com [wp-login.php]", "webdisk.thehomemakers.nl [spyware | tracking]", "https://tulach.cc/ [phishing - malware engineers. Malware commonly associated with m.brian sabey of hallrender.(.)com [malware hosting/attacking legal team]", "URL https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [OS & iOS password cracker] | 136-186.pornhub.org", "cs9.wac.phicdn.net.1.1.e64a8639.roksit.net", "www.anyxxxtube.net [malicious data collection]", "s3.amazonaws.com [targeting data collection]", "https://twitter.com/PORNO_SEXYBABES | https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/", "nr-data.net [Apple Private Data Collection] | 67.199.248.12 [apple data collection IP]", "api.utah.edu [access apple]", "https://applemusic-spotlight.myunidays.com/US/en-US? [access to vulnerable or targeted devices via media]", "tv.apple.com", "104.92.250.162 [Apple image scanning IP] || appleid.com [insecure. other users]", "andrewka6.pythonanywhere.com [python connection - apple]", "http://l2filesget.com/horyuclassic/updater/system-eu/EnchantStatBonus_Classic.dat.lzma", "https://www.picussecurity.com/resource/unc2452-nobelium-threat-group-attack-campaign", "sonymobilemail.com", "https://onhimalayas.com/ckfinder/userfiles/files/jafufedopegagedolabib.pdf", "pegahpouraseflaw.info", "http://mouthgrave.net/index.php", "ransomed.vc", "Intellectual property accessed and distributed" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [ { "id": "Cyber Criminal", "display_name": "Cyber Criminal", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax", "display_name": "GoldMax", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "NjRAT", "display_name": "NjRAT", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Maui Ransomware", "display_name": "Maui Ransomware", "target": null }, { "id": "Worm:Win32/Mydoom", "display_name": "Worm:Win32/Mydoom", "target": "/malware/Worm:Win32/Mydoom" }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Sality", "display_name": "Sality", "target": null } ], "attack_ids": [ { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1094", "name": "Custom Command and Control Protocol", "display_name": "T1094 - Custom Command and Control Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1215", "name": "Kernel Modules and Extensions", "display_name": "T1215 - Kernel Modules and Extensions" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1059.002", "name": "AppleScript", "display_name": "T1059.002 - AppleScript" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" } ], "industries": [ "Entertainment", "Technology", "Telecommunications", "Recording Industry", "Entertainers", "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 49, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5271, "FileHash-MD5": 899, "FileHash-SHA1": 881, "FileHash-SHA256": 5609, "domain": 2199, "hostname": 3205, "CVE": 1, "email": 9 }, "indicator_count": 18074, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "813 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65c4a1c74cf5f1af5be6464e", "name": " authsmtp.sabeydatacenters.com | tulach gained access to Side3 Studios Denver\t\t", "description": "", "modified": "2024-03-09T09:02:09.950000", "created": "2024-02-08T09:41:27.252000", "tags": [ "ssl certificate", "contacted", "historical ssl", "february", "referrer", "threat roundup", "apple ios", "goldfinder", "sibot", "goldmax", "hacktool", "malicious", "formbook", "contacted urls", "resolutions", "malware", "njrat", "ransomware", "open", "cyber criminal", "record type", "ttl value", "dropped", "execution", "hashes hashes", "hashes", "network", "communicating", "maui ransomware", "type name", "jpeg", "ms word", "document", "whois record", "january", "october", "december", "april", "august", "crypto", "awful", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "self", "march", "urls http", "threat network", "problems", "whois whois", "probe", "startpage", "premium", "snatch", "first", "utc submissions", "submitters", "cloudflarenet", "gvb gelimed", "com laude", "mb super", "optimizer", "amazonaes", "summary iocs", "twitter", "united", "as20940", "aaaa", "as714 apple", "as16625 akamai", "win32mydoom feb", "name servers", "trojan", "as6185 apple", "creation date", "virtool", "worm", "date", "win32", "urls", "search", "servers", "targeting", "target", "tsara brashears", "united kingdom", "whitelisted", "as6453 tata", "passive dns", "domain", "as46606", "scan endpoints", "all search", "otx octoseek", "pulse submit", "url analysis", "as54113", "entries", "moved", "body", "unknown", "found", "files", "backdoor", "expiration date", "hallrender", "tulach", "all octoseek", "url http", "pulse pulses", "http", "related pulses", "none related", "tags none", "file type", "as62597 nsone", "as62729", "showing", "next", "as2914 ntt", "ireland unknown", "germany unknown", "as6461 zayo", "as7843 charter", "as3257 gtt", "ip address", "location united", "for privacy", "record value", "as54990", "bouvet island", "encrypt", "show", "filehash", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "june", "copy", "as15169 google", "domains ii", "sality", "ck id", "ck matrix", "intellectual property theft", "malicious file transfers", "scheme", "threat", "paste", "iocs", "hostnames", "urls https", "urls url", "j490s6lkpppw", "lfqprnkje8dni0" ], "references": [ "https://side3.com/", "https://www.side3.com", "http://koshishmarketing.com/mo8igygw3uv/t4z68181/ [malware_hosting]", "http://l2filesget.com/horyuclassic/updater/Launcher_Horyu_Classic.exe [malware_hosting]", "http://fillmark.net/index.php [phishing]", "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [phishing]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]", "www-temp.metrobyt-mobile.com [malicious | data collection]", "www.icloud.com [wp-login.php]", "webdisk.thehomemakers.nl [spyware | tracking]", "https://tulach.cc/ [phishing - malware engineers. Malware commonly associated with m.brian sabey of hallrender.(.)com [malware hosting/attacking legal team]", "URL https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [OS & iOS password cracker] | 136-186.pornhub.org", "cs9.wac.phicdn.net.1.1.e64a8639.roksit.net", "www.anyxxxtube.net [malicious data collection]", "s3.amazonaws.com [targeting data collection]", "https://twitter.com/PORNO_SEXYBABES | https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/", "nr-data.net [Apple Private Data Collection] | 67.199.248.12 [apple data collection IP]", "api.utah.edu [access apple]", "https://applemusic-spotlight.myunidays.com/US/en-US? [access to vulnerable or targeted devices via media]", "tv.apple.com", "104.92.250.162 [Apple image scanning IP] || appleid.com [insecure. other users]", "andrewka6.pythonanywhere.com [python connection - apple]", "http://l2filesget.com/horyuclassic/updater/system-eu/EnchantStatBonus_Classic.dat.lzma", "https://www.picussecurity.com/resource/unc2452-nobelium-threat-group-attack-campaign", "sonymobilemail.com", "https://onhimalayas.com/ckfinder/userfiles/files/jafufedopegagedolabib.pdf", "pegahpouraseflaw.info", "http://mouthgrave.net/index.php", "ransomed.vc", "Intellectual property accessed and distributed" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [ { "id": "Cyber Criminal", "display_name": "Cyber Criminal", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax", "display_name": "GoldMax", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "NjRAT", "display_name": "NjRAT", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Maui Ransomware", "display_name": "Maui Ransomware", "target": null }, { "id": "Worm:Win32/Mydoom", "display_name": "Worm:Win32/Mydoom", "target": "/malware/Worm:Win32/Mydoom" }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Sality", "display_name": "Sality", "target": null } ], "attack_ids": [ { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1094", "name": "Custom Command and Control Protocol", "display_name": "T1094 - Custom Command and Control Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1215", "name": "Kernel Modules and Extensions", "display_name": "T1215 - Kernel Modules and Extensions" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1059.002", "name": "AppleScript", "display_name": "T1059.002 - AppleScript" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" } ], "industries": [ "Entertainment", "Technology", "Telecommunications", "Recording Industry", "Entertainers", "Civil Society" ], "TLP": "white", "cloned_from": "65c4a099f6a2c8fc2bb85d4b", "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5271, "FileHash-MD5": 899, "FileHash-SHA1": 881, "FileHash-SHA256": 5609, "domain": 2199, "hostname": 3205, "CVE": 1, "email": 9 }, "indicator_count": 18074, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "813 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65536bc6301b7cdf7d04e095", "name": "TrojanDownloader:Win32/Cutwail.BS/Win.Trojan.Pushdo-20", "description": "backdoor,trojan downloaders, networm, phishing, tracking, spyware, device commands...", "modified": "2023-12-14T12:03:15.957000", "created": "2023-11-14T12:44:54.422000", "tags": [ "passive dns", "urls", "t1604023287", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "ssl certificate", "whois record", "resolutions", "referrer", "historical ssl", "communicating", "threat roundup", "whois whois", "apple", "stopransomware", "core", "discord", "metro", "blister", "cobalt strike", "hacktool", "june", "name verdict", "pattern match", "et tor", "known tor", "misc attack", "link", "woff2", "relayrouter", "exit", "node traffic", "ascii text", "date", "click", "unknown", "meta", "hybrid", "general", "local", "strings", "class", "generator", "critical", "error", "execution", "malware", "network", "roblox", "united", "as13335", "a domains", "status", "aaaa", "search", "script urls", "creation date", "showing", "pixel", "win32", "download", "t1507537243" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Roblox", "display_name": "Roblox", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 11333, "FileHash-MD5": 81, "FileHash-SHA1": 74, "FileHash-SHA256": 3269, "domain": 2748, "hostname": 3475, "email": 2, "CVE": 2 }, "indicator_count": 20984, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "899 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65536bdc3676a40633a619be", "name": "TrojanDownloader:Win32/Cutwail.BS/Win.Trojan.Pushdo-20", "description": "backdoor,trojan downloaders, networm, phishing, tracking, spyware, device commands...", "modified": "2023-12-14T12:03:15.957000", "created": "2023-11-14T12:45:16.667000", "tags": [ "passive dns", "urls", "t1604023287", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "ssl certificate", "whois record", "resolutions", "referrer", "historical ssl", "communicating", "threat roundup", "whois whois", "apple", "stopransomware", "core", "discord", "metro", "blister", "cobalt strike", "hacktool", "june", "name verdict", "pattern match", "et tor", "known tor", "misc attack", "link", "woff2", "relayrouter", "exit", "node traffic", "ascii text", "date", "click", "unknown", "meta", "hybrid", "general", "local", "strings", "class", "generator", "critical", "error", "execution", "malware", "network", "roblox", "united", "as13335", "a domains", "status", "aaaa", "search", "script urls", "creation date", "showing", "pixel", "win32", "download", "t1507537243" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Roblox", "display_name": "Roblox", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 35, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 11333, "FileHash-MD5": 81, "FileHash-SHA1": 74, "FileHash-SHA256": 3269, "domain": 2748, "hostname": 3475, "email": 2, "CVE": 2 }, "indicator_count": 20984, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "899 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65568d67bd96e06ab44b9b95", "name": "TrojanDownloader:Win32/Cutwail.BS/Win.Trojan.Pushdo-20", "description": "", "modified": "2023-12-14T12:03:15.957000", "created": "2023-11-16T21:45:11.721000", "tags": [ "passive dns", "urls", "t1604023287", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "ssl certificate", "whois record", "resolutions", "referrer", "historical ssl", "communicating", "threat roundup", "whois whois", "apple", "stopransomware", "core", "discord", "metro", "blister", "cobalt strike", "hacktool", "june", "name verdict", "pattern match", "et tor", "known tor", "misc attack", "link", "woff2", "relayrouter", "exit", "node traffic", "ascii text", "date", "click", "unknown", "meta", "hybrid", "general", "local", "strings", "class", "generator", "critical", "error", "execution", "malware", "network", "roblox", "united", "as13335", "a domains", "status", "aaaa", "search", "script urls", "creation date", "showing", "pixel", "win32", "download", "t1507537243" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Roblox", "display_name": "Roblox", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "green", "cloned_from": "65536bdc3676a40633a619be", "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 11333, "FileHash-MD5": 81, "FileHash-SHA1": 74, "FileHash-SHA256": 3269, "domain": 2748, "hostname": 3475, "email": 2, "CVE": 2 }, "indicator_count": 20984, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "899 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6550cc7e0eb20237b9caa382", "name": "telus.net (part 1)", "description": "", "modified": "2023-12-12T12:02:19.185000", "created": "2023-11-12T13:00:46.503000", "tags": [ "virustotal" ], "references": [ "https://www.virustotal.com/graph/g1de5e44a37db46b99ccde279765afb2876ec174f4c9249ebb5bf7f392e75f071" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 318, "FileHash-SHA1": 319, "FileHash-SHA256": 1695, "URL": 193, "domain": 91, "hostname": 23 }, "indicator_count": 2639, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "901 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "api.utah.edu [access apple]", "Intellectual property accessed and distributed", "nr-data.net [Apple Private Data Collection]", "https://tulach.cc/ | [phishing | malware engineering]", "http://fillmark.net/index.php [phishing]", "https://tulach.cc/ [phishing - malware engineers. Malware commonly associated with m.brian sabey of hallrender.(.)com [malware hosting/attacking legal team]", "URL https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [OS & iOS password cracker] | 136-186.pornhub.org", "pegahpouraseflaw.info", "andrewka6.pythonanywhere.com [python connection - apple]", "https://side3.com/ | webdisk.side3.com | (http://koshishmarketing.com/mo8igygw3uv/t4z68181/ | malware hosting)", "cs9.wac.phicdn.net.1.1.e64a8639.roksit.net", "http://koshishmarketing.com/mo8igygw3uv/t4z68181/ [malware_hosting]", "https://applemusic-spotlight.myunidays.com/US/en-US? [access to vulnerable or targeted devices via media]", "nr-data.net [Apple Private Data Collection] | 67.199.248.12 [apple data collection IP]", "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [phishing]", "https://onhimalayas.com/ckfinder/userfiles/files/jafufedopegagedolabib.pdf", "104.92.250.162 [Apple image scanning IP] || appleid.com [insecure. other users]", "tv.apple.com", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]", "https://sabeydatacenters.com/", "http://l2filesget.com/horyuclassic/updater/system-eu/EnchantStatBonus_Classic.dat.lzma", "https://side3.com/", "www-temp.metrobyt-mobile.com [malicious | data collection]", "ransomed.vc", "http://l2filesget.com/horyuclassic/updater/Launcher_Horyu_Classic.exe [malware_hosting]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing | data collection | property theft | target]", "https://www.picussecurity.com/resource/unc2452-nobelium-threat-group-attack-campaign", "www.anyxxxtube.net [malicious data collection]", "www.icloud.com [wp-login.php]", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [password decryption]", "4jslg.sabeydatacenters.com", "https://twitter.com/PORNO_SEXYBABES | https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/", "sonymobilemail.com", "https://cdn.jsdelivr.net/gh/salaryman-technologies/quickpick@refs/heads/main/blocklist.txt", "https://www.virustotal.com/graph/g1de5e44a37db46b99ccde279765afb2876ec174f4c9249ebb5bf7f392e75f071", "https://www.side3.com", "s3.amazonaws.com [targeting data collection]", "sabeydatacenters.com", "webdisk.thehomemakers.nl [spyware | tracking]", "ProflWiz.exe | 1993173153b9112833140c61f28232bd8af7df7a4891fa4796378a6647fe95e0", "http://mouthgrave.net/index.php" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Maui ransomware", "Hacktool", "Goldfinder", "Ransomware", "Worm:win32/mydoom", "Go", "Formbook", "Sality", "Sibot", "Tulach", "Cyber criminal", "Roblox", "Njrat", "Goldmax", "Sabey" ], "industries": [ "Recording industry", "Entertainment", "Entertainers", "Technology", "Telecommunications", "Civil society" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 9, "pulses": [ { "id": "6878ab97e659d23d965452ac", "name": "Yandex - Tofsee.AX | Malvertising Hub for US", "description": "Win32/Tofsee.AX google.com connectivity check\n Can\u2019t access all malware files.\n\nYandex has long been a malvertising Hub for US and other non- Russian threat actors.", "modified": "2025-08-16T07:00:49.321000", "created": "2025-07-17T07:51:51.799000", "tags": [ "status", "russia", "creation date", "passive dns", "urls", "date", "hostname add", "pulse pulses", "files", "verdict", "present jul", "certificate", "ip address", "search", "record value", "showing", "xml title", "present jan", "present sep", "present oct", "whois", "urlvoid", "related", "https", "expiration", "http", "months ago", "expiration http", "url http", "report spam", "smear", "brian sabey", "sabey", "data upload", "extraction", "url https", "type indicator", "role title", "added active", "related pulses", "entries", "tbmvid", "sourcelnms", "zx1724209326040", "hostname", "trojan", "delete c", "united", "grum", "show", "cape", "tofsee", "high", "total", "copy", "write", "malware", "patched", "next", "class", "failed", "indicator role", "title added", "active related", "filehashmd5", "filehashsha1", "filehashsha256" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "display_name": "T1190 - Exploit Public-Facing Application" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1472", "name": "Generate Fraudulent Advertising Revenue", "display_name": "T1472 - Generate Fraudulent Advertising Revenue" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1586", "name": "Compromise Accounts", "display_name": "T1586 - Compromise Accounts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2337, "hostname": 833, "email": 4, "domain": 357, "FileHash-MD5": 113, "FileHash-SHA256": 1551, "FileHash-SHA1": 108, "SSLCertFingerprint": 1 }, "indicator_count": 5304, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "288 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6854082f2edb40c1c80b0831", "name": "JSDdelivr blocklist", "description": "", "modified": "2025-06-19T14:28:09.610000", "created": "2025-06-19T12:53:03.734000", "tags": [], "references": [ "https://cdn.jsdelivr.net/gh/salaryman-technologies/quickpick@refs/heads/main/blocklist.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 5675, "hostname": 171 }, "indicator_count": 5846, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "346 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65c4b7b44b63ea6ea0c503d8", "name": "Sabey targeting | Gains access to premier Denver Recording Studio", "description": "Intellectual property accessed and distributed. \nSabey and company have access, storage and at will control. Ransomware. Active threat. Likelihood of Pegasus abuse.. Critical alert. Reckless predatory type with motives, tools, knowledge, and colleagues continue cyberstalking and in person contact with SA survivor. Carelessly attacking systems of business and facilities target likely to use, This behavior puts others at risk.", "modified": "2024-03-09T10:04:19.572000", "created": "2024-02-08T11:15:00.329000", "tags": [ "malware", "scan endpoints", "all search", "otx octoseek", "report spam", "author", "cyber espionage", "studio created", "minutes ago", "white goldmax", "sibot", "goldfinder", "python", "indicator role", "title added", "active related", "pulses url", "entries", "url http", "pulses cve", "threat analyzer", "threat", "paste", "iocs", "analyze", "hostnames", "urls http", "sample", "urls https", "filehashsha1", "filehashmd5", "ipv4", "types of", "united kingdom", "united", "india", "china", "search", "pega type", "united states", "url https", "added active", "related pulses", "backdoor type", "discovery", "command", "all octoseek", "formbook", "goldmax", "ransomware", "njrat", "hacktool", "maui ransomware", "worm", "next", "type indicator", "role title", "go", "sabey", "tulach", "targeting tsara brashears", "utah", "whois record", "contacted", "ssl certificate", "referrer", "whois whois", "resolutions", "collections", "bundled", "execution", "lokibot", "tracer tool", "c2", "command and control", "sabey", "targeting", "hacking apple" ], "references": [ "https://side3.com/ | webdisk.side3.com | (http://koshishmarketing.com/mo8igygw3uv/t4z68181/ | malware hosting)", "https://sabeydatacenters.com/", "sabeydatacenters.com", "4jslg.sabeydatacenters.com", "https://sabeydatacenters.com/", "ProflWiz.exe | 1993173153b9112833140c61f28232bd8af7df7a4891fa4796378a6647fe95e0", "https://tulach.cc/ | [phishing | malware engineering]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing | data collection | property theft | target]", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [password decryption]", "nr-data.net [Apple Private Data Collection]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "Go", "display_name": "Go", "target": null }, { "id": "NjRAT", "display_name": "NjRAT", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Sabey", "display_name": "Sabey", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Maui Ransomware", "display_name": "Maui Ransomware", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1094", "name": "Custom Command and Control Protocol", "display_name": "T1094 - Custom Command and Control Protocol" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1215", "name": "Kernel Modules and Extensions", "display_name": "T1215 - Kernel Modules and Extensions" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [ "Entertainment", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 422, "domain": 240, "hostname": 495, "CVE": 1, "FileHash-MD5": 75, "FileHash-SHA1": 73, "FileHash-SHA256": 843, "email": 2 }, "indicator_count": 2151, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "813 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65c4a099f6a2c8fc2bb85d4b", "name": "Cyber espionage & ransomware attacks Denver Recording Studio", "description": "GoldMax is used by UNC2452 as a command-and-control backdoor. It is written in the Go programming language. To hide its activities, it generates dummy traffic.\n\nSibot is a VBScript-based malware that allows attackers to download and run payloads from a remote command-and-control server. It uses file names that are similar to those used in Windows for masquerading. The VBScript is executed through a scheduled task.\n\nGoldFinder is another Go malware used by attackers to access a hardcoded command-and-control (C2) server by logging the route or hops that a packet takes like an HTTP tracer tool.", "modified": "2024-03-09T09:02:09.950000", "created": "2024-02-08T09:36:25.114000", "tags": [ "ssl certificate", "contacted", "historical ssl", "february", "referrer", "threat roundup", "apple ios", "goldfinder", "sibot", "goldmax", "hacktool", "malicious", "formbook", "contacted urls", "resolutions", "malware", "njrat", "ransomware", "open", "cyber criminal", "record type", "ttl value", "dropped", "execution", "hashes hashes", "hashes", "network", "communicating", "maui ransomware", "type name", "jpeg", "ms word", "document", "whois record", "january", "october", "december", "april", "august", "crypto", "awful", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "self", "march", "urls http", "threat network", "problems", "whois whois", "probe", "startpage", "premium", "snatch", "first", "utc submissions", "submitters", "cloudflarenet", "gvb gelimed", "com laude", "mb super", "optimizer", "amazonaes", "summary iocs", "twitter", "united", "as20940", "aaaa", "as714 apple", "as16625 akamai", "win32mydoom feb", "name servers", "trojan", "as6185 apple", "creation date", "virtool", "worm", "date", "win32", "urls", "search", "servers", "targeting", "target", "tsara brashears", "united kingdom", "whitelisted", "as6453 tata", "passive dns", "domain", "as46606", "scan endpoints", "all search", "otx octoseek", "pulse submit", "url analysis", "as54113", "entries", "moved", "body", "unknown", "found", "files", "backdoor", "expiration date", "hallrender", "tulach", "all octoseek", "url http", "pulse pulses", "http", "related pulses", "none related", "tags none", "file type", "as62597 nsone", "as62729", "showing", "next", "as2914 ntt", "ireland unknown", "germany unknown", "as6461 zayo", "as7843 charter", "as3257 gtt", "ip address", "location united", "for privacy", "record value", "as54990", "bouvet island", "encrypt", "show", "filehash", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "june", "copy", "as15169 google", "domains ii", "sality", "ck id", "ck matrix", "intellectual property theft", "malicious file transfers", "scheme", "threat", "paste", "iocs", "hostnames", "urls https", "urls url", "j490s6lkpppw", "lfqprnkje8dni0" ], "references": [ "https://side3.com/", "https://www.side3.com", "http://koshishmarketing.com/mo8igygw3uv/t4z68181/ [malware_hosting]", "http://l2filesget.com/horyuclassic/updater/Launcher_Horyu_Classic.exe [malware_hosting]", "http://fillmark.net/index.php [phishing]", "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [phishing]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]", "www-temp.metrobyt-mobile.com [malicious | data collection]", "www.icloud.com [wp-login.php]", "webdisk.thehomemakers.nl [spyware | tracking]", "https://tulach.cc/ [phishing - malware engineers. Malware commonly associated with m.brian sabey of hallrender.(.)com [malware hosting/attacking legal team]", "URL https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [OS & iOS password cracker] | 136-186.pornhub.org", "cs9.wac.phicdn.net.1.1.e64a8639.roksit.net", "www.anyxxxtube.net [malicious data collection]", "s3.amazonaws.com [targeting data collection]", "https://twitter.com/PORNO_SEXYBABES | https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/", "nr-data.net [Apple Private Data Collection] | 67.199.248.12 [apple data collection IP]", "api.utah.edu [access apple]", "https://applemusic-spotlight.myunidays.com/US/en-US? [access to vulnerable or targeted devices via media]", "tv.apple.com", "104.92.250.162 [Apple image scanning IP] || appleid.com [insecure. other users]", "andrewka6.pythonanywhere.com [python connection - apple]", "http://l2filesget.com/horyuclassic/updater/system-eu/EnchantStatBonus_Classic.dat.lzma", "https://www.picussecurity.com/resource/unc2452-nobelium-threat-group-attack-campaign", "sonymobilemail.com", "https://onhimalayas.com/ckfinder/userfiles/files/jafufedopegagedolabib.pdf", "pegahpouraseflaw.info", "http://mouthgrave.net/index.php", "ransomed.vc", "Intellectual property accessed and distributed" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [ { "id": "Cyber Criminal", "display_name": "Cyber Criminal", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax", "display_name": "GoldMax", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "NjRAT", "display_name": "NjRAT", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Maui Ransomware", "display_name": "Maui Ransomware", "target": null }, { "id": "Worm:Win32/Mydoom", "display_name": "Worm:Win32/Mydoom", "target": "/malware/Worm:Win32/Mydoom" }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Sality", "display_name": "Sality", "target": null } ], "attack_ids": [ { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1094", "name": "Custom Command and Control Protocol", "display_name": "T1094 - Custom Command and Control Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1215", "name": "Kernel Modules and Extensions", "display_name": "T1215 - Kernel Modules and Extensions" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1059.002", "name": "AppleScript", "display_name": "T1059.002 - AppleScript" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" } ], "industries": [ "Entertainment", "Technology", "Telecommunications", "Recording Industry", "Entertainers", "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 49, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5271, "FileHash-MD5": 899, "FileHash-SHA1": 881, "FileHash-SHA256": 5609, "domain": 2199, "hostname": 3205, "CVE": 1, "email": 9 }, "indicator_count": 18074, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "813 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65c4a1c74cf5f1af5be6464e", "name": " authsmtp.sabeydatacenters.com | tulach gained access to Side3 Studios Denver\t\t", "description": "", "modified": "2024-03-09T09:02:09.950000", "created": "2024-02-08T09:41:27.252000", "tags": [ "ssl certificate", "contacted", "historical ssl", "february", "referrer", "threat roundup", "apple ios", "goldfinder", "sibot", "goldmax", "hacktool", "malicious", "formbook", "contacted urls", "resolutions", "malware", "njrat", "ransomware", "open", "cyber criminal", "record type", "ttl value", "dropped", "execution", "hashes hashes", "hashes", "network", "communicating", "maui ransomware", "type name", "jpeg", "ms word", "document", "whois record", "january", "october", "december", "april", "august", "crypto", "awful", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "self", "march", "urls http", "threat network", "problems", "whois whois", "probe", "startpage", "premium", "snatch", "first", "utc submissions", "submitters", "cloudflarenet", "gvb gelimed", "com laude", "mb super", "optimizer", "amazonaes", "summary iocs", "twitter", "united", "as20940", "aaaa", "as714 apple", "as16625 akamai", "win32mydoom feb", "name servers", "trojan", "as6185 apple", "creation date", "virtool", "worm", "date", "win32", "urls", "search", "servers", "targeting", "target", "tsara brashears", "united kingdom", "whitelisted", "as6453 tata", "passive dns", "domain", "as46606", "scan endpoints", "all search", "otx octoseek", "pulse submit", "url analysis", "as54113", "entries", "moved", "body", "unknown", "found", "files", "backdoor", "expiration date", "hallrender", "tulach", "all octoseek", "url http", "pulse pulses", "http", "related pulses", "none related", "tags none", "file type", "as62597 nsone", "as62729", "showing", "next", "as2914 ntt", "ireland unknown", "germany unknown", "as6461 zayo", "as7843 charter", "as3257 gtt", "ip address", "location united", "for privacy", "record value", "as54990", "bouvet island", "encrypt", "show", "filehash", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "june", "copy", "as15169 google", "domains ii", "sality", "ck id", "ck matrix", "intellectual property theft", "malicious file transfers", "scheme", "threat", "paste", "iocs", "hostnames", "urls https", "urls url", "j490s6lkpppw", "lfqprnkje8dni0" ], "references": [ "https://side3.com/", "https://www.side3.com", "http://koshishmarketing.com/mo8igygw3uv/t4z68181/ [malware_hosting]", "http://l2filesget.com/horyuclassic/updater/Launcher_Horyu_Classic.exe [malware_hosting]", "http://fillmark.net/index.php [phishing]", "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [phishing]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]", "www-temp.metrobyt-mobile.com [malicious | data collection]", "www.icloud.com [wp-login.php]", "webdisk.thehomemakers.nl [spyware | tracking]", "https://tulach.cc/ [phishing - malware engineers. Malware commonly associated with m.brian sabey of hallrender.(.)com [malware hosting/attacking legal team]", "URL https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [OS & iOS password cracker] | 136-186.pornhub.org", "cs9.wac.phicdn.net.1.1.e64a8639.roksit.net", "www.anyxxxtube.net [malicious data collection]", "s3.amazonaws.com [targeting data collection]", "https://twitter.com/PORNO_SEXYBABES | https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/", "nr-data.net [Apple Private Data Collection] | 67.199.248.12 [apple data collection IP]", "api.utah.edu [access apple]", "https://applemusic-spotlight.myunidays.com/US/en-US? [access to vulnerable or targeted devices via media]", "tv.apple.com", "104.92.250.162 [Apple image scanning IP] || appleid.com [insecure. other users]", "andrewka6.pythonanywhere.com [python connection - apple]", "http://l2filesget.com/horyuclassic/updater/system-eu/EnchantStatBonus_Classic.dat.lzma", "https://www.picussecurity.com/resource/unc2452-nobelium-threat-group-attack-campaign", "sonymobilemail.com", "https://onhimalayas.com/ckfinder/userfiles/files/jafufedopegagedolabib.pdf", "pegahpouraseflaw.info", "http://mouthgrave.net/index.php", "ransomed.vc", "Intellectual property accessed and distributed" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [ { "id": "Cyber Criminal", "display_name": "Cyber Criminal", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax", "display_name": "GoldMax", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "NjRAT", "display_name": "NjRAT", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Maui Ransomware", "display_name": "Maui Ransomware", "target": null }, { "id": "Worm:Win32/Mydoom", "display_name": "Worm:Win32/Mydoom", "target": "/malware/Worm:Win32/Mydoom" }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Sality", "display_name": "Sality", "target": null } ], "attack_ids": [ { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1094", "name": "Custom Command and Control Protocol", "display_name": "T1094 - Custom Command and Control Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1215", "name": "Kernel Modules and Extensions", "display_name": "T1215 - Kernel Modules and Extensions" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1059.002", "name": "AppleScript", "display_name": "T1059.002 - AppleScript" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" } ], "industries": [ "Entertainment", "Technology", "Telecommunications", "Recording Industry", "Entertainers", "Civil Society" ], "TLP": "white", "cloned_from": "65c4a099f6a2c8fc2bb85d4b", "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5271, "FileHash-MD5": 899, "FileHash-SHA1": 881, "FileHash-SHA256": 5609, "domain": 2199, "hostname": 3205, "CVE": 1, "email": 9 }, "indicator_count": 18074, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "813 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65536bc6301b7cdf7d04e095", "name": "TrojanDownloader:Win32/Cutwail.BS/Win.Trojan.Pushdo-20", "description": "backdoor,trojan downloaders, networm, phishing, tracking, spyware, device commands...", "modified": "2023-12-14T12:03:15.957000", "created": "2023-11-14T12:44:54.422000", "tags": [ "passive dns", "urls", "t1604023287", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "ssl certificate", "whois record", "resolutions", "referrer", "historical ssl", "communicating", "threat roundup", "whois whois", "apple", "stopransomware", "core", "discord", "metro", "blister", "cobalt strike", "hacktool", "june", "name verdict", "pattern match", "et tor", "known tor", "misc attack", "link", "woff2", "relayrouter", "exit", "node traffic", "ascii text", "date", "click", "unknown", "meta", "hybrid", "general", "local", "strings", "class", "generator", "critical", "error", "execution", "malware", "network", "roblox", "united", "as13335", "a domains", "status", "aaaa", "search", "script urls", "creation date", "showing", "pixel", "win32", "download", "t1507537243" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Roblox", "display_name": "Roblox", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 11333, "FileHash-MD5": 81, "FileHash-SHA1": 74, "FileHash-SHA256": 3269, "domain": 2748, "hostname": 3475, "email": 2, "CVE": 2 }, "indicator_count": 20984, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "899 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65536bdc3676a40633a619be", "name": "TrojanDownloader:Win32/Cutwail.BS/Win.Trojan.Pushdo-20", "description": "backdoor,trojan downloaders, networm, phishing, tracking, spyware, device commands...", "modified": "2023-12-14T12:03:15.957000", "created": "2023-11-14T12:45:16.667000", "tags": [ "passive dns", "urls", "t1604023287", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "ssl certificate", "whois record", "resolutions", "referrer", "historical ssl", "communicating", "threat roundup", "whois whois", "apple", "stopransomware", "core", "discord", "metro", "blister", "cobalt strike", "hacktool", "june", "name verdict", "pattern match", "et tor", "known tor", "misc attack", "link", "woff2", "relayrouter", "exit", "node traffic", "ascii text", "date", "click", "unknown", "meta", "hybrid", "general", "local", "strings", "class", "generator", "critical", "error", "execution", "malware", "network", "roblox", "united", "as13335", "a domains", "status", "aaaa", "search", "script urls", "creation date", "showing", "pixel", "win32", "download", "t1507537243" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Roblox", "display_name": "Roblox", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 35, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 11333, "FileHash-MD5": 81, "FileHash-SHA1": 74, "FileHash-SHA256": 3269, "domain": 2748, "hostname": 3475, "email": 2, "CVE": 2 }, "indicator_count": 20984, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "899 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65568d67bd96e06ab44b9b95", "name": "TrojanDownloader:Win32/Cutwail.BS/Win.Trojan.Pushdo-20", "description": "", "modified": "2023-12-14T12:03:15.957000", "created": "2023-11-16T21:45:11.721000", "tags": [ "passive dns", "urls", "t1604023287", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "ssl certificate", "whois record", "resolutions", "referrer", "historical ssl", "communicating", "threat roundup", "whois whois", "apple", "stopransomware", "core", "discord", "metro", "blister", "cobalt strike", "hacktool", "june", "name verdict", "pattern match", "et tor", "known tor", "misc attack", "link", "woff2", "relayrouter", "exit", "node traffic", "ascii text", "date", "click", "unknown", "meta", "hybrid", "general", "local", "strings", "class", "generator", "critical", "error", "execution", "malware", "network", "roblox", "united", "as13335", "a domains", "status", "aaaa", "search", "script urls", "creation date", "showing", "pixel", "win32", "download", "t1507537243" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Roblox", "display_name": "Roblox", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "green", "cloned_from": "65536bdc3676a40633a619be", "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 11333, "FileHash-MD5": 81, "FileHash-SHA1": 74, "FileHash-SHA256": 3269, "domain": 2748, "hostname": 3475, "email": 2, "CVE": 2 }, "indicator_count": 20984, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "899 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6550cc7e0eb20237b9caa382", "name": "telus.net (part 1)", "description": "", "modified": "2023-12-12T12:02:19.185000", "created": "2023-11-12T13:00:46.503000", "tags": [ "virustotal" ], "references": [ "https://www.virustotal.com/graph/g1de5e44a37db46b99ccde279765afb2876ec174f4c9249ebb5bf7f392e75f071" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 318, "FileHash-SHA1": 319, "FileHash-SHA256": 1695, "URL": 193, "domain": 91, "hostname": 23 }, "indicator_count": 2639, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "901 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "eresmas.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "eresmas.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780279977.9457834 }