{ "type": "Domain", "indicator": "exploit.im", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/exploit.im", "alexa": "http://www.alexa.com/siteinfo/exploit.im", "indicator": "exploit.im", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 653602, "indicator": "exploit.im", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 39, "pulses": [ { "id": "67a182dc6ac40eb6a70b9d76", "name": "Uncovering Cyber Threat Networks: SmartApeSG & NetSupport RAT", "description": "This investigation explores the connections between SmartApeSG, a FakeUpdate threat, and NetSupport RAT. Through analysis of Internet telemetry data, the research uncovered related C2 management hosts, active NetSupport RAT servers, and cross-connections to suspicious infrastructure. Key findings include the identification of Moldovan IPs used for C2 management, an active NetSupport RAT cluster with old C2s still receiving victim communication, and potential links between SmartApeSG and NetSupport RAT infrastructures. The investigation also revealed connections to Quasar RAT and cryptocurrency-related activities. The research demonstrates how pivoting through Internet telemetry data can uncover complex threat actor infrastructures and their persistent evolution.", "modified": "2025-03-06T03:02:53.532000", "created": "2025-02-04T03:00:44.002000", "tags": [ "cryptocurrency", "moldovan ips", "pivoting analysis", "socgholish", "netsupport rat", "c2 infrastructure", "quasar rat", "fakeupdate", "landupdate808", "ispmanager", "smartapesg", "clearfake", "lycantrox" ], "references": [ "https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat" ], "public": 1, "adversary": "", "targeted_countries": [ "Moldova, Republic of", "Russian Federation" ], "malware_families": [ { "id": "SmartApeSG", "display_name": "SmartApeSG", "target": null }, { "id": "NetSupport RAT", "display_name": "NetSupport RAT", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "SocGholish", "display_name": "SocGholish", "target": null }, { "id": "LandUpdate808", "display_name": "LandUpdate808", "target": null }, { "id": "ClearFake", "display_name": "ClearFake", "target": null }, { "id": "Lycantrox", "display_name": "Lycantrox", "target": null } ], "attack_ids": [ { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "display_name": "T1190 - Exploit Public-Facing Application" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1136", "name": "Create Account", "display_name": "T1136 - Create Account" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1584.001", "name": "Domains", "display_name": "T1584.001 - Domains" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 54, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "domain": 50 }, "indicator_count": 50, "is_author": false, "is_subscribing": null, "subscriber_count": 377570, "modified_text": "409 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6675c61d2a8e4554b9985027", "name": "BLOCK_2024", "description": "", "modified": "2026-02-04T19:03:11.880000", "created": "2024-06-21T18:27:41.885000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65e899612f5527bad9d4e5a8", "export_count": 6863838, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2306, "FileHash-MD5": 4833, "URL": 1674, "hostname": 1302, "FileHash-SHA256": 6371, "FileHash-SHA1": 4014, "IPv4": 3524, "CIDR": 19, "email": 190, "CVE": 4 }, "indicator_count": 24237, "is_author": false, "is_subscribing": null, "subscriber_count": 108, "modified_text": "74 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6938723f07525bd1cd9e0f4d", "name": "NetSupport RAT / SmartApeSG", "description": "NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software.", "modified": "2026-01-08T19:00:37.613000", "created": "2025-12-09T19:02:19.867000", "tags": [ "captcha", "SmartApeSG", "NetSupport", "RAT", "quasar", "c2", "telegram", "zphp", "haneymaney", "javascript", "FakeUpdate", "Lycantrox", "DarkSeller", "DarkMarket", "Russia", "Moldova", "HostZealot", "Stark", "ClickFix", "SocGhoulish", "Quasar" ], "references": [ "https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat", "https://www.threatdown.com/blog/smartapesg-06-11-2024/", "https://isc.sans.edu/diary/32474", "https://medium.com/walmartglobaltech/smartapesg-4605157a5b80", "https://www.trellix.com/blogs/research/new-techniques-of-fake-browser-updates/", "https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-02-18-IOCs-for-SmartApeSG-fake-browser-update-leads-to-NetSupport-RAT-and-StealC.txt", "https://any.run/malware-trends/netsupport/", "https://blogs.vmware.com/security/2023/11/netsupport-rat-the-rat-king-returns.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "NetSupportManager RAT", "display_name": "NetSupportManager RAT", "target": null }, { "id": "", "display_name": "", "target": null } ], "attack_ids": [ { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1074.001", "name": "Local Data Staging", "display_name": "T1074.001 - Local Data Staging" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "display_name": "T1547.001 - Registry Run Keys / Startup Folder" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "v0od0o.exe", "id": "273579", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 172, "hostname": 13, "FileHash-SHA256": 62, "URL": 93, "FileHash-MD5": 32, "FileHash-SHA1": 32 }, "indicator_count": 404, "is_author": false, "is_subscribing": null, "subscriber_count": 25, "modified_text": "101 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69404b09d8296388596ecfa9", "name": "BLOCK_2025_DIC", "description": "", "modified": "2025-12-24T16:04:11.529000", "created": "2025-12-15T17:53:13.004000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6675c61d2a8e4554b9985027", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2300, "FileHash-MD5": 4833, "URL": 1673, "hostname": 1297, "FileHash-SHA256": 6371, "FileHash-SHA1": 4014, "IPv4": 3235, "CIDR": 19, "email": 170, "CVE": 4 }, "indicator_count": 23916, "is_author": false, "is_subscribing": null, "subscriber_count": 79, "modified_text": "116 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "654c34e7efa40976a9dd655b", "name": "SOC2023", "description": "", "modified": "2025-08-17T17:03:38.868000", "created": "2023-11-09T01:24:55.160000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65491efbfc3d9479076431bb", "export_count": 36, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1714, "FileHash-MD5": 3448, "URL": 727, "hostname": 912, "FileHash-SHA256": 4539, "FileHash-SHA1": 2696, "IPv4": 276, "CIDR": 10, "email": 28 }, "indicator_count": 14350, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "245 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67a2d8c675e61c24e3fffd05", "name": "Tracing the Path From SmartApeSG to NetSupport RAT", "description": "\u6b21\u8c03\u67e5\u8ffd\u8e2a\u4e86 SmartApeSG \u5047\u66f4\u65b0\uff08FakeUpdate\uff09\u6076\u610f\u8f6f\u4ef6\u6d3b\u52a8\uff0c\u8be5\u6d3b\u52a8\u5411\u53d7\u5bb3\u8005\u6295\u653e NetSupport RAT \u8fdc\u7a0b\u8bbf\u95ee\u6728\u9a6c\u3002\u901a\u8fc7\u4e92\u8054\u7f51\u9065\u6d4b\u5206\u6790\uff0c\u7814\u7a76\u4eba\u5458\u53d1\u73b0 SmartApeSG\u3001NetSupport RAT\u3001Quasar RAT \u53ca\u52a0\u5bc6\u8d27\u5e01\u76f8\u5173\u7684\u7f51\u7edc\u72af\u7f6a\u6d3b\u52a8 \u4e4b\u95f4\u5b58\u5728\u5173\u8054\u3002\u8c03\u67e5\u63ed\u793a\u4e86 \u5171\u4eab\u7684 C2 \u57fa\u7840\u8bbe\u65bd\u3001\u7ba1\u7406\u4e3b\u673a\u7684\u91cd\u53e0\u4ee5\u53ca\u4e0d\u540c\u6076\u610f\u8f6f\u4ef6\u96c6\u7fa4\u4e4b\u95f4\u7684\u4ea4\u4e92\u3002\u5c3d\u7ba1\u90e8\u5206\u6076\u610f\u670d\u52a1\u5668\u5df2\u88ab\u62a5\u544a\u5e76\u4e0b\u7ebf\uff0c\u653b\u51fb\u8005\u8fc5\u901f\u8fc1\u79fb\u81f3\u65b0\u7684\u57df\u540d\u548c IP \u4ee5\u7ee7\u7eed\u5176\u6d3b\u52a8\u3002\u672c\u7814\u7a76\u5f3a\u8c03\u4e86\u7f51\u7edc\u5a01\u80c1\u884c\u4e3a\u8005\u7684\u6301\u7eed\u6027\uff0c\u5e76\u547c\u5401\u5b89\u5168\u56e2\u961f\u4e0d\u65ad\u76d1\u6d4b\u548c\u91cd\u65b0\u8bc4\u4f30\u57fa\u7840\u8bbe\u65bd\u6307\u6807\uff0c\u4ee5\u5e94\u5bf9\u4e0d\u65ad\u53d8\u5316\u7684\u5a01\u80c1\u3002", "modified": "2025-03-06T03:02:53.532000", "created": "2025-02-05T03:19:34.823000", "tags": [ "cryptocurrency", "moldovan ips", "pivoting analysis", "socgholish", "netsupport rat", "c2 infrastructure", "quasar rat", "fakeupdate", "landupdate808", "ispmanager", "smartapesg", "clearfake", "lycantrox" ], "references": [ "https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat" ], "public": 1, "adversary": "", "targeted_countries": [ "Moldova, Republic of", "Russian Federation" ], "malware_families": [ { "id": "SmartApeSG", "display_name": "SmartApeSG", "target": null }, { "id": "NetSupport RAT", "display_name": "NetSupport RAT", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "SocGholish", "display_name": "SocGholish", "target": null }, { "id": "LandUpdate808", "display_name": "LandUpdate808", "target": null }, { "id": "ClearFake", "display_name": "ClearFake", "target": null }, { "id": "Lycantrox", "display_name": "Lycantrox", "target": null } ], "attack_ids": [ { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "display_name": "T1190 - Exploit Public-Facing Application" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1136", "name": "Create Account", "display_name": "T1136 - Create Account" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1584.001", "name": "Domains", "display_name": "T1584.001 - Domains" } ], "industries": [], "TLP": "white", "cloned_from": "67a182dc6ac40eb6a70b9d76", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "celestre", "id": "295357", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 50 }, "indicator_count": 50, "is_author": false, "is_subscribing": null, "subscriber_count": 119, "modified_text": "409 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67a9938d5891942bf2005ac7", "name": "Uncovering Cyber Threat Networks", "description": "", "modified": "2025-03-06T03:02:53.532000", "created": "2025-02-10T05:50:05.107000", "tags": [ "cryptocurrency", "moldovan ips", "pivoting analysis", "socgholish", "netsupport rat", "c2 infrastructure", "quasar rat", "fakeupdate", "landupdate808", "ispmanager", "smartapesg", "clearfake", "lycantrox" ], "references": [ "https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat" ], "public": 1, "adversary": "", "targeted_countries": [ "Moldova, Republic of", "Russian Federation" ], "malware_families": [ { "id": "SmartApeSG", "display_name": "SmartApeSG", "target": null }, { "id": "NetSupport RAT", "display_name": "NetSupport RAT", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "SocGholish", "display_name": "SocGholish", "target": null }, { "id": "LandUpdate808", "display_name": "LandUpdate808", "target": null }, { "id": "ClearFake", "display_name": "ClearFake", "target": null }, { "id": "Lycantrox", "display_name": "Lycantrox", "target": null } ], "attack_ids": [ { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "display_name": "T1190 - Exploit Public-Facing Application" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1136", "name": "Create Account", "display_name": "T1136 - Create Account" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1584.001", "name": "Domains", "display_name": "T1584.001 - Domains" } ], "industries": [], "TLP": "white", "cloned_from": "67a9862e0e4a02485d03c730", "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 50 }, "indicator_count": 50, "is_author": false, "is_subscribing": null, "subscriber_count": 263, "modified_text": "409 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67a9862e0e4a02485d03c730", "name": "Uncovering Cyber Threat Networks: SmartApeSG & NetSupport RAT", "description": "", "modified": "2025-03-06T03:02:53.532000", "created": "2025-02-10T04:53:02.006000", "tags": [ "cryptocurrency", "moldovan ips", "pivoting analysis", "socgholish", "netsupport rat", "c2 infrastructure", "quasar rat", "fakeupdate", "landupdate808", "ispmanager", "smartapesg", "clearfake", "lycantrox" ], "references": [ "https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat" ], "public": 1, "adversary": "", "targeted_countries": [ "Moldova, Republic of", "Russian Federation" ], "malware_families": [ { "id": "SmartApeSG", "display_name": "SmartApeSG", "target": null }, { "id": "NetSupport RAT", "display_name": "NetSupport RAT", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "SocGholish", "display_name": "SocGholish", "target": null }, { "id": "LandUpdate808", "display_name": "LandUpdate808", "target": null }, { "id": "ClearFake", "display_name": "ClearFake", "target": null }, { "id": "Lycantrox", "display_name": "Lycantrox", "target": null } ], "attack_ids": [ { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "display_name": "T1190 - Exploit Public-Facing Application" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1136", "name": "Create Account", "display_name": "T1136 - Create Account" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1584.001", "name": "Domains", "display_name": "T1584.001 - Domains" } ], "industries": [], "TLP": "white", "cloned_from": "67a182dc6ac40eb6a70b9d76", "export_count": 5845, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 50 }, "indicator_count": 50, "is_author": false, "is_subscribing": null, "subscriber_count": 263, "modified_text": "409 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "679c246da161670e959a9eec", "name": "2024-blocking-soc-ene25", "description": "", "modified": "2025-02-15T00:01:08.338000", "created": "2025-01-31T01:16:29.608000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6675c61d2a8e4554b9985027", "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2045, "FileHash-MD5": 4426, "URL": 1463, "hostname": 1231, "FileHash-SHA256": 5892, "FileHash-SHA1": 3625, "IPv4": 189, "CIDR": 6, "email": 163 }, "indicator_count": 19040, "is_author": false, "is_subscribing": null, "subscriber_count": 84, "modified_text": "428 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "679c246c8bf7850b5096828e", "name": "2024-blocking-soc-ene25", "description": "", "modified": "2025-02-15T00:01:08.338000", "created": "2025-01-31T01:16:28.004000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6675c61d2a8e4554b9985027", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2045, "FileHash-MD5": 4426, "URL": 1463, "hostname": 1231, "FileHash-SHA256": 5892, "FileHash-SHA1": 3625, "IPv4": 189, "CIDR": 6, "email": 163 }, "indicator_count": 19040, "is_author": false, "is_subscribing": null, "subscriber_count": 84, "modified_text": "428 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6765eebf9ec06704f3a6ea68", "name": "CLON IPIF", "description": "", "modified": "2025-01-09T23:04:00.232000", "created": "2024-12-20T22:25:03.407000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6675c61d2a8e4554b9985027", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2031, "FileHash-MD5": 4171, "URL": 1324, "hostname": 1222, "FileHash-SHA256": 5634, "FileHash-SHA1": 3368, "IPv4": 189, "CIDR": 6, "email": 162 }, "indicator_count": 18107, "is_author": false, "is_subscribing": null, "subscriber_count": 84, "modified_text": "464 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6758ebc2472100ac75acad69", "name": "2024-DIC-10-Clon", "description": "", "modified": "2025-01-09T23:04:00.232000", "created": "2024-12-11T01:32:50.260000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6675c61d2a8e4554b9985027", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2030, "FileHash-MD5": 4171, "URL": 1324, "hostname": 1222, "FileHash-SHA256": 5634, "FileHash-SHA1": 3368, "IPv4": 189, "CIDR": 6, "email": 162 }, "indicator_count": 18106, "is_author": false, "is_subscribing": null, "subscriber_count": 84, "modified_text": "464 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6732a0b6cc4c5356a823de37", "name": "_CLON_2024_NOV11", "description": "", "modified": "2024-12-11T00:00:21.805000", "created": "2024-11-12T00:26:30.524000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6675c61d2a8e4554b9985027", "export_count": 30, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1795, "FileHash-MD5": 3724, "URL": 1028, "hostname": 1096, "FileHash-SHA256": 5030, "FileHash-SHA1": 2927, "IPv4": 189, "CIDR": 6, "email": 28 }, "indicator_count": 15823, "is_author": false, "is_subscribing": null, "subscriber_count": 84, "modified_text": "494 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65fc23e4c36f0715310e1d95", "name": "SOC_BLOCK_NEW", "description": "", "modified": "2024-03-21T12:11:41.190000", "created": "2024-03-21T12:11:16.345000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65e899612f5527bad9d4e5a8", "export_count": 275, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": true, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "fencesense", "id": "255590", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1715, "FileHash-MD5": 3498, "URL": 729, "hostname": 911, "FileHash-SHA256": 4590, "FileHash-SHA1": 2746, "IPv4": 189, "CIDR": 6, "email": 28 }, "indicator_count": 14412, "is_author": false, "is_subscribing": null, "subscriber_count": 25, "modified_text": "759 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a9b042961d3e7a6a564d", "name": "bkp16oct", "description": "", "modified": "2023-12-06T17:04:48.880000", "created": "2023-12-06T17:04:48.880000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1390, "FileHash-SHA256": 3099, "hostname": 769, "FileHash-MD5": 2353, "FileHash-SHA1": 1624, "URL": 590, "email": 26, "IPv4": 150, "CIDR": 6 }, "indicator_count": 10007, "is_author": false, "is_subscribing": null, "subscriber_count": 113, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a8b5cae685fce7f5231f", "name": "bkp oct 10", "description": "", "modified": "2023-12-06T17:00:37.687000", "created": "2023-12-06T17:00:37.687000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1376, "FileHash-SHA256": 3065, "hostname": 768, "FileHash-MD5": 2320, "FileHash-SHA1": 1591, "URL": 589, "email": 26, "IPv4": 150, "CIDR": 6 }, "indicator_count": 9891, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a7d02c5746343283fc12", "name": "bkp5o23", "description": "", "modified": "2023-12-06T16:56:48.472000", "created": "2023-12-06T16:56:48.472000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1365, "FileHash-SHA256": 3021, "hostname": 764, "FileHash-MD5": 2278, "FileHash-SHA1": 1539, "URL": 589, "email": 26, "IPv4": 150, "CIDR": 6 }, "indicator_count": 9738, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a7aaee2e95f7517277d3", "name": "bkp03test", "description": "", "modified": "2023-12-06T16:56:10.492000", "created": "2023-12-06T16:56:10.492000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1362, "FileHash-SHA256": 2891, "hostname": 755, "FileHash-MD5": 2159, "FileHash-SHA1": 1420, "URL": 589, "email": 26, "IPv4": 148, "CIDR": 6 }, "indicator_count": 9356, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a7a346ec10c12d5b15b5", "name": "BKPo3", "description": "", "modified": "2023-12-06T16:56:03.381000", "created": "2023-12-06T16:56:03.381000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1362, "FileHash-SHA256": 2891, "hostname": 755, "FileHash-MD5": 2159, "FileHash-SHA1": 1420, "URL": 589, "email": 26, "IPv4": 148, "CIDR": 6 }, "indicator_count": 9356, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a602c1e9c47280c247e4", "name": "SOC2023", "description": "", "modified": "2023-12-06T16:49:06.159000", "created": "2023-12-06T16:49:06.159000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1420, "FileHash-SHA256": 3123, "hostname": 769, "FileHash-MD5": 2379, "FileHash-SHA1": 1642, "URL": 590, "email": 26, "IPv4": 150, "CIDR": 6 }, "indicator_count": 10105, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a5f81702fdce6c496a1c", "name": "Undefined Name", "description": "", "modified": "2023-12-06T16:48:56.950000", "created": "2023-12-06T16:48:56.950000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1345, "FileHash-SHA256": 2819, "hostname": 741, "FileHash-MD5": 2106, "FileHash-SHA1": 1371, "URL": 571, "email": 26, "IPv4": 148, "CIDR": 6 }, "indicator_count": 9133, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a5a5f6bf793f823e6397", "name": "Undefined Name", "description": "", "modified": "2023-12-06T16:47:33.032000", "created": "2023-12-06T16:47:33.032000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1345, "FileHash-SHA256": 2819, "hostname": 741, "FileHash-MD5": 2106, "FileHash-SHA1": 1371, "URL": 571, "email": 26, "IPv4": 148, "CIDR": 6 }, "indicator_count": 9133, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a131970ec6097f14145d", "name": "SOC BACKUP 30 agosto 23", "description": "", "modified": "2023-12-06T16:28:33.117000", "created": "2023-12-06T16:28:33.117000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2285, "FileHash-MD5": 1940, "FileHash-SHA1": 1329, "domain": 1221, "URL": 509, "hostname": 691, "email": 26, "IPv4": 148, "CIDR": 6 }, "indicator_count": 8155, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a06afa6efdc2e5fa11b2", "name": "Cuba ransomware", "description": "", "modified": "2023-12-06T16:25:14.685000", "created": "2023-12-06T16:25:14.685000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 19, "FileHash-SHA256": 33, "FileHash-SHA1": 19, "domain": 108, "URL": 1, "email": 5, "hostname": 2 }, "indicator_count": 187, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65709d867a940714a5e7986c", "name": "soc bkp 20jul23", "description": "", "modified": "2023-12-06T16:12:54.283000", "created": "2023-12-06T16:12:54.283000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1808, "FileHash-MD5": 1232, "FileHash-SHA1": 991, "domain": 1138, "URL": 431, "hostname": 546, "email": 26, "IPv4": 142, "CIDR": 6 }, "indicator_count": 6320, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65709d02c0ab86d6d480a712", "name": "prueba final9", "description": "", "modified": "2023-12-06T16:10:42.479000", "created": "2023-12-06T16:10:42.479000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1159, "FileHash-SHA256": 1645, "FileHash-SHA1": 913, "domain": 1082, "URL": 353, "email": 25, "hostname": 395, "CIDR": 6 }, "indicator_count": 5578, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65709cd0237fe7c1dad22d00", "name": "backup soc 3jul", "description": "", "modified": "2023-12-06T16:09:52.107000", "created": "2023-12-06T16:09:52.107000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1607, "FileHash-MD5": 1121, "FileHash-SHA1": 863, "domain": 1094, "URL": 349, "hostname": 371, "email": 25, "IPv4": 131, "CIDR": 6 }, "indicator_count": 5567, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65709c30640281616285e1c3", "name": "Backup_soc_2022_05jun23", "description": "", "modified": "2023-12-06T16:07:12.894000", "created": "2023-12-06T16:07:12.894000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1115, "FileHash-SHA256": 1554, "FileHash-SHA1": 857, "domain": 1079, "URL": 338, "hostname": 368, "email": 25, "IPv4": 131, "CIDR": 6 }, "indicator_count": 5473, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "657093164553ecf08ba4a8bd", "name": "SOC2022ALL", "description": "", "modified": "2023-12-06T15:28:22.905000", "created": "2023-12-06T15:28:22.905000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1345, "FileHash-SHA256": 2819, "hostname": 741, "FileHash-MD5": 2106, "FileHash-SHA1": 1371, "URL": 571, "email": 26, "IPv4": 148, "CIDR": 6 }, "indicator_count": 9133, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6346ee707f119521a426ecc9", "name": "SOC2022ALL", "description": "DD", "modified": "2023-10-21T14:02:41.990000", "created": "2022-10-12T16:42:24.004000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16454, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1490, "FileHash-MD5": 2606, "URL": 611, "hostname": 831, "FileHash-SHA256": 3518, "FileHash-SHA1": 1794, "IPv4": 187, "CIDR": 6, "email": 26 }, "indicator_count": 11069, "is_author": false, "is_subscribing": null, "subscriber_count": 102, "modified_text": "911 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64e305c038fbc57edd14e9e8", "name": "Cuba ransomware", "description": "", "modified": "2023-09-20T06:01:57.386000", "created": "2023-08-21T06:35:44.432000", "tags": [ "domain", "hash", "ip address", "hashsha256", "email address" ], "references": [ "entities.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Ransom:Win32/Cuba", "display_name": "Ransom:Win32/Cuba", "target": "/malware/Ransom:Win32/Cuba" } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ASQ505sa", "id": "217420", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 19, "FileHash-SHA1": 19, "FileHash-SHA256": 33, "URL": 1, "domain": 108, "email": 5, "hostname": 2 }, "indicator_count": 187, "is_author": false, "is_subscribing": null, "subscriber_count": 35, "modified_text": "942 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64886ada7313b886df588f8f", "name": "domains", "description": "domains", "modified": "2023-06-13T13:10:50.659000", "created": "2023-06-13T13:10:50.659000", "tags": [ "domain" ], "references": [ "entities (48).csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ASQ505sa", "id": "217420", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 23, "domain": 91 }, "indicator_count": 114, "is_author": false, "is_subscribing": null, "subscriber_count": 35, "modified_text": "1041 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62e74b49b252a1e285be145c", "name": "Dirty Deeds Done Dirt Cheap: Russian RAT Offers Backdoor Bargains", "description": "", "modified": "2022-08-01T03:40:57.327000", "created": "2022-08-01T03:40:57.327000", "tags": [ "dcrat", "jphp", "dcrat client", "trojan", "darkcrystal rat", "boldenis44", "coder", "rats", "gbpus", "deeper", "cobalt strike", "prometheus" ], "references": [ "https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "627b794db708d8a93f91c88c", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "fontwang1234", "id": "196068", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 32, "FileHash-SHA1": 31, "FileHash-SHA256": 32, "domain": 5 }, "indicator_count": 100, "is_author": false, "is_subscribing": null, "subscriber_count": 49, "modified_text": "1357 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "629a19c0652225dfdbd723e0", "name": "Dirty Deeds Done Dirt Cheap: Russian RAT Offers Backdoor Bargains", "description": "A lone Russian threat actor is selling a commercial remote access Trojan (RAT) for less than 5 GBP/US$6 (\u00c2\u00a35.6), according to a new whitepaper.", "modified": "2022-06-03T14:25:04.162000", "created": "2022-06-03T14:25:04.162000", "tags": [ "darkcrystal", "dcrat", "njrat", "jphp", "dcrat client", "apt group", "security", "trojan", "darkcrystal rat", "boldenis44", "coder", "rats", "cobalt strike", "prometheus" ], "references": [ "https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Darkcrystal", "display_name": "Darkcrystal", "target": null }, { "id": "DCRat", "display_name": "DCRat", "target": null }, { "id": "njRAT", "display_name": "njRAT", "target": null }, { "id": "DarkCrystal", "display_name": "DarkCrystal", "target": null } ], "attack_ids": [ { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "display_name": "T1127 - Trusted Developer Utilities Proxy Execution" }, { "id": "T1499", "name": "Endpoint Denial of Service", "display_name": "T1499 - Endpoint Denial of Service" } ], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "hogan777", "id": "167471", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 32, "FileHash-SHA1": 31, "FileHash-SHA256": 32, "domain": 5 }, "indicator_count": 100, "is_author": false, "is_subscribing": null, "subscriber_count": 52, "modified_text": "1416 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "627b794db708d8a93f91c88c", "name": "Dirty Deeds Done Dirt Cheap: Russian RAT Offers Backdoor Bargains", "description": "", "modified": "2022-05-11T08:52:29.451000", "created": "2022-05-11T08:52:29.451000", "tags": [ "dcrat", "jphp", "dcrat client", "trojan", "darkcrystal rat", "boldenis44", "coder", "rats", "gbpus", "deeper", "cobalt strike", "prometheus" ], "references": [ "https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "caralin0702", "id": "73972", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 32, "FileHash-SHA1": 31, "FileHash-SHA256": 32, "domain": 5 }, "indicator_count": 100, "is_author": false, "is_subscribing": null, "subscriber_count": 100, "modified_text": "1439 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "627a186873c568a02bebfb20", "name": "Dirty Deeds Done Dirt Cheap: Russian RAT Offers Backdoor Bargains", "description": "", "modified": "2022-05-10T07:46:48.457000", "created": "2022-05-10T07:46:48.457000", "tags": [ "darkcrystal", "dcrat", "njrat", "jphp", "dcrat client", "trojan", "darkcrystal rat", "boldenis44", "coder", "rats", "gbpus", "deeper", "cobalt strike", "prometheus" ], "references": [ "https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Darkcrystal", "display_name": "Darkcrystal", "target": null }, { "id": "DCRat", "display_name": "DCRat", "target": null }, { "id": "njRAT", "display_name": "njRAT", "target": null }, { "id": "DarkCrystal", "display_name": "DarkCrystal", "target": null } ], "attack_ids": [ { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "display_name": "T1127 - Trusted Developer Utilities Proxy Execution" }, { "id": "T1499", "name": "Endpoint Denial of Service", "display_name": "T1499 - Endpoint Denial of Service" } ], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "email": 1, "hostname": 1, "FileHash-MD5": 32, "FileHash-SHA1": 31, "FileHash-SHA256": 32, "domain": 5 }, "indicator_count": 102, "is_author": false, "is_subscribing": null, "subscriber_count": 847, "modified_text": "1440 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "627a023c21f529e08e82874e", "name": "Dirty Deeds Done Dirt Cheap: Russian RAT Offers Backdoor Bargains", "description": "A new threat actor\u2019s tool, DCRat, is one of the cheapest and most popular tools for opening backdoors on a cheap basis, according to a whitepaper published by ThreatVector.", "modified": "2022-05-10T06:12:12.045000", "created": "2022-05-10T06:12:12.045000", "tags": [ "darkcrystal", "dcrat", "njrat", "jphp", "dcrat client", "trojan", "darkcrystal rat", "boldenis44", "coder", "rats", "gbpus", "deeper", "cobalt strike", "prometheus" ], "references": [ "https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Darkcrystal", "display_name": "Darkcrystal", "target": null }, { "id": "DCRat", "display_name": "DCRat", "target": null }, { "id": "njRAT", "display_name": "njRAT", "target": null }, { "id": "DarkCrystal", "display_name": "DarkCrystal", "target": null } ], "attack_ids": [ { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "display_name": "T1127 - Trusted Developer Utilities Proxy Execution" }, { "id": "T1499", "name": "Endpoint Denial of Service", "display_name": "T1499 - Endpoint Denial of Service" } ], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cyberasmi", "id": "169715", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 32, "FileHash-SHA1": 31, "FileHash-SHA256": 32, "domain": 5 }, "indicator_count": 100, "is_author": false, "is_subscribing": null, "subscriber_count": 57, "modified_text": "1440 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f0a952655b1beb099a0e25", "name": "Kraken the Code on Prometheus", "description": "", "modified": "2022-02-25T00:01:34.436000", "created": "2022-01-26T01:52:18.442000", "tags": [ "blackmatter", "ryuk", "qakbot", "cerber", "fickerstealer", "raas", "file encryption", "rust", "chrome", "firefox", "winscp", "discord", "sodinokibi", "gandcrab", "revil", "ryuk ransomware", "trickbot", "darkside", "icedid", "prometheus", "dark" ], "references": [ "https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "caralin0702", "id": "73972", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-MD5": 1, "URL": 1, "domain": 2 }, "indicator_count": 5, "is_author": false, "is_subscribing": null, "subscriber_count": 100, "modified_text": "1514 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e9103b4c67ac8ee1972779", "name": "Kraken the Code on Prometheus", "description": "A security researcher for BlackBerry has identified a subscription-based malware service called Prometheus TDS, which allows cyber-thieves to target targets via a complex web of phishing, maldocs and HTTP redirection.", "modified": "2022-02-19T00:03:23.595000", "created": "2022-01-20T07:33:15.585000", "tags": [ "cobalt strike", "prometheus tds", "ryuk", "php", "darkcrystal", "prometheus", "remote access", "dcrat", "fickerstealer", "trickbot", "blackmatter", "qakbot", "cerber", "raas", "file encryption", "rust", "chrome", "firefox", "winscp", "discord", "sodinokibi", "gandcrab", "revil", "ryuk ransomware", "darkside", "icedid", "dark" ], "references": [ "https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus" ], "public": 1, "adversary": "", "targeted_countries": [ "Belgium", "United States of America" ], "malware_families": [ { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Ryuk", "display_name": "Ryuk", "target": null }, { "id": "Prometheus TDS", "display_name": "Prometheus TDS", "target": null }, { "id": "DarkCrystal", "display_name": "DarkCrystal", "target": null }, { "id": "PHP", "display_name": "PHP", "target": null }, { "id": "Trickbot", "display_name": "Trickbot", "target": null }, { "id": "FickerStealer", "display_name": "FickerStealer", "target": null }, { "id": "DCRAT", "display_name": "DCRAT", "target": null }, { "id": "Remote Access", "display_name": "Remote Access", "target": null }, { "id": "Prometheus", "display_name": "Prometheus", "target": null } ], "attack_ids": [ { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1021", "name": "Remote Services", "display_name": "T1021 - Remote Services" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1505", "name": "Server Software Component", "display_name": "T1505 - Server Software Component" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" } ], "industries": [ "Government", "Defense", "Oil And Gas", "Nuclear", "Critical Infrastructure", "Power Plants" ], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "mohdrennis", "id": "138092", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-MD5": 1, "URL": 1, "domain": 2 }, "indicator_count": 5, "is_author": false, "is_subscribing": null, "subscriber_count": 360, "modified_text": "1520 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat", "https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-02-18-IOCs-for-SmartApeSG-fake-browser-update-leads-to-NetSupport-RAT-and-StealC.txt", "https://isc.sans.edu/diary/32474", "entities (48).csv", "https://blogs.vmware.com/security/2023/11/netsupport-rat-the-rat-king-returns.html", "entities.csv", "https://medium.com/walmartglobaltech/smartapesg-4605157a5b80", "https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains", "https://www.threatdown.com/blog/smartapesg-06-11-2024/", "https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus", "https://www.trellix.com/blogs/research/new-techniques-of-fake-browser-updates/", "https://any.run/malware-trends/netsupport/" ], "related": { "alienvault": { "adversary": [], "malware_families": [ "Clearfake", "Smartapesg", "Quasar rat", "Lycantrox", "Socgholish", "Netsupport rat", "Landupdate808" ], "industries": [] }, "other": { "adversary": [], "malware_families": [ "", "Quasar rat", "Njrat", "Socgholish", "Php", "Clearfake", "Prometheus", "Darkcrystal", "Cobalt strike", "Netsupport rat", "Trickbot", "Netsupportmanager rat", "Ryuk", "Lycantrox", "Remote access", "Dcrat", "Ransom:win32/cuba", "Fickerstealer", "Smartapesg", "Prometheus tds", "Landupdate808" ], "industries": [ "Oil and gas", "Defense", "Critical infrastructure", "Power plants", "Government", "Nuclear" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 39, "pulses": [ { "id": "67a182dc6ac40eb6a70b9d76", "name": "Uncovering Cyber Threat Networks: SmartApeSG & NetSupport RAT", "description": "This investigation explores the connections between SmartApeSG, a FakeUpdate threat, and NetSupport RAT. Through analysis of Internet telemetry data, the research uncovered related C2 management hosts, active NetSupport RAT servers, and cross-connections to suspicious infrastructure. Key findings include the identification of Moldovan IPs used for C2 management, an active NetSupport RAT cluster with old C2s still receiving victim communication, and potential links between SmartApeSG and NetSupport RAT infrastructures. The investigation also revealed connections to Quasar RAT and cryptocurrency-related activities. The research demonstrates how pivoting through Internet telemetry data can uncover complex threat actor infrastructures and their persistent evolution.", "modified": "2025-03-06T03:02:53.532000", "created": "2025-02-04T03:00:44.002000", "tags": [ "cryptocurrency", "moldovan ips", "pivoting analysis", "socgholish", "netsupport rat", "c2 infrastructure", "quasar rat", "fakeupdate", "landupdate808", "ispmanager", "smartapesg", "clearfake", "lycantrox" ], "references": [ "https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat" ], "public": 1, "adversary": "", "targeted_countries": [ "Moldova, Republic of", "Russian Federation" ], "malware_families": [ { "id": "SmartApeSG", "display_name": "SmartApeSG", "target": null }, { "id": "NetSupport RAT", "display_name": "NetSupport RAT", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "SocGholish", "display_name": "SocGholish", "target": null }, { "id": "LandUpdate808", "display_name": "LandUpdate808", "target": null }, { "id": "ClearFake", "display_name": "ClearFake", "target": null }, { "id": "Lycantrox", "display_name": "Lycantrox", "target": null } ], "attack_ids": [ { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "display_name": "T1190 - Exploit Public-Facing Application" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1136", "name": "Create Account", "display_name": "T1136 - Create Account" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1584.001", "name": "Domains", "display_name": "T1584.001 - Domains" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 54, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "domain": 50 }, "indicator_count": 50, "is_author": false, "is_subscribing": null, "subscriber_count": 377570, "modified_text": "409 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6675c61d2a8e4554b9985027", "name": "BLOCK_2024", "description": "", "modified": "2026-02-04T19:03:11.880000", "created": "2024-06-21T18:27:41.885000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65e899612f5527bad9d4e5a8", "export_count": 6863838, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2306, "FileHash-MD5": 4833, "URL": 1674, "hostname": 1302, "FileHash-SHA256": 6371, "FileHash-SHA1": 4014, "IPv4": 3524, "CIDR": 19, "email": 190, "CVE": 4 }, "indicator_count": 24237, "is_author": false, "is_subscribing": null, "subscriber_count": 108, "modified_text": "74 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6938723f07525bd1cd9e0f4d", "name": "NetSupport RAT / SmartApeSG", "description": "NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software.", "modified": "2026-01-08T19:00:37.613000", "created": "2025-12-09T19:02:19.867000", "tags": [ "captcha", "SmartApeSG", "NetSupport", "RAT", "quasar", "c2", "telegram", "zphp", "haneymaney", "javascript", "FakeUpdate", "Lycantrox", "DarkSeller", "DarkMarket", "Russia", "Moldova", "HostZealot", "Stark", "ClickFix", "SocGhoulish", "Quasar" ], "references": [ "https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat", "https://www.threatdown.com/blog/smartapesg-06-11-2024/", "https://isc.sans.edu/diary/32474", "https://medium.com/walmartglobaltech/smartapesg-4605157a5b80", "https://www.trellix.com/blogs/research/new-techniques-of-fake-browser-updates/", "https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-02-18-IOCs-for-SmartApeSG-fake-browser-update-leads-to-NetSupport-RAT-and-StealC.txt", "https://any.run/malware-trends/netsupport/", "https://blogs.vmware.com/security/2023/11/netsupport-rat-the-rat-king-returns.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "NetSupportManager RAT", "display_name": "NetSupportManager RAT", "target": null }, { "id": "", "display_name": "", "target": null } ], "attack_ids": [ { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1074.001", "name": "Local Data Staging", "display_name": "T1074.001 - Local Data Staging" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "display_name": "T1547.001 - Registry Run Keys / Startup Folder" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "v0od0o.exe", "id": "273579", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 172, "hostname": 13, "FileHash-SHA256": 62, "URL": 93, "FileHash-MD5": 32, "FileHash-SHA1": 32 }, "indicator_count": 404, "is_author": false, "is_subscribing": null, "subscriber_count": 25, "modified_text": "101 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69404b09d8296388596ecfa9", "name": "BLOCK_2025_DIC", "description": "", "modified": "2025-12-24T16:04:11.529000", "created": "2025-12-15T17:53:13.004000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6675c61d2a8e4554b9985027", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2300, "FileHash-MD5": 4833, "URL": 1673, "hostname": 1297, "FileHash-SHA256": 6371, "FileHash-SHA1": 4014, "IPv4": 3235, "CIDR": 19, "email": 170, "CVE": 4 }, "indicator_count": 23916, "is_author": false, "is_subscribing": null, "subscriber_count": 79, "modified_text": "116 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "654c34e7efa40976a9dd655b", "name": "SOC2023", "description": "", "modified": "2025-08-17T17:03:38.868000", "created": "2023-11-09T01:24:55.160000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65491efbfc3d9479076431bb", "export_count": 36, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1714, "FileHash-MD5": 3448, "URL": 727, "hostname": 912, "FileHash-SHA256": 4539, "FileHash-SHA1": 2696, "IPv4": 276, "CIDR": 10, "email": 28 }, "indicator_count": 14350, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "245 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67a2d8c675e61c24e3fffd05", "name": "Tracing the Path From SmartApeSG to NetSupport RAT", "description": "\u6b21\u8c03\u67e5\u8ffd\u8e2a\u4e86 SmartApeSG \u5047\u66f4\u65b0\uff08FakeUpdate\uff09\u6076\u610f\u8f6f\u4ef6\u6d3b\u52a8\uff0c\u8be5\u6d3b\u52a8\u5411\u53d7\u5bb3\u8005\u6295\u653e NetSupport RAT \u8fdc\u7a0b\u8bbf\u95ee\u6728\u9a6c\u3002\u901a\u8fc7\u4e92\u8054\u7f51\u9065\u6d4b\u5206\u6790\uff0c\u7814\u7a76\u4eba\u5458\u53d1\u73b0 SmartApeSG\u3001NetSupport RAT\u3001Quasar RAT \u53ca\u52a0\u5bc6\u8d27\u5e01\u76f8\u5173\u7684\u7f51\u7edc\u72af\u7f6a\u6d3b\u52a8 \u4e4b\u95f4\u5b58\u5728\u5173\u8054\u3002\u8c03\u67e5\u63ed\u793a\u4e86 \u5171\u4eab\u7684 C2 \u57fa\u7840\u8bbe\u65bd\u3001\u7ba1\u7406\u4e3b\u673a\u7684\u91cd\u53e0\u4ee5\u53ca\u4e0d\u540c\u6076\u610f\u8f6f\u4ef6\u96c6\u7fa4\u4e4b\u95f4\u7684\u4ea4\u4e92\u3002\u5c3d\u7ba1\u90e8\u5206\u6076\u610f\u670d\u52a1\u5668\u5df2\u88ab\u62a5\u544a\u5e76\u4e0b\u7ebf\uff0c\u653b\u51fb\u8005\u8fc5\u901f\u8fc1\u79fb\u81f3\u65b0\u7684\u57df\u540d\u548c IP \u4ee5\u7ee7\u7eed\u5176\u6d3b\u52a8\u3002\u672c\u7814\u7a76\u5f3a\u8c03\u4e86\u7f51\u7edc\u5a01\u80c1\u884c\u4e3a\u8005\u7684\u6301\u7eed\u6027\uff0c\u5e76\u547c\u5401\u5b89\u5168\u56e2\u961f\u4e0d\u65ad\u76d1\u6d4b\u548c\u91cd\u65b0\u8bc4\u4f30\u57fa\u7840\u8bbe\u65bd\u6307\u6807\uff0c\u4ee5\u5e94\u5bf9\u4e0d\u65ad\u53d8\u5316\u7684\u5a01\u80c1\u3002", "modified": "2025-03-06T03:02:53.532000", "created": "2025-02-05T03:19:34.823000", "tags": [ "cryptocurrency", "moldovan ips", "pivoting analysis", "socgholish", "netsupport rat", "c2 infrastructure", "quasar rat", "fakeupdate", "landupdate808", "ispmanager", "smartapesg", "clearfake", "lycantrox" ], "references": [ "https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat" ], "public": 1, "adversary": "", "targeted_countries": [ "Moldova, Republic of", "Russian Federation" ], "malware_families": [ { "id": "SmartApeSG", "display_name": "SmartApeSG", "target": null }, { "id": "NetSupport RAT", "display_name": "NetSupport RAT", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "SocGholish", "display_name": "SocGholish", "target": null }, { "id": "LandUpdate808", "display_name": "LandUpdate808", "target": null }, { "id": "ClearFake", "display_name": "ClearFake", "target": null }, { "id": "Lycantrox", "display_name": "Lycantrox", "target": null } ], "attack_ids": [ { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "display_name": "T1190 - Exploit Public-Facing Application" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1136", "name": "Create Account", "display_name": "T1136 - Create Account" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1584.001", "name": "Domains", "display_name": "T1584.001 - Domains" } ], "industries": [], "TLP": "white", "cloned_from": "67a182dc6ac40eb6a70b9d76", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "celestre", "id": "295357", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 50 }, "indicator_count": 50, "is_author": false, "is_subscribing": null, "subscriber_count": 119, "modified_text": "409 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67a9938d5891942bf2005ac7", "name": "Uncovering Cyber Threat Networks", "description": "", "modified": "2025-03-06T03:02:53.532000", "created": "2025-02-10T05:50:05.107000", "tags": [ "cryptocurrency", "moldovan ips", "pivoting analysis", "socgholish", "netsupport rat", "c2 infrastructure", "quasar rat", "fakeupdate", "landupdate808", "ispmanager", "smartapesg", "clearfake", "lycantrox" ], "references": [ "https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat" ], "public": 1, "adversary": "", "targeted_countries": [ "Moldova, Republic of", "Russian Federation" ], "malware_families": [ { "id": "SmartApeSG", "display_name": "SmartApeSG", "target": null }, { "id": "NetSupport RAT", "display_name": "NetSupport RAT", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "SocGholish", "display_name": "SocGholish", "target": null }, { "id": "LandUpdate808", "display_name": "LandUpdate808", "target": null }, { "id": "ClearFake", "display_name": "ClearFake", "target": null }, { "id": "Lycantrox", "display_name": "Lycantrox", "target": null } ], "attack_ids": [ { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "display_name": "T1190 - Exploit Public-Facing Application" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1136", "name": "Create Account", "display_name": "T1136 - Create Account" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1584.001", "name": "Domains", "display_name": "T1584.001 - Domains" } ], "industries": [], "TLP": "white", "cloned_from": "67a9862e0e4a02485d03c730", "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 50 }, "indicator_count": 50, "is_author": false, "is_subscribing": null, "subscriber_count": 263, "modified_text": "409 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67a9862e0e4a02485d03c730", "name": "Uncovering Cyber Threat Networks: SmartApeSG & NetSupport RAT", "description": "", "modified": "2025-03-06T03:02:53.532000", "created": "2025-02-10T04:53:02.006000", "tags": [ "cryptocurrency", "moldovan ips", "pivoting analysis", "socgholish", "netsupport rat", "c2 infrastructure", "quasar rat", "fakeupdate", "landupdate808", "ispmanager", "smartapesg", "clearfake", "lycantrox" ], "references": [ "https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat" ], "public": 1, "adversary": "", "targeted_countries": [ "Moldova, Republic of", "Russian Federation" ], "malware_families": [ { "id": "SmartApeSG", "display_name": "SmartApeSG", "target": null }, { "id": "NetSupport RAT", "display_name": "NetSupport RAT", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "SocGholish", "display_name": "SocGholish", "target": null }, { "id": "LandUpdate808", "display_name": "LandUpdate808", "target": null }, { "id": "ClearFake", "display_name": "ClearFake", "target": null }, { "id": "Lycantrox", "display_name": "Lycantrox", "target": null } ], "attack_ids": [ { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "display_name": "T1190 - Exploit Public-Facing Application" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1136", "name": "Create Account", "display_name": "T1136 - Create Account" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1584.001", "name": "Domains", "display_name": "T1584.001 - Domains" } ], "industries": [], "TLP": "white", "cloned_from": "67a182dc6ac40eb6a70b9d76", "export_count": 5845, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 50 }, "indicator_count": 50, "is_author": false, "is_subscribing": null, "subscriber_count": 263, "modified_text": "409 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "679c246da161670e959a9eec", "name": "2024-blocking-soc-ene25", "description": "", "modified": "2025-02-15T00:01:08.338000", "created": "2025-01-31T01:16:29.608000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6675c61d2a8e4554b9985027", "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2045, "FileHash-MD5": 4426, "URL": 1463, "hostname": 1231, "FileHash-SHA256": 5892, "FileHash-SHA1": 3625, "IPv4": 189, "CIDR": 6, "email": 163 }, "indicator_count": 19040, "is_author": false, "is_subscribing": null, "subscriber_count": 84, "modified_text": "428 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "679c246c8bf7850b5096828e", "name": "2024-blocking-soc-ene25", "description": "", "modified": "2025-02-15T00:01:08.338000", "created": "2025-01-31T01:16:28.004000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6675c61d2a8e4554b9985027", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BLOCKINGBLOCK", "id": "211480", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_211480/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2045, "FileHash-MD5": 4426, "URL": 1463, "hostname": 1231, "FileHash-SHA256": 5892, "FileHash-SHA1": 3625, "IPv4": 189, "CIDR": 6, "email": 163 }, "indicator_count": 19040, "is_author": false, "is_subscribing": null, "subscriber_count": 84, "modified_text": "428 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "exploit.im", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "exploit.im", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1776639661.166273 }