{ "type": "Domain", "indicator": "f.read", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/f.read", "alexa": "http://www.alexa.com/siteinfo/f.read", "indicator": "f.read", "type": "domain", "type_title": "Domain", "validation": [ { "source": "domain_tld", "message": "Whitelisted TLD: read", "name": "Whitelisted TLD" } ], "base_indicator": { "id": 199528202, "indicator": "f.read", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "6879093e8658df9f35683846", "name": "Worm:Win32/Benjamin continues to impact network", "description": "Worm:Win32/Benjamin continues to impact network operations of a little known, limited national cybers space organization. P2P-Worm.\n*IDS Detections: \n\u2022 Win32.Worm.Benjamin.A CnC Checkin Alerts\n\u2022 nids_malware_alert\n\u2022 network_icmp\n\u2022 network_irc\n\u2022 persistence_autorun\n| Multiple network issues from outages, stolen password keychains, credentials dumping, impressive espionage attacks. Likely goes unnoticed to many. Widely regarded/reported as an outage that is really an unpatched, ongoing cyber attack.", "modified": "2025-08-16T14:00:26.166000", "created": "2025-07-17T14:31:26.824000", "tags": [ "include review", "data upload", "extraction", "read c", "search", "medium", "show", "msie", "windows nt", "wow64", "slcc2", "media center", "entries", "dock", "write", "execution", "capture", "next", "copy", "date", "aaaa", "present may", "present nov", "passive dns", "ip address", "domain", "status", "next associated", "delete", "iocs", "failed", "sc data", "type", "extr data", "included", "review iocs", "memcommit", "user execution", "module load", "t1129", "icmp traffic", "high", "collection", "cmd c", "t1055", "enter", "extract", "enter sc", "drop or", "browse t", "oprop", "extraction data", "enter source", "url or", "texorag", "browse", "urls", "dnssec", "hostname add", "pulse pulses", "files", "files ip", "domainadmin", "showing", "ttl value", "thumbprint", "onlv", "find", "extri data", "dran anu", "extr", "manually add", "review exclude", "sugges", "find s", "typ hos", "se data", "include data", "review locs", "exclude", "suggested es", "intel", "ms windows", "write c", "pe32", "pe32 executable", "copy c", "worm", "win32", "benjamin", "june", "delphi", "malware", "nids", "icmp delphi", "yara detections", "malware traffic", "checkin", "code", "name servers", "servers", "pulses", "expiration date", "united", "body", "cookie", "related tags", "file type", "pe packer", "pm size", "sha1 sha256", "imphash pehash", "virustotal api", "screenshots", "comments" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 50, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 536, "FileHash-SHA1": 465, "FileHash-SHA256": 1836, "domain": 766, "hostname": 960, "URL": 2879, "CVE": 1, "email": 4 }, "indicator_count": 7447, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "289 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67f5555b6ce863d998e83e26", "name": "macOS Threat Infrastructure Leveraging Remote Agents via remotewd.com and rtmsprod.net", "description": "This pulse identifies an actively observed macOS-focused remote access infrastructure abusing trusted native Apple agents (ARDAgent.app, SSMenuAgent.app) and communicating with a distributed network of C2-like endpoints under domains such as remotewd.com, idsremoteurlconnectionagent.app, and rtmsprod.net.\n\nThe infrastructure is composed of dynamically generated subdomains \u2014 many in the form of device-.remotewd.com \u2014 indicative of automated deployment, system tracking, or per-host remote access configurations.\n\nAdditional indicators include HTTP/S URLs pointing directly to embedded binary paths within macOS agents, suggesting possible delivery vectors, staging, or persistence techniques.\n\nThis campaign shows signs of structured, programmatic targeting and is highly likely to be pre-operational infrastructure for wide-scale surveillance or access operations. All listed indicators should be considered high-risk. If observed in your environment, initiate a full forensic and IR process immediately.", "modified": "2025-05-11T19:03:59.885000", "created": "2025-04-08T16:56:59.641000", "tags": [ "generated from", "do not", "edit uri", "urls", "edit", "rewriteengine", "rewritecond", "rewriterule", "r301", "xml2encalias", "beralloct", "berbvarrayadd", "berbvarrayfree", "berbvdup", "berbvecadd", "berbvecfree", "berbvfree", "berdump", "berdup", "berdupbv", "laerrordomain", "laerrornoncekey", "lamechanismtree", "lacontext", "ladomainstate", "laenvironment", "lanotification", "laprivatekey", "lapublickey", "laright", "apple swift", "o librarylevel", "combine import", "foundation", "swift import", "mcpeerid", "mcsession", "property", "copyright", "protocol", "class", "bonjour", "ascii lowercase", "abc company", "section", "bonjour txt", "note", "ui element", "utf8 encoding", "nscopying", "nsdictionary", "nsstring", "mcextern", "attribute", "mcextern extern", "mcexternweak", "nsenum", "nsinteger", "mcerrorcode", "mcerrorunknown", "mcerrortimedout", "peer", "example", "bonjour apis", "stop", "tags", "session", "nsprogress", "nserror", "nsurl", "nsarray", "create", "nsuinteger", "notifies", "mcsession api", "interface", "dbictrace", "dbivporth", "dbictracelevel", "dbdtffoo", "dbihseterrchar", "dbicstate", "dbictraceflags", "provides macros", "dbi release", "only", "sqlsuccess", "odbc", "sqlok", "tim bunce", "england", "sql cli", "sql datatype", "sqlguid", "sqlwlongvarchar", "main", "beware", "sv sth", "sv dbh", "impsth", "impdbh", "sv keysv", "sv params", "sv attr", "sv attribs", "sv drh", "void", "fri jul", "mixed", "dbixsrevision", "plsvundef", "license", "spagain", "perlioprintf", "dbiclogpio", "putback", "ireland", "gnu general", "super", "magic", "dbicflags", "dbis", "svrv", "null", "imp2com", "dbicactivekids", "dbicfiadestroy", "sv h", "dbicdbistate", "code", "copy", "refer", "trace", "error", "unknown", "hookopcheckh", "startexternc", "hookopcheckcb", "userdata", "endexternc", "isinternalbuild", "kickmcxdforuid", "loadappkit", "ardconfig", "authenticator", "dsauthenticator", "dsnode", "dsrecord", "group", "hostconfig", "apfsvolumelock", "apfsvolumerole", "aoskgetosinfo", "aoskgetuserinfo", "aosaddappleid", "aosdisablepcs", "aosenablepcs", "aoslog", "aoslogforce", "aosrelaycookie", "didfailcallback", "kaosaccountkey", "kapcsbundle", "kapcspath", "kjsonextension", "apcsbucketid", "apcsreports", "apconfiguration", "apversiondata", "apversionhelper", "systemvolumesvm", "name size", "identifier", "gb disk0s3", "devdisk3", "apfs container", "scheme", "physical store", "macintosh hd", "apfs snapshot", "preboot", "refs address", "size wired", "name", "version", "uuid", "linked against", "renderer", "helper", "chrome helper", "contains", "cloud ui", "macintosh", "khtml", "gecko", "ui helper", "plugin", "service", "good", "battery power", "apfs encryption", "jumpcloud go", "chrome web", "store", "privacy badger", "flowcrypt", "encrypt gmail", "simple", "google", "b2b phone", "number", "apollo", "future", "exccrash", "sigkill", "code signature", "invalid", "sigabrt", "protonvpn", "excguard", "excbreakpoint", "sigtrap", "excbadaccess", "appl", "english", "adobe crash", "adobe", "acrobat dcadobe", "processor", "uninstaller", "assistant", "install", "cloud", "dock", "calendar", "music", "terminal", "tips", "installer", "updater", "proton", "tools", "stub", "python", "clock", "powershell", "team", "rave scout", "cookies", "public folder", "key cert", "sign", "crl sign", "root ca", "authority", "public primary", "global root", "verisign", "academic", "premium", "adaptive", "interactive", "background", "standard", "launchd sandbox", "s mdworker", "agent", "command line", "progress", "yubico", "macos13action", "disableoverride", "disableairdrop", "denyactivation", "enable", "loginwindowtext", "jumpcloud", "autoupdate", "loggingoption", "enablefirewall", "arm64e", "apple m2", "mac142", "kjqqtw7pqt", "daemon", "server", "open directory", "user", "account", "kerberos admin", "kerberos change", "device daemon", "network", "desktop", "screensaver", "bridge", "aesxtsarm", "aesecbarm", "sha512vngarmhw", "sha384vngarmhw", "sha256vngarm", "sha1vngarm", "darwin kernel", "wed mar", "wkarraycreate", "wkbooleancreate", "wkcontextcreate", "wkdatacreate", "wkdatagettypeid", "wkdoublecreate", "wkframecopyurl", "wkgettypeid", "wkimagecreate", "wkpagecandelete", "webview", "notice", "this software", "including", "but not", "limited to", "redistribution", "is provided", "by apple", "direct", "damage", "apiavailable", "webkit", "nsswiftname", "document", "a block", "as is", "hasinclude", "wkdownload", "abstract", "wkerrorcode", "wkerrorunknown", "discussion", "bool", "whether", "wkcontentworld", "wkwebview", "javascript", "nsunavailable", "vaargs", "nsswiftasync", "wkswiftasync", "wkcookiepolicy", "wkswiftuiactor", "nshttpcookie", "targetosiphone", "wknavigation", "decides", "boolean value", "apideprecated", "methodkind", "wkerrordomain", "wkscriptmessage", "promise", "fulfill", "const", "url scheme", "mark", "wkuserscript", "targetosvision", "param", "wkframeinfo", "targetosios", "pass", "window", "mime type", "link", "nsimage", "returns", "nsset", "checks", "matches", "a boolean", "defaults", "wkwebextension", "cgsize", "uiimage", "apis", "nsdate", "wkcontentmode", "wkextern", "possible", "cgfloat", "media", "cgrect", "apiunavailable", "framework", "nsswiftuiactor", "targetoswatch", "confirms", "apple upgrade", "nsstring user", "nsobject", "provider", "apple", "password", "uicontrol", "nscontrol", "asuseragerange", "check", "opaque user", "apple id", "initiate", "asauthorization", "operation", "state", "nserrorenum", "nsdata", "relying party", "asapiavailable", "perform", "realm", "http response", "authorization", "http", "oauth", "saml", "a byte", "nsdata userid", "relying", "a string", "nsdata readdata", "bool didwrite", "a cose", "nsdata first", "nsdata second", "nsstring name", "bool appid", "targetosxr", "nsstring appid", "bluetooth", "mdm profile", "nsurl url", "returns yes", "a state", "a json", "web token", "private seckeys", "enables", "keychain", "asswiftsendable", "cose algorithm", "ecdsa", "sha256", "cose curve", "p256", "nullable", "bool success", "remove", "call", "complete", "initializes", "time code", "extensions", "asextern extern", "asextern", "nsswiftsendable", "prepare", "list", "nsextension", "attempt", "nsstring label", "creates", "nsstring code", "a key", "webauthn", "nssecurecoding", "input", "output", "initialize", "nsinteger rank", "json", "inputs", "hash", "nsstring origin", "settings app", "extension", "https urls", "safari", "cancel", "nsuuid uuid", "r uftpexu", "nsmutabledata", "vnsdate", "mprcjy", "postfix", "domain", "canonical", "tables", "ldap", "post", "replace user", "address", "wietse venema", "bugs", "mail", "aliases", "postfix version", "restrict", "sample", "person", "basic system", "general", "reject empty", "postfix smtp", "ipv6 host", "reject", "reply", "access", "prior", "hold", "info", "mail delivery", "charset", "system", "report", "postfix dsn", "mail returned", "this", "generic", "smtp", "isp mail", "mime", "headerchecks", "readme files", "filters while", "posix", "empty", "body", "write", "date", "smtp server", "specify", "mx host", "unix password", "user unknown", "pathbin", "postfix queue", "unix", "cyrus", "path", "uucp", "shell", "local", "program", "agreement", "contributor", "recipient", "contribution", "the program", "corporation", "contributors", "product x", "as expressly", "arch", "arch x8664", "pipe wall", "wimplicit", "ranlib", "warn", "switch", "start", "systype", "outlook", "postfix master", "begin", "server admin", "mail backend", "modern smtp", "iana", "many", "postfix pipe", "recent cyrus", "amos gouaux", "old example", "or even", "lutz jaenicke", "technology", "cottbus", "germany", "openssl package", "openssl project", "europe", "remember that", "use of", "file", "update", "usrsbin", "file format", "no group", "daemondirectory", "deliver mail", "transport", "description", "result format", "virtual", "virtual alias", "redirect mail", "relocated", "matches user", "synopsis", "lastname", "firstname", "apple computer", "tcpip", "supported", "quantum", "facility", "level", "level info", "broadcast", "ignore", "rules", "sender", "automounter map", "use directory", "get home", "home autohome", "true", "t option", "mount", "force", "environment", "automountdenv", "promptcommand", "shellsessiondir", "histfile", "histfilesize", "myvar", "histtimeformat", "arrange", "bashrematch", "tell", "ps1h", "make bash", "s checkwinsize", "etcbashrc", "termprogram", "inpck", "nnnbaud", "berkeley", "parity", "pc entry", "pass8", "parenb istrip", "fixed speed", "entry", "clocal mode", "maxhistsize", "promptmode", "verbose end", "etcirbrcloaded", "default", "setup", "history file", "kernel", "readline", "jabber", "group database", "dovecot", "postfix scsd", "networkd", "searchpaths", "freebsd", "tmpdir", "fcodes", "prunepaths", "vartmp", "prunedirs", "filesystems", "nroff", "manpath", "uncomment", "manpager", "whatispager", "manlocale", "every", "manpath optman", "maybe", "troff", "status mailfrom", "returnpath via", "pidfile", "flags", "bcgjnuwz", "bin usrsbin", "sbin", "default pf", "care", "audio", "user database", "unix copy", "gate daemon", "bashno", "r etcbashrc", "rfc1323", "m1460", "macos x", "signature", "linux", "opera", "xp sp1", "windows sp1", "nmap syn", "m265", "synack", "mind", "macos", "warp", "ipv6", "internet", "icmp", "cisco", "monitoring", "argus", "chaos", "rsvp", "encapsulation", "aris", "isis", "netbootmount", "netbootshadow", "computername", "localonly", "localnetbootdir", "netboot", "define", "purpose", "networkonly", "waiting", "networkup", "term", "devnull", "common setup", "configure", "set command", "dns hostname", "dns query", "see also", "kame", "sunnet manager", "rpcsrc", "netlicense", "ftpd", "bindash binksh", "binsh bintcsh", "jumpcloud ldap", "smb2", "security", "workgroup", "standalone", "samba server", "enforce", "smb3", "example share", "improper use", "ctrlc", "none", "fax reception", "hardwired", "0007", "must", "visudo", "blocksize", "charset lang", "language lcall", "lines columns", "lscolors", "sshauthsock", "orion", "setup user", "home", "zdotdir", "delete", "beep", "vendor", "kf10", "kf11", "kf12", "kf13", "backspace", "insert", "resume", "termsessionid", "savehist", "sharehistory", "h do", "volume", "de l", "l uuid", "m tra", "n est", "suuid", "prfen", "fusion", "syst", "look", "executant", "alla", "over", "test", "overie", "zapis", "rapid", "disco usa", "de macos", "nie s", "i denne", "adgjmpsvx", "diskgthis disk", "01k8x j", "34disk", "levy kytt", "dict", "array", "plist", "apple root", "code signing", "inode64r", "xofkoxzh", "integer", "doctype", "brain", "abcd", "ogwo", "boaw", "cobwa", "uhawavauatsh", "ip bitmap", "foewdc", "could", "ip block", "funcs", "cogwo", "trash", "double", "hunt", "affa", "carr", "crypto", "docwbac", "q1b0", "q1 0", "h h5", "docwbag", "slice", "format", "zero", "alfa", "hera", "lelei", "hehe", "hisp", "fail", "katy", "zakk", "eodwcbgao", "hhk8di", "alma", "topo", "open", "huhk", "piper", "hehx", "eh ui", "h20hph", "hif h", "hmhhihqhyla hq", "r11b0", "target", "uus10u", "hifh", "loghookfailed", "loghook", "hell", "q1b 0", "f duh", "aqw1", "1160" ], "references": [ "index.html.en", "bind.html", "caching.html", "BUILDING", "configuring.html", "content-negotiation.html", "custom-error.html", "convenience.map", "LDAP.tbd", "lber.h", "ldap.h", "LocalAuthentication.tbd", "arm64e-apple-macos.swiftinterface", "x86_64-apple-ios-macabi.swiftinterface", "arm64e-apple-ios-macabi.swiftinterface", "x86_64-apple-macos.swiftinterface", "MultipeerConnectivity.tbd", "module.modulemap", "MCNearbyServiceAdvertiser.h", "MCPeerID.h", "MCError.h", "MCNearbyServiceBrowser.h", "MCAdvertiserAssistant.h", "MultipeerConnectivity.apinotes", "MultipeerConnectivity.h", "MCSession.h", "MCBrowserViewController.h", "dbivport.h", "dbi_sql.h", "dbd_xsh.h", "dbixs_rev.h", "Driver_xst.h", "DBIXS.h", "hook_op_check.h", "Admin.tbd", "AirPlayReceiver.tbd", "apfs_boot_mount.tbd", "AOSKit.tbd", "APConfigurationSystem.tbd", "AppleFirmwareUpdate.tbd", "launchdaemons.txt", "preboot_archive_errors.log", "mounts.txt", "launchagents.txt", "disk_structure.txt", "user_launchagents.txt", "security_status.txt", "kexts.txt", "process_list.txt", "battery.csv", "diskEncryption.csv", "chromeExtensions.csv", "crashes.csv", "interfaceAddrs.csv", "kernel.csv", "interfaceDetails.csv", "etcHosts.csv", "applications.csv", "mounts.csv", "sharedFolders.csv", "certificates.csv", "sharingPreferences.csv", "launchD.csv", "usbDevices.csv", "managedPolicies.csv", "systemInfo.csv", "users.csv", "sipConfig.csv", "systemControls.csv", "canonical", "aliases", "custom_header_checks", "access", "bounce.cf.default", "generic", "header_checks", "main.cf.default", "LICENSE", "makedefs.out", "main.cf", "master.cf.default", "main.cf.proto", "master.cf.proto", "master.cf", "TLS_LICENSE", "postfix-files", "transport", "virtual", "relocated", "afpovertcp.cfg", "asl.conf", "auto_home", "auto_master", "autofs.conf", "bashrc_Apple_Terminal", "com.apple.screensharing.agent.launchd", "bashrc", "command_args.json", "csh.cshrc", "csh.login", "find.codes", "csh.logout", "ftpusers", "gettytab", "irbrc", "kern_loader.conf", "group", "locate.rc", "man.conf", "mail.rc", "manpaths", "networks", "nfs.conf", "newsyslog.conf", "ntp_opendirectory.conf", "ntp.conf", "notify.conf", "paths", "pf.conf", "passwd", "profile", "pf.os", "protocols", "rc.netboot", "rc.common", "rmtab", "resolv.conf", "rtadvd.conf", "rpc", "shells", "smb.conf", "sudo_lecture", "ttys", "syslog.conf", "xtab", "sudoers", "zprofile", "zshrc", "zshrc_Apple_Terminal", "CodeResources", "version.plist", "Info.plist" ], "public": 1, "adversary": "DragonForce Malaysia Hacker Group", "targeted_countries": [], "malware_families": [ { "id": "Lastname", "display_name": "Lastname", "target": null }, { "id": "Firstname", "display_name": "Firstname", "target": null } ], "attack_ids": [ { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 66, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 4449, "domain": 3847, "URL": 14263, "FileHash-SHA256": 2356, "FileHash-MD5": 223, "FileHash-SHA1": 523, "email": 223, "CVE": 40, "CIDR": 12, "SSLCertFingerprint": 302 }, "indicator_count": 26238, "is_author": false, "is_subscribing": null, "subscriber_count": 37, "modified_text": "386 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66f9ae71e7d4851280fa367f", "name": "The Jane Doe Syndrome Files: Credential Dumping and Data Exfiltration", "description": "This pulse outlines a series of techniques (Tactics) utilized in a cyber intrusion targeting Jane Doe's MacBook. These techniques span various stages of the attack lifecycle, including credential dumping (T1003), system discovery (T1016, T1082), and data exfiltration methods (T1114, T1560). The attacker employed advanced obfuscation strategies (T1027) and input capture methods (T1056) to maintain persistence and evade detection, while also utilizing command and scripting interpreters (T1059) to execute malicious commands.\n\nFurthermore, the adversary manipulated system tokens (T1134) and leveraged remote access software (T1219) to control the compromised system. Techniques for data destruction (T1485) and artifact hiding (T1564) indicate a concerted effort to cover tracks and minimize detection.\n\nBy examining these techniques, we can better understand the methods used in this intrusion, facilitating enhanced detection and prevention strategies for future incidents.", "modified": "2024-11-08T00:03:35.782000", "created": "2024-09-29T19:45:53.583000", "tags": [ "autogenerated", "please", "class", "hp laserjet", "duplexer", "modify", "printer", "description", "location", "share", "printer make", "ppd file", "model", "driver", "ipp everywhere", "printers", "hardware", "baud rate", "parity", "odd data", "flow control", "software", "rtscts", "dtrdsr", "input", "type", "name", "value", "hidden", "delete class", "form", "h2 class", "warning", "p align", "allow", "advanced", "use kerberos", "save", "max clients", "maximum", "metadata", "documents", "max log", "img src", "width", "height", "align", "absmiddle", "indicator", "status", "printername", "idle", "edit", "cupsdconf", "error", "blockquote", "unknown", "h3 class", "jobs", "help jobs", "helptitle", "qtext", "topic", "bmtext", "qptext", "cups", "search", "online help", "documents all", "hold job", "server default", "shared", "test page", "pause class", "accept jobs", "move all", "jobs cancel", "all jobs", "class delete", "cancel", "move job", "destination", "release", "reprint", "action", "method", "name user", "size pages", "state control", "jobid", "withheld", "held", "change settings", "label", "input type", "select name", "multiple size", "option", "inches feet", "table", "submit", "set default", "prev", "next", "last", "accept", "options", "default", "delete printer", "form action", "pause", "reject", "resume", "print", "self test", "pause printer", "location make", "model status", "test", "please stand", "allowed users", "prevent", "whichjobs", "standard rom", "standard", "copyright", "standard font", "cups ppd", "easy software", "apache license", "license", "symbol special", "deskjet", "cups sample", "hplaserjet", "laserjet", "hpdeskjet", "hpdeskjet2", "epson", "stylus color", "stylus photo", "escp", "epson9pin", "zebra", "dymo3x0", "dymo", "labelwriter", "advance", "leading", "move", "black", "gold", "rotate", "never", "cyan", "yellow", "turn", "long edge", "edge", "oversize", "address", "b1jis b1", "adobe", "small", "image", "apple mime", "xhtml", "pict string", "cgimageio", "radiance", "fujifilm", "preview", "os x", "colorsync", "airprint", "do not", "this file", "it is", "you install", "versions of", "base mime", "format", "postscript", "language", "pattern match", "ras2", "pwgraster", "comment", "attr", "group", "attr language", "attr integer", "attr name", "attributes", "attr keyword", "post", "resource admin", "operation", "group operation", "create", "withvalue", "display", "d recipienturi", "expect", "tv d", "member", "createjob", "senddocument", "create faxout", "get list", "display jobname", "cupsgetdevices", "get job", "expect jobstate", "job template", "get printer", "cupsgetppd", "cupsgetppds", "get ppd", "attr text", "product", "psversion", "version", "message", "hello", "cupsgetprinters", "beep", "sound", "count", "ingroup", "oftype keyword", "oftype integer", "oftype text", "oftype charset", "oftype enum", "az09", "withallvalues", "mediaregex", "oftype", "print file", "printjob", "test printjob", "file", "ippurischeme", "member integer", "print test", "printuri", "post resource", "validatejob", "validate", "printjob group", "repeatmatch", "choice", "envelope", "resolution", "modelname", "inputslot", "pcfilename", "modelnumber", "attribute", "false", "darkness", "media", "generic", "mark", "dark", "tear", "cupsbanner show", "header printer", "footer printer", "notice cups", "header cover", "page footer", "cover page", "header top", "secret footer", "top secret", "header secret", "footer secret", "vzefibootloader", "nsunavailable", "virtualization", "base class", "vzbootloader", "network device", "initialize", "host network", "property", "return", "define", "nsarray", "bsd name", "ethernet", "vzconsoledevice", "console port", "defines", "a directory", "vzexport extern", "apiavailable", "bool", "nsenum", "nsinteger", "local file", "raw format", "nsurl", "nserror", "file handle", "storage device", "nserror error", "nsfilehandle", "boot loader", "efi rom", "efi boot", "vzerrorcode", "vzerrordomain", "error type", "nserror domain", "vzerrorsave", "nbd server", "nbd client", "nsoptions", "nsuinteger", "nsswiftname", "nvram", "write", "sorcvbuf", "sosndbuf", "mtu value", "data", "data sent", "true", "graphics", "intel", "indicate", "enable", "nsdata", "opaque", "host audio", "host output", "host input", "cgsize", "new display", "protocol", "unix domain", "socket", "rosetta", "caching", "rosetta daemon", "nsstring", "abstract socket", "rosetta support", "linux", "arm64", "availability", "download", "vzmacaddress", "mac address", "a vzmacaddress", "linux kernel", "ram disk", "linux boot", "a mac", "configuration", "mac hardware", "describes", "mac platform", "mac keyboard", "usb keyboard", "mac machine", "apple silicon", "rosetta runtime", "nsobject", "handle", "init", "url property", "whether", "recovery", "block", "nullable", "load", "mac trackpad", "usb pointing", "cpus", "overwrite", "nsdictionary", "directory share", "check", "namemax", "vznetworkdevice", "nbd url", "nbd uniform", "nbd protocol", "url error", "nat attachment", "a network", "nvm express", "nsscreen", "nssize", "serial port", "directory", "spice agent", "spice guest", "a console", "vzsocketdevice", "vzstoragedevice", "vzexport", "usb controller", "vzusbcontroller", "usb device", "device uuid", "nsuuid uuid", "usb mass", "vzusbdevice", "virtio block", "device", "storage storage", "virtio console", "delegate object", "a class", "extra care", "virtio entropy", "nsstring name", "array", "virtio file", "system device", "discussion", "nsstring tag", "port", "bool isconsole", "a virtio", "virtio graphics", "virtio gpu", "virtio", "port array", "utf8", "virtio network", "macaddress", "virtio socket", "close", "does nothing", "virtio sound", "nsarray streams", "pointer", "device input", "a pcm", "audio stream", "source", "sink", "device output", "device stream", "memory balloon", "target memory", "return yes", "start", "stop", "usb xhci", "automatically", "nsview", "virtual machine", "cpucount", "verify", "apple swift", "o librarylevel", "swift", "cachingoptions", "vzaudiodevice", "vzdebugstub", "swiftname", "targetosiphone", "targetososx", "targetosios", "apple computer", "targetostv", "targetosvision", "targetostvos", "targetosxr", "vtbaseh", "vtint32point", "vtint32size", "iphonena", "apiunavailable", "vtexport const", "abstract", "cfstringref", "readwrite", "cfnumber", "cfboolean", "optional", "null", "macos", "cmnullable", "pass null", "call", "video toolbox", "contains", "cmtime duration", "cvimagebuffer", "vterrorsh", "cfoptions", "12914", "uint32", "osstatus", "12900", "12901", "12902", "12903", "17690", "vtexport", "encoder", "zero", "alpha", "requires", "cmsamplebuffer", "prototype", "osstatus status", "cfrelease", "cvpixelbuffer", "iosurface", "hdr metadata", "hdr per", "frame metadata", "cf type", "cfretain", "a mechanism", "cmbridgedtype", "interface", "specifies", "a reference", "pixel rotation", "session", "a pixel", "cf object", "vtframesilo", "returns", "vtframesiloh", "vtframesiloref", "pass", "pixel transfer", "vtexport void", "media extension", "video raw", "processors", "standard video", "metal device", "metal", "rawprocessors", "cfstring", "copy", "vtsessionh", "cfdictionaryref", "apis", "vtsessionref", "raw processor", "a cfdictionary", "cfswiftname", "vtutilitiesh", "cgimage", "builds", "cfarrayref", "raw processing", "list", "list element", "cfdictionaries", "skipper", "vdspdftexecute", "vdspdftexecuted", "vdspdftzop", "vdspfft16copv", "vdspfft16zopv", "vdspfft32copv", "vdspfft32zopv", "vdspbiquad", "vdspbiquadd", "vdspbiquadm", "project version", "created", "elana stettin", "apple", "swextern", "title", "typedef", "param", "nsstring title", "represents", "nsitemprovider", "const", "swhidden extern", "swdefines", "swextern extern", "sha256 hash", "merkle tree", "sociallayer", "swperson", "devin clary", "swaction", "sbappcontext", "sbapplocator", "sbapplication", "sbelementarray", "sbobject", "scriptingbridge", "objecttype", "finder", "bridge", "index", "apple event", "target", "urls", "locator", "scripting", "desctype", "receiver", "track", "code", "sccontentfilter", "bgra format", "rgha format", "const nonnull", "nserrorenum", "nsurl outputurl", "avfiletypempeg4", "provides", "scwindow", "scdisplay", "cgrect frame", "bool indicating", "pixel", "scstream", "control center", "takes", "cfdictionary", "rbhash", "initvmrandom", "initvmtranscode", "initarray", "initbarevm", "initbignum", "initcomplex", "initcont", "initdir", "initfile", "libxml", "require", "cfpropertylist", "xml parser", "libxmlparser", "xml file", "plist", "cfplisterror", "exception", "format error", "easy", "kruse", "mit license", "standarderror", "cfformaterror", "cftypeerror", "nokogiri", "parserinterface", "cftype", "cfdate", "cfinteger", "blob", "ruby string", "uidfixnum", "ruby integer", "date", "format constant", "formatbinary", "formatxml", "magicnumber", "enumerator", "cfdata", "ruby", "example", "john", "path", "plainparser", "ascii", "cfreal", "importplain", "escapechar", "read", "length", "utf16be", "cfarray", "offsetsize", "integer", "rexml", "rexmlparser", "float", "appledtd plist", "dom node", "prefix", "config", "item", "bindir", "libruby", "rubypath", "fileoperations", "arch", "installer", "template", "install", "major", "yesno", "todo", "kwargs", "makefiles", "miniportile", "cmakecmd", "configure", "cmakefile", "cmake", "keyringname", "debug", "targetos", "ldflags", "gpgexe", "digest", "stdout", "patch", "installerror", "savefile", "task", "packages", "dlext", "minero aoki", "rubyversion", "loaderror", "sqlite3", "was sqlite3", "apiobjects", "database", "pragmas", "resultset", "sqlite3ruby faq", "sqliteruby faq", "value klass", "qnil", "sqliteok", "sqliteerror", "sqliteinternal", "sqliteperm", "sqliteabort", "sqlitebusy", "sqlitelocked", "datagetstruct", "int2num", "main", "done", "stringvalueptr", "note", "sqlite3ruby", "sqlite3rubyptr", "unused", "gnuc", "lclint", "usasciip", "utf8p", "utf16lep", "utf16le", "utf16bep", "sqlite3stmtruby", "rubyplatform", "darwin", "rcarchs", "libpkgconfig", "pkgconfigpath", "pkgconf", "mswin", "cflags", "install sqlite3", "int2fix", "rbignumlen", "sizeofbdigits", "charbit", "bdigit", "bmax", "value unused", "sqliteopenuri", "open", "requireopendb", "nilp", "qtrue", "id2sym", "requireopenstmt", "donep", "rstringlen", "num2int", "attrs", "deal", "xsd module", "xmlparser", "nokogiri xml", "simply", "rubyengine", "slop decorator", "css3 selector", "xpath", "nokogiri class", "parse", "html", "xml document", "0x30", "0x41", "0x61", "gumbogentable", "gumboasciicntrl", "gumboasciispace", "gumboasciidigit", "constfn", "gumboasciih", "gumboasciialpha", "gumboasciialnum", "c0 control", "gumbocharrefh", "gumboattributeh", "gumboattribute", "craig barnes", "google inc", "as is", "basis", "or conditions", "any kind", "gumboerrorh", "gumbotag", "additional", "gumbovector", "encoding", "gumboerrparser", "gumboerrortype", "html tag", "minwordlength", "maxwordlength", "maxhashvalue", "ansic code", "m100 n", "computed", "totalkeywords", "minhashvalue", "doctype", "capacity", "doctype system", "sourcelength", "sourcetext", "silence", "html5", "a struct", "text", "gumbo", "gumboh", "anything", "gumboparserh", "output", "library", "oopstyle", "gumboparser", "const localname", "string", "ietfdtd html", "w3cdtd html", "level", "html strict", "terminator", "final", "buffer", "gnucatleast", "hasattribute", "macrosh", "printf", "returnsnonnull", "win32", "unusedifndebug", "malloc", "pure", "m100", "gumbotaglookuph", "gumbotag tag", "taghashslot", "gumbotagunknown", "gumbotokentypeh", "gumbotokencdata", "gumbotokennull", "gumbotokeneof", "gumbotokentype", "gumbotaglast", "position", "gumbotokenizerh", "struct", "gumbotoken", "spec", "stack", "emittoken", "continue", "current", "utf8iterator", "utf8accept", "parser", "html5 spec", "rest", "gumboutf8h", "unicode code", "html5 parser", "utf8 decoding", "func", "gumbodebug", "gumboutilh", "utility", "debug wrapper", "script", "attribute value", "comment end", "doctype name", "cdata section", "rcdata end", "rawtext end", "initialcapacity", "gumboalloc", "vector", "memmove", "gumbovectorh", "initializes", "ownership", "stringvaluecstr", "rtest", "xmlchar", "html document", "nokogiristrnew2", "html4", "value get", "qfalse", "a list", "value list", "attrsdepr", "attrsopt", "chunk", "pushparser", "xmlsax", "value chunk", "w3c dom", "xmlelementnode", "finds", "qundef", "value val", "value args", "value exc", "libxml2patches", "rbconfig", "packagerootdir", "cppflags", "libs", "dldflags", "nokogiri test", "attributedecl", "defaultvalue", "atype", "tree", "ctxt", "noreturn", "xmldocptr doc", "private", "nokogirinative", "nokogiristrnew", "xmldoc", "value setvalue", "value content", "xmlchar value", "xmlnode cur", "content", "cdata", "cdata element", "value argv", "value rbnode", "document", "value document", "value getname", "pcdata", "element", "mult", "datawrapstruct", "value ctxtval", "mydoc", "userdata", "encodinghandler", "value key", "delete", "elementdecl", "id iddocument", "etype", "value prefix", "orig", "externalid", "systemid", "nodenr", "xmlnodeset", "nodeset", "nodetab", "xmldtd", "value hash", "publicid", "notation", "hash", "rbfuncall", "parseargs", "xmlnode", "without", "href", "xmlns", "namespace node", "nodes", "value rbreader", "relaxng schema", "relaxng", "value name", "nokogirisaxself", "rbivget", "rbstrorqnil", "xmlchar name", "xmlparserctxt", "text element", "value string", "schema", "xmlschema", "context", "stringval", "wrapper", "emp0001n", "emp0002n", "xslt", "handler", "handlerstate", "checktype", "tarray", "id documentid", "comment element", "node", "first", "prop", "typeerror", "gc", "pkpublicchannel", "pkpushpayload", "pkpushregistry", "pkpushtypevoip", "pushkit", "object", "pkpushtype type", "forward", "http", "apple push", "pkexport extern", "nsstringenum", "payload data", "voip", "json format", "callkit", "pkpushtype", "framework", "apps", "push", "odsessioncreate", "odattributemap", "odconfiguration", "odcontext", "odmappings", "odmoduleentry", "odnode", "odquery", "odrecord", "odrecordmap", "nsavailablemac", "original code", "nsstring value", "custom", "modifications", "apple public", "source license", "of any", "nsavailable", "nsrunloop", "objc", "sets", "odsession", "sfauthorization", "will", "odsessionref", "cfexport", "odqueryref", "odnoderef", "cfexport bool", "odrecordref", "cfdataref", "cfexport const", "utf8 encoding", "odattributetype", "odrecordtype", "attribute type", "local", "realm", "cftyperef", "odnodegetdsref", "odnodegettypeid", "odrecorddelete", "odtriggercancel", "odnodeinit", "odquerycreate", "odqueryinit", "odsessioninit", "albuffer3i", "albufferdata", "albufferf", "albufferfv", "albufferi", "albufferiv", "aldistancemodel", "aldopplerfactor", "algetbooleanv", "algetbuffer3f", "alcapi", "alcapientry", "alcboolean", "targetosmac", "alcdevice", "alcenum param", "alalch", "alcchar", "alcsizei", "capture", "alenum param", "alapi", "aluint sid", "alfloat", "aluint bid", "alsizei", "alint", "alfloat value", "alapientry", "aluint", "play", "speed", "bits", "alutapi alvoid", "alvoid data", "alsizei size", "alsizei freq", "gnu library", "general public", "aluth", "alenum format", "openalopenalh", "umbrella header", "alvoid", "openal", "alvoid nonnull", "alenum", "roger beep", "sendable", "preconcurrency", "rawvalue", "network import", "failure", "service", "must", "number", "stride", "brief", "descriptor", "matrix", "mtlpackedfloat3", "infinity", "metalversion", "minimum point", "maximum point", "interpolation", "translation", "offset", "acceleration", "declare", "prior", "insert", "nonnull", "nsrange", "mtldevice", "t argname", "mtlstructtype", "mtlarraytype", "mtltype", "mtlpointertype", "instance", "methodkind", "swiftprivate", "mtlbuffer", "nullability", "mtlcommandqueue", "mtlresource", "mtlresidencyset", "command encoder", "individual", "mtlexport", "xcode", "gpu trace", "apideprecated", "mtlcapturescope", "remarks", "mtlallocation", "metal command", "mtldispatchtype", "mtlorigin", "mtlsize", "mtlblitoption", "flush", "gpu work", "marks", "specify", "mtlinline", "mtlintern", "stdcversion", "mtlextern", "definition", "inline", "nsstring label", "stencil", "defaults", "allocate", "typical", "nsprocessinfo", "mtldrawable", "present", "cftimeinterval", "gpustarttime", "gpuendtime", "mtlcountersh", "mtlcounter", "mtlcounterset", "mtllibrary", "a container", "mtlfence", "mtldatatype", "default usage", "mtlfunction", "mtllogcontainer", "mtlsharedevent", "mtlevent", "synchronously", "a function", "cpu cache", "requiredsize", "behavior", "mtlheap", "query device", "dispatch", "metal shading", "language guide", "raytriangle", "vends", "groups", "encodes", "mtliofilehandle", "mtlextern sizet", "mtlextern void", "mtlstoreaction", "mtlloglevel", "enum", "mtlmutability", "astcetc2bc", "normal", "astc", "clamptoedge", "depth", "mtlcoordinate2d", "nsnumber", "controls", "mtlclearcolor", "adds", "mtlregion", "cpu mapping", "mtltexture", "mtlindextype", "filter option", "clamp", "mtlrenderstages", "draw", "mtlstepfunction", "vertex", "compute", "gpu resource", "nsuinteger x", "identify", "nsuinteger y", "nsuinteger z", "mtlsize size", "mtlvertexformat", "nsuintegermax", "mtlpixelformat", "mtltexturetype", "slice", "swiftui", "coregraphics", "swift import", "previewregistry", "libraryitem", "category", "dict", "apple root", "code signing", "public", "uus10u", "GUANGZHOU FIVE SIX TECHNOLOGY", "Havana Syndrome", "Aishah Lazim", "Al-Arqam", "Brooklyn" ], "references": [ "httpd.exp", "metadata.json", "add-class.tmpl", "choose-make.tmpl", "choose-model.tmpl", "choose-device.tmpl", "add-printer.tmpl", "choose-serial.tmpl", "class-added.tmpl", "choose-uri.tmpl", "class-confirm.tmpl", "admin.tmpl", "class-deleted.tmpl", "class-modified.tmpl", "classes-header.tmpl", "command.tmpl", "classes.tmpl", "edit-config.tmpl", "error-op.tmpl", "class-jobs-header.tmpl", "error.tmpl", "header.tmpl", "help-header.tmpl", "help-printable.tmpl", "help-trailer.tmpl", "job-hold.tmpl", "class.tmpl", "job-cancel.tmpl", "job-move.tmpl", "job-moved.tmpl", "job-release.tmpl", "job-restart.tmpl", "list-available-printers.tmpl", "jobs.tmpl", "norestart.tmpl", "option-boolean.tmpl", "option-header.tmpl", "option-conflict.tmpl", "option-pickmany.tmpl", "option-pickone.tmpl", "modify-printer.tmpl", "option-trailer.tmpl", "pager.tmpl", "printer-cancel-jobs.tmpl", "printer-added.tmpl", "printer-accept.tmpl", "printer-configured.tmpl", "printer-default.tmpl", "printer-confirm.tmpl", "printer-deleted.tmpl", "printer-jobs-header.tmpl", "printer-modified.tmpl", "jobs-header.tmpl", "printer-stop.tmpl", "modify-class.tmpl", "printer-reject.tmpl", "printers-header.tmpl", "printer-start.tmpl", "printer.tmpl", "printers.tmpl", "set-printer-options-trailer.tmpl", "test-page.tmpl", "restart.tmpl", "users.tmpl", "set-printer-options-header.tmpl", "search.tmpl", "trailer.tmpl", "font.defs", "hp.h", "epson.h", "label.h", "raster.defs", "media.defs", "apple.types", "apple.convs", "mime.convs", "mime.types", "cancel-current-job.test", "create-job-sheets.test", "create-job.test", "create-job-format.test", "create-job-timeout.test", "create-printer-subscription.test", "cups-create-local-printer.test", "fax-job.test", "get-completed-jobs.test", "get-devices.test", "get-job-attributes.test", "get-job-attributes2.test", "get-notifications.test", "get-jobs.test", "get-job-template-attributes.test", "get-ppd-printer.test", "get-ppds-drv-only.test", "get-ppd.test", "get-ppds-make-and-model.test", "get-ppds-make.test", "get-ppds-product.test", "get-ppds-psversion.test", "get-ppds-language.test", "get-printer-description-attributes.test", "get-ppds.test", "get-printer-attributes.test", "get-subscriptions.test", "identify-printer-display.test", "get-printers-printer-id.test", "identify-printer-multiple.test", "get-printers.test", "identify-printer.test", "get-printer-attributes-suite.test", "ipp-2.0.test", "ipp-2.2.test", "ipp-backend.test", "ipp-2.1.test", "print-job-and-wait.test", "print-job-deflate.test", "print-job-hold.test", "print-job-gzip.test", "ipp-1.1.test", "print-job-manual.test", "print-job-password.test", "print-job.test", "print-job-media-col.test", "print-uri.test", "print-job-letter.test", "set-attrs-hold.test", "validate-job.test", "ipp-everywhere.test", "sample.drv", "testprint", "classified", "standard", "topsecret", "secret", "confidential", "unclassified", "ntp_opendirectory.conf", "ntp.conf", "notify.conf", "nfs.conf", "nsmb.conf", "xtab", "6015FED9-D723-4332-87D9-C478CF341407.aamdownload", "AuraService-fda-test", "com.adobe.acrobat.rna.AcroCefBrowserLock.DC", "ExmanProcessMutex", "proxy.xml", "A53749AF-3855-4842-A1E7-4AEFA60BD2AC", "XPdb-wal", "VZBootLoader.h", "VZAudioInputStreamSource.h", "VZBridgedNetworkDeviceAttachment.h", "VZAudioOutputStreamSink.h", "VZBridgedNetworkInterface.h", "VZConsoleDeviceConfiguration.h", "VZConsoleDevice.h", "VZConsolePortConfiguration.h", "VZDirectorySharingDevice.h", "VZDirectoryShare.h", "VZDefines.h", "VZDiskImageStorageDeviceAttachment.h", "VZDiskSynchronizationMode.h", "VZDiskBlockDeviceStorageDeviceAttachment.h", "Virtualization.h", "VZDirectorySharingDeviceConfiguration.h", "VZEntropyDeviceConfiguration.h", "VZEFIBootLoader.h", "VZError.h", "VZEFIVariableStore.h", "VZFileHandleNetworkDeviceAttachment.h", "VZFileHandleSerialPortAttachment.h", "VZFileSerialPortAttachment.h", "VZGraphicsDevice.h", "VZGenericPlatformConfiguration.h", "VZGenericMachineIdentifier.h", "VZGraphicsDeviceConfiguration.h", "VZGraphicsDisplayConfiguration.h", "VZHostAudioOutputStreamSink.h", "VZKeyboardConfiguration.h", "VZHostAudioInputStreamSource.h", "VZGraphicsDisplay.h", "VZAudioDeviceConfiguration.h", "VZLinuxRosettaUnixSocketCachingOptions.h", "VZLinuxRosettaAbstractSocketCachingOptions.h", "VZLinuxRosettaDirectoryShare.h", "VZMACAddress.h", "VZLinuxBootLoader.h", "VZMacGraphicsDevice.h", "VZMacGraphicsDisplay.h", "VZMacGraphicsDeviceConfiguration.h", "VZMacHardwareModel.h", "VZMacKeyboardConfiguration.h", "VZMacMachineIdentifier.h", "VZMacOSBootLoader.h", "VZLinuxRosettaCachingOptions.h", "VZMacOSInstaller.h", "VZMacOSVirtualMachineStartOptions.h", "VZMacOSRestoreImage.h", "VZMacTrackpadConfiguration.h", "VZMacOSConfigurationRequirements.h", "VZMemoryBalloonDevice.h", "VZMemoryBalloonDeviceConfiguration.h", "VZMacAuxiliaryStorage.h", "VZMultipleDirectoryShare.h", "VZMacPlatformConfiguration.h", "VZNetworkDevice.h", "VZNetworkBlockDeviceStorageDeviceAttachment.h", "VZNATNetworkDeviceAttachment.h", "VZNetworkDeviceAttachment.h", "VZPlatformConfiguration.h", "VZPointingDeviceConfiguration.h", "VZNetworkDeviceConfiguration.h", "VZSharedDirectory.h", "VZSerialPortAttachment.h", "VZNVMExpressControllerDeviceConfiguration.h", "VZMacGraphicsDisplayConfiguration.h", "VZSerialPortConfiguration.h", "VZSingleDirectoryShare.h", "VZSpiceAgentPortAttachment.h", "VZSocketDeviceConfiguration.h", "VZSocketDevice.h", "VZStorageDevice.h", "VZStorageDeviceAttachment.h", "VZStorageDeviceConfiguration.h", "VZUSBControllerConfiguration.h", "VZUSBDeviceConfiguration.h", "VZUSBMassStorageDevice.h", "VZUSBKeyboardConfiguration.h", "VZUSBController.h", "VZUSBDevice.h", "VZVirtioBlockDeviceConfiguration.h", "VZUSBScreenCoordinatePointingDeviceConfiguration.h", "VZUSBMassStorageDeviceConfiguration.h", "VZVirtioConsoleDevice.h", "VZVirtioConsoleDeviceConfiguration.h", "VZVirtioConsoleDeviceSerialPortConfiguration.h", "VZVirtioEntropyDeviceConfiguration.h", "VZVirtioConsolePort.h", "VZVirtioConsolePortConfigurationArray.h", "VZVirtioFileSystemDevice.h", "VZVirtioConsolePortConfiguration.h", "VZVirtioGraphicsDevice.h", "VZVirtioGraphicsDeviceConfiguration.h", "VZVirtioGraphicsScanout.h", "VZVirtioGraphicsScanoutConfiguration.h", "VZVirtioConsolePortArray.h", "VZVirtioFileSystemDeviceConfiguration.h", "VZVirtioNetworkDeviceConfiguration.h", "VZVirtioSocketConnection.h", "VZVirtioSocketDevice.h", "VZVirtioSoundDeviceConfiguration.h", "VZVirtioSocketListener.h", "VZVirtioSoundDeviceInputStreamConfiguration.h", "VZVirtioSocketDeviceConfiguration.h", "VZVirtioSoundDeviceOutputStreamConfiguration.h", "VZVirtioSoundDeviceStreamConfiguration.h", "VZVirtioTraditionalMemoryBalloonDeviceConfiguration.h", "VZVirtualMachineDelegate.h", "VZVirtualMachineStartOptions.h", "VZVirtioTraditionalMemoryBalloonDevice.h", "VZVirtualMachine.h", "VZXHCIControllerConfiguration.h", "VZVirtualMachineView.h", "VZVirtualMachineConfiguration.h", "VZXHCIController.h", "x86_64-apple-macos.swiftinterface", "arm64e-apple-macos.swiftinterface", "module.modulemap", "Virtualization.tbd", "VideoToolbox.apinotes", "VideoToolbox.h", "VTBase.h", "VTDecompressionProperties.h", "VTCompressionSession.h", "VTErrors.h", "VTCompressionProperties.h", "VTDecompressionSession.h", "VTHDRPerFrameMetadataGenerationSession.h", "VTMultiPassStorage.h", "VTPixelRotationSession.h", "VTFrameSilo.h", "VTPixelRotationProperties.h", "VTPixelTransferSession.h", "VTProfessionalVideoWorkflow.h", "VTRAWProcessingProperties.h", "VTPixelTransferProperties.h", "VTSession.h", "VTUtilities.h", "VTVideoEncoderList.h", "VTRAWProcessingSession.h", "libvDSP.tbd", "SharedWithYouCore.h", "SWAction.h", "SWCollaborationActionHandler.h", "SWCollaborationCoordinator.h", "SWCollaborationMetadata.h", "SWCollaborationOption.h", "SWCollaborationOptionsPickerGroup.h", "SWCollaborationOptionsGroup.h", "SWCollaborationShareOptions.h", "SWDefines.h", "SWPersonIdentity.h", "SWPerson.h", "SWStartCollaborationAction.h", "SWPersonIdentityProof.h", "SWUpdateCollaborationParticipantsAction.h", "SharedWithYouCore.tbd", "ScriptingBridge.tbd", "SBElementArray.h", "ScriptingBridge.apinotes", "ScriptingBridge.h", "SBApplication.h", "SBObject.h", "SCScreenshotManager.h", "SCError.h", "SCRecordingOutput.h", "ScreenCaptureKit.h", "SCShareableContent.h", "SCContentSharingPicker.h", "SCStream.h", "Ruby.tbd", "rbLibXMLParser.rb", "rbCFPlistError.rb", "rbNokogiriParser.rb", "rbCFTypes.rb", "rbCFPropertyList.rb", "rbPlainCFPropertyList.rb", "rbBinaryCFPropertyList.rb", "rbREXMLParser.rb", "cfpropertylist.rb", "setup.rb", "libxml.rb", "xml.rb", "mini_portile_cmake.rb", "version.rb", "mini_portile.rb", "sqlite3.rb", "faq.rb", "exception.c", "backup.h", "backup.c", "database.h", "exception.h", "sqlite3_ruby.h", "statement.h", "extconf.rb", "sqlite3.c", "database.c", "statement.c", "nokogiri.rb", "ascii.c", "ascii.h", "char_ref.h", "attribute.h", "attribute.c", "error.h", "foreign_attrs.c", "insertion_mode.h", "error.c", "gumbo.h", "parser.h", "replacement.h", "parser.c", "string_buffer.h", "string_buffer.c", "string_piece.c", "macros.h", "svg_attrs.c", "tag_lookup.h", "svg_tags.c", "tag_lookup.c", "token_type.h", "tag.c", "token_buffer.h", "token_buffer.c", "tokenizer.h", "tokenizer.c", "utf8.c", "utf8.h", "util.c", "util.h", "tokenizer_states.h", "vector.c", "vector.h", "html4_document.c", "html4_entity_lookup.c", "html4_element_description.c", "html4_sax_push_parser.c", "libxml2_backwards_compat.c", "nokogiri.c", "test_global_handlers.c", "xml_attribute_decl.c", "nokogiri.h", "xml_attr.c", "xml_cdata.c", "xml_document_fragment.c", "xml_document.c", "xml_element_content.c", "html4_sax_parser_context.c", "xml_encoding_handler.c", "xml_element_decl.c", "xml_entity_decl.c", "xml_node_set.c", "xml_dtd.c", "gumbo.c", "xml_namespace.c", "xml_processing_instruction.c", "xml_reader.c", "xml_relax_ng.c", "xml_entity_reference.c", "xml_sax_parser.c", "xml_sax_push_parser.c", "xml_sax_parser_context.c", "xml_text.c", "xml_schema.c", "xml_xpath_context.c", "xslt_stylesheet.c", "xml_syntax_error.c", "xml_comment.c", "xml_node.c", "PushKit.tbd", "PKPushCredentials.h", "PKDefines.h", "PKPushPayload.h", "PushKit.h", "PKPushRegistry.h", "PushKit.apinotes", "OpenDirectory.tbd", "ODAttributeMap.h", "ODMappings.h", "NSOpenDirectory.h", "ODConfiguration.h", "ODQuery.h", "ODNode.h", "OpenDirectory.h", "ODRecordMap.h", "ODSession.h", "ODModuleEntry.h", "ODRecord.h", "CFODContext.h", "CFODSession.h", "CFOpenDirectory.h", "CFODQuery.h", "CFODNode.h", "CFODRecord.h", "CFOpenDirectoryConstants.h", "CFOpenDirectory.tbd", "OpenAL.tbd", "alc.h", "al.h", "alut.h", "OpenAL.h", "MacOSX_OALExtensions.h", "arm64e-apple-ios-macabi.swiftinterface", "x86_64-apple-ios-macabi.swiftinterface", "SwiftUI.swiftoverlay", "MTLAccelerationStructure.h", "Metal.h", "MTLAccelerationStructureTypes.h", "MTLAccelerationStructureCommandEncoder.h", "MTLArgumentEncoder.h", "MTLArgument.h", "MTLBinaryArchive.h", "Metal.apinotes", "MTLBlitPass.h", "MTLBuffer.h", "MTLCaptureManager.h", "MTLCaptureScope.h", "MTLAllocation.h", "MTLCommandEncoder.h", "MTLCommandBuffer.h", "MTLComputePass.h", "MTLBlitCommandEncoder.h", "MTLCommandQueue.h", "MTLDefines.h", "MTLDepthStencil.h", "MTLComputePipeline.h", "MTLDeviceCertification.h", "MTLDrawable.h", "MTLCounters.h", "MTLComputeCommandEncoder.h", "MTLDynamicLibrary.h", "MTLFence.h", "MTLFunctionConstantValues.h", "MTLFunctionDescriptor.h", "MTLFunctionLog.h", "MTLFunctionHandle.h", "MTLEvent.h", "MTLFunctionStitching.h", "MTLHeap.h", "MTLDevice.h", "MTLIndirectCommandBuffer.h", "MTLIntersectionFunctionTable.h", "MTLIOCommandQueue.h", "MTLLinkedFunctions.h", "MTLIOCommandBuffer.h", "MTLIOCompressor.h", "MTLParallelRenderCommandEncoder.h", "MTLLogState.h", "MTLPipeline.h", "MTLLibrary.h", "MTLPixelFormat.h", "MTLRasterizationRate.h", "MTLRenderPass.h", "MTLRenderPipeline.h", "MTLResidencySet.h", "MTLResourceStateCommandEncoder.h", "MTLResourceStatePass.h", "MTLResource.h", "MTLIndirectCommandEncoder.h", "MTLSampler.h", "MTLRenderCommandEncoder.h", "MTLStageInputOutputDescriptor.h", "MTLVisibleFunctionTable.h", "MTLTypes.h", "MTLVertexDescriptor.h", "MTLTexture.h", "WebKit.arm64e.bridgesupport", "WebKit.bridgesupport" ], "public": 1, "adversary": "DragonForce Hacker Group Malaysia", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "VZBootLoader", "display_name": "VZBootLoader", "target": null }, { "id": "TypeError", "display_name": "TypeError", "target": null }, { "id": "GC", "display_name": "GC", "target": null }, { "id": "CFTypeRef", "display_name": "CFTypeRef", "target": null } ], "attack_ids": [ { "id": "T1123", "name": "Audio Capture", "display_name": "T1123 - Audio Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1135", "name": "Network Share Discovery", "display_name": "T1135 - Network Share Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1124", "name": "System Time Discovery", "display_name": "T1124 - System Time Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1550", "name": "Use Alternate Authentication Material", "display_name": "T1550 - Use Alternate Authentication Material" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" } ], "industries": [ "Media" ], "TLP": "white", "cloned_from": null, "export_count": 49, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 346, "FileHash-SHA256": 272, "domain": 110, "hostname": 101, "email": 1, "CVE": 2, "FileHash-SHA1": 1 }, "indicator_count": 833, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "571 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62925b989eba65cefe8c5f88", "name": "Mathworks.com (work in progress) extractor is malfunctioning", "description": "defineProperty(t,n), Object.prototype, E.S.D, e.CmpApiModel, \"DeepClone\", \"deepClones\" - a description of all the functions in this.", "modified": "2022-05-28T17:43:49.055000", "created": "2022-05-28T17:27:52.332000", "tags": [ "optin", "elqsitevisited", "qnew date", "rnew date", "dlkey", "dllookup", "image", "httponly", "typeof e", "typeerror", "typeof symbol", "string", "array", "date", "efunction", "sfunction", "target", "typeof h", "typeof t", "typeof n", "typeof", "copyright", "event", "jquery", "typeof u", "uspapi", "confirmation", "matlab", "matlab speaks", "video", "system toolbox", "international", "learning", "computer vision", "analytics", "toolbox", "shell", "loans", "b0b6c1", "send", "caced6", "qualaroo", "thank", "ffd700", "simulink", "blank", "pass", "undef", "false", "null", "martin", "6464", "12224", "survey", "close", "tools", "python", "typeof require", "error", "modulenotfound", "abcdef", "typeof visitor", "adcloud", "typeof alloy" ], "references": [ "https://quantcast.mgr.consensu.org/tcfv2/27/cmp2.js?referer=m", "https://www.everestjs.net/static/le/last-event-tag-latest.min.js", "https://s3.amazonaws.com/ki.js/49559/ahy.js", "https://rules.quantcount.com/rules-p-zfNtLVVEHXE-1.js", "https://secure.quantserve.com/quant.js", "https://quantcast.mgr.consensu.org/tcfv2/27/cmp2.js?referer=mathworks.com", "https://img03.en25.com/i/elqCfg.min.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 156, "hostname": 192, "URL": 608, "FileHash-SHA256": 22, "FileHash-MD5": 2 }, "indicator_count": 980, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "1465 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "WebKit.bridgesupport", "jobs.tmpl", "main.cf.proto", "OpenDirectory.tbd", "VZUSBDevice.h", "exception.h", "MTLParallelRenderCommandEncoder.h", "VZMacMachineIdentifier.h", "vector.c", "command.tmpl", "VZVirtioFileSystemDevice.h", "SCShareableContent.h", "VZVirtioNetworkDeviceConfiguration.h", "VZVirtioBlockDeviceConfiguration.h", "users.csv", "VZMultipleDirectoryShare.h", "database.c", "group", "epson.h", "xml_element_content.c", "man.conf", "print-job-and-wait.test", "get-ppds.test", "MTLLibrary.h", "main.cf.default", "standard", "SWAction.h", "disk_structure.txt", "add-class.tmpl", "MTLIOCompressor.h", "printer-jobs-header.tmpl", "protocols", "dbivport.h", "notify.conf", "print-job-letter.test", "parser.c", "MTLCommandEncoder.h", "VZAudioInputStreamSource.h", "PKPushPayload.h", "ODNode.h", "VZVirtioEntropyDeviceConfiguration.h", "master.cf.default", "dbd_xsh.h", "attribute.h", "rtadvd.conf", "VZVirtioSocketDeviceConfiguration.h", "class-modified.tmpl", "get-printer-description-attributes.test", "VZMacPlatformConfiguration.h", "test-page.tmpl", "identify-printer.test", "MTLAllocation.h", "VTDecompressionSession.h", "xml_attr.c", "MCBrowserViewController.h", "PKPushRegistry.h", "process_list.txt", "printers.tmpl", "SWPerson.h", "set-printer-options-header.tmpl", "VTPixelRotationProperties.h", "VZGenericMachineIdentifier.h", "header_checks", "xml_comment.c", "secret", "string_buffer.h", "kern_loader.conf", "insertion_mode.h", "VZVirtioSoundDeviceInputStreamConfiguration.h", "pf.conf", "VZDiskSynchronizationMode.h", "VZMacOSRestoreImage.h", "rbPlainCFPropertyList.rb", "nokogiri.h", "rmtab", "VZStorageDevice.h", "ascii.c", "metadata.json", "MacOSX_OALExtensions.h", "mail.rc", "get-ppds-language.test", "AirPlayReceiver.tbd", "VTFrameSilo.h", "xml_sax_parser_context.c", "get-ppds-drv-only.test", "dbi_sql.h", "modify-class.tmpl", "Virtualization.tbd", "faq.rb", "unclassified", "rbCFTypes.rb", "custom-error.html", "smb.conf", "VZMACAddress.h", "MTLVisibleFunctionTable.h", "custom_header_checks", "classified", "XPdb-wal", "cups-create-local-printer.test", "VZAudioDeviceConfiguration.h", "interfaceAddrs.csv", "VZStorageDeviceConfiguration.h", "SBElementArray.h", "OpenDirectory.h", "VTVideoEncoderList.h", "postfix-files", "VZSerialPortAttachment.h", "font.defs", "help-trailer.tmpl", "MTLBuffer.h", "job-cancel.tmpl", "norestart.tmpl", "csh.cshrc", "MTLFunctionStitching.h", "ODRecordMap.h", "MTLDefines.h", "MTLArgument.h", "ipp-2.2.test", "apfs_boot_mount.tbd", "ttys", "choose-uri.tmpl", "VZVirtualMachineConfiguration.h", "get-ppds-make.test", "MTLAccelerationStructureTypes.h", "job-moved.tmpl", "ldap.h", "MTLCaptureManager.h", "identify-printer-display.test", "xml_document_fragment.c", "xml_xpath_context.c", "module.modulemap", "ODSession.h", "MTLIndirectCommandBuffer.h", "MultipeerConnectivity.tbd", "ntp_opendirectory.conf", "MultipeerConnectivity.apinotes", "printer-reject.tmpl", "VZConsoleDevice.h", "rbCFPropertyList.rb", "VZGraphicsDisplay.h", "create-job-format.test", "PushKit.apinotes", "VZMacTrackpadConfiguration.h", "VZVirtioSoundDeviceStreamConfiguration.h", "diskEncryption.csv", "ODConfiguration.h", "VZLinuxBootLoader.h", "VTErrors.h", "raster.defs", "VZConsoleDeviceConfiguration.h", "create-job-timeout.test", "SwiftUI.swiftoverlay", "VZUSBDeviceConfiguration.h", "SWCollaborationOption.h", "MTLCommandQueue.h", "rpc", "PKPushCredentials.h", "MTLDynamicLibrary.h", "parser.h", "MTLComputePipeline.h", "VZDiskBlockDeviceStorageDeviceAttachment.h", "ScriptingBridge.apinotes", "get-subscriptions.test", "VZPointingDeviceConfiguration.h", "MTLDevice.h", "certificates.csv", "rbCFPlistError.rb", "etcHosts.csv", "xml_sax_parser.c", "makedefs.out", "version.plist", "nokogiri.rb", "systemInfo.csv", "applications.csv", "print-job.test", "VZUSBMassStorageDevice.h", "Info.plist", "class.tmpl", "add-printer.tmpl", "printer-start.tmpl", "nfs.conf", "option-header.tmpl", "VZBridgedNetworkDeviceAttachment.h", "restart.tmpl", "get-job-template-attributes.test", "httpd.exp", "tokenizer_states.h", "MTLCaptureScope.h", "VZMacGraphicsDisplay.h", "get-printers-printer-id.test", "VZNVMExpressControllerDeviceConfiguration.h", "MTLCommandBuffer.h", "VZLinuxRosettaCachingOptions.h", "csh.logout", "x86_64-apple-macos.swiftinterface", "xml_cdata.c", "topsecret", "VZAudioOutputStreamSink.h", "VZVirtioConsolePortConfiguration.h", "print-job-manual.test", "html4_element_description.c", "help-printable.tmpl", "VZUSBScreenCoordinatePointingDeviceConfiguration.h", "ntp.conf", "SWCollaborationOptionsGroup.h", "xml_dtd.c", "pf.os", "xml_element_decl.c", "command_args.json", "token_type.h", "MCError.h", "string_buffer.c", "printer-cancel-jobs.tmpl", "VTHDRPerFrameMetadataGenerationSession.h", "tag_lookup.c", "xml_namespace.c", "apple.types", "al.h", "html4_entity_lookup.c", "mini_portile_cmake.rb", "svg_tags.c", "VZVirtioSoundDeviceConfiguration.h", "passwd", "CFODQuery.h", "job-hold.tmpl", "MTLLogState.h", "hook_op_check.h", "html4_document.c", "gettytab", "VZMacGraphicsDeviceConfiguration.h", "MultipeerConnectivity.h", "option-boolean.tmpl", "VZVirtioSocketConnection.h", "printer-default.tmpl", "Driver_xst.h", "profile", "sqlite3.rb", "MTLDepthStencil.h", "VZVirtioGraphicsScanoutConfiguration.h", "printer-confirm.tmpl", "option-conflict.tmpl", "create-job-sheets.test", "printer-configured.tmpl", "MTLIOCommandBuffer.h", "VZDiskImageStorageDeviceAttachment.h", "ascii.h", "statement.h", "class-deleted.tmpl", "pager.tmpl", "token_buffer.h", "class-confirm.tmpl", "NSOpenDirectory.h", "preboot_archive_errors.log", "SWDefines.h", "MTLComputeCommandEncoder.h", "search.tmpl", "VZVirtioConsoleDeviceSerialPortConfiguration.h", "paths", "VZVirtioSoundDeviceOutputStreamConfiguration.h", "VZVirtioGraphicsDevice.h", "label.h", "kernel.csv", "get-printers.test", "VZMacOSBootLoader.h", "gumbo.h", "VTPixelTransferSession.h", "VZMemoryBalloonDeviceConfiguration.h", "MTLHeap.h", "VZSpiceAgentPortAttachment.h", "MTLFunctionLog.h", "AuraService-fda-test", "ipp-2.1.test", "modify-printer.tmpl", "mounts.txt", "class-added.tmpl", "proxy.xml", "VZBridgedNetworkInterface.h", "printer-stop.tmpl", "VZVirtioGraphicsScanout.h", "trailer.tmpl", "Admin.tbd", "option-pickmany.tmpl", "choose-device.tmpl", "MTLPixelFormat.h", "xml_entity_reference.c", "rc.netboot", "apple.convs", "SWCollaborationCoordinator.h", "error-op.tmpl", "extconf.rb", "Metal.h", "rbREXMLParser.rb", "attribute.c", "auto_master", "VZUSBMassStorageDeviceConfiguration.h", "ODMappings.h", "VTRAWProcessingSession.h", "ipp-everywhere.test", "MTLEvent.h", "MTLPipeline.h", "util.c", "convenience.map", "VideoToolbox.h", "VZPlatformConfiguration.h", "launchagents.txt", "VZNetworkDevice.h", "fax-job.test", "get-devices.test", "cancel-current-job.test", "VZBootLoader.h", "util.h", "MTLResourceStateCommandEncoder.h", "tag.c", "com.adobe.acrobat.rna.AcroCefBrowserLock.DC", "get-ppd.test", "https://img03.en25.com/i/elqCfg.min.js", "relocated", "ODRecord.h", "choose-model.tmpl", "get-job-attributes2.test", "identify-printer-multiple.test", "libxml2_backwards_compat.c", "MTLResourceStatePass.h", "index.html.en", "dbixs_rev.h", "VZEntropyDeviceConfiguration.h", "xml_node.c", "VZVirtioConsolePort.h", "newsyslog.conf", "VZGraphicsDevice.h", "VZHostAudioOutputStreamSink.h", "SCError.h", "battery.csv", "kexts.txt", "ScriptingBridge.h", "VTUtilities.h", "VTCompressionProperties.h", "printer-added.tmpl", "foreign_attrs.c", "get-ppds-psversion.test", "SharedWithYouCore.h", "xml_schema.c", "https://quantcast.mgr.consensu.org/tcfv2/27/cmp2.js?referer=mathworks.com", "DBIXS.h", "printer-deleted.tmpl", "xml_sax_push_parser.c", "sqlite3_ruby.h", "print-uri.test", "VTProfessionalVideoWorkflow.h", "MTLTypes.h", "AOSKit.tbd", "html4_sax_push_parser.c", "SWPersonIdentityProof.h", "svg_attrs.c", "autofs.conf", "alc.h", "SWCollaborationActionHandler.h", "xtab", "content-negotiation.html", "choose-make.tmpl", "classes-header.tmpl", "bounce.cf.default", "access", "xml_encoding_handler.c", "VTPixelRotationSession.h", "asl.conf", "LICENSE", "macros.h", "x86_64-apple-ios-macabi.swiftinterface", "user_launchagents.txt", "edit-config.tmpl", "xslt_stylesheet.c", "token_buffer.c", "VZHostAudioInputStreamSource.h", "LDAP.tbd", "libvDSP.tbd", "VZVirtioSocketListener.h", "VZLinuxRosettaUnixSocketCachingOptions.h", "VZVirtualMachineDelegate.h", "VZVirtioConsoleDeviceConfiguration.h", "SBObject.h", "admin.tmpl", "MCSession.h", "rbLibXMLParser.rb", "auto_home", "bashrc_Apple_Terminal", "string_piece.c", "interfaceDetails.csv", "MTLFence.h", "backup.h", "xml_node_set.c", "VZMacAuxiliaryStorage.h", "aliases", "xml_document.c", "VZNetworkDeviceAttachment.h", "CFODRecord.h", "6015FED9-D723-4332-87D9-C478CF341407.aamdownload", "media.defs", "cfpropertylist.rb", "zshrc", "mini_portile.rb", "ipp-backend.test", "tag_lookup.h", "VZVirtioSocketDevice.h", "MCPeerID.h", "MTLSampler.h", "xml_attribute_decl.c", "MTLBlitPass.h", "class-jobs-header.tmpl", "VZMacOSInstaller.h", "MTLRenderCommandEncoder.h", "VTPixelTransferProperties.h", "MTLAccelerationStructure.h", "ipp-1.1.test", "VZConsolePortConfiguration.h", "VZFileHandleNetworkDeviceAttachment.h", "caching.html", "launchdaemons.txt", "VZVirtualMachineStartOptions.h", "mounts.csv", "printer-modified.tmpl", "manpaths", "afpovertcp.cfg", "SWPersonIdentity.h", "security_status.txt", "utf8.h", "MTLAccelerationStructureCommandEncoder.h", "crashes.csv", "get-jobs.test", "VZVirtioConsoleDevice.h", "sqlite3.c", "launchD.csv", "canonical", "get-ppds-make-and-model.test", "help-header.tmpl", "VZVirtioGraphicsDeviceConfiguration.h", "virtual", "VZLinuxRosettaDirectoryShare.h", "ftpusers", "OpenAL.tbd", "sharedFolders.csv", "hp.h", "print-job-gzip.test", "print-job-media-col.test", "html4_sax_parser_context.c", "sudoers", "sipConfig.csv", "VZXHCIControllerConfiguration.h", "OpenAL.h", "MTLRenderPipeline.h", "com.apple.screensharing.agent.launchd", "confidential", "print-job-hold.test", "rbNokogiriParser.rb", "VZStorageDeviceAttachment.h", "create-job.test", "xml_relax_ng.c", "AppleFirmwareUpdate.tbd", "job-restart.tmpl", "print-job-deflate.test", "MTLBlitCommandEncoder.h", "MTLIOCommandQueue.h", "https://s3.amazonaws.com/ki.js/49559/ahy.js", "setup.rb", "libxml.rb", "VZGraphicsDisplayConfiguration.h", "zprofile", "option-pickone.tmpl", "MCAdvertiserAssistant.h", "VZXHCIController.h", "get-printer-attributes-suite.test", "job-move.tmpl", "nokogiri.c", "BUILDING", "LocalAuthentication.tbd", "syslog.conf", "users.tmpl", "printer-accept.tmpl", "SWCollaborationMetadata.h", "MTLBinaryArchive.h", "TLS_LICENSE", "VZVirtioConsolePortConfigurationArray.h", "SWUpdateCollaborationParticipantsAction.h", "xml_entity_decl.c", "statement.c", "vector.h", "VZNetworkDeviceConfiguration.h", "get-ppds-product.test", "VZVirtualMachine.h", "systemControls.csv", "PushKit.h", "resolv.conf", "sudo_lecture", "usbDevices.csv", "VZGraphicsDeviceConfiguration.h", "https://secure.quantserve.com/quant.js", "configuring.html", "PKDefines.h", "MTLArgumentEncoder.h", "MTLLinkedFunctions.h", "gumbo.c", "xml_reader.c", "VZFileSerialPortAttachment.h", "managedPolicies.csv", "get-printer-attributes.test", "PushKit.tbd", "job-release.tmpl", "get-completed-jobs.test", "replacement.h", "VZDirectorySharingDeviceConfiguration.h", "VTDecompressionProperties.h", "tokenizer.h", "option-trailer.tmpl", "MTLCounters.h", "locate.rc", "MTLResidencySet.h", "VZKeyboardConfiguration.h", "test_global_handlers.c", "Metal.apinotes", "char_ref.h", "ODModuleEntry.h", "validate-job.test", "ODAttributeMap.h", "VZUSBKeyboardConfiguration.h", "VZDirectoryShare.h", "bind.html", "ScreenCaptureKit.h", "error.h", "MTLComputePass.h", "sharingPreferences.csv", "main.cf", "CFODNode.h", "mime.convs", "VZSocketDevice.h", "get-ppd-printer.test", "xml.rb", "VZNATNetworkDeviceAttachment.h", "VZVirtioTraditionalMemoryBalloonDeviceConfiguration.h", "zshrc_Apple_Terminal", "lber.h", "nsmb.conf", "MCNearbyServiceBrowser.h", "Ruby.tbd", "WebKit.arm64e.bridgesupport", "MTLFunctionConstantValues.h", "MTLIntersectionFunctionTable.h", "CFOpenDirectory.tbd", "sample.drv", "master.cf.proto", "VTCompressionSession.h", "CFODContext.h", "https://rules.quantcount.com/rules-p-zfNtLVVEHXE-1.js", "exception.c", "CFODSession.h", "set-printer-options-trailer.tmpl", "ScriptingBridge.tbd", "networks", "tokenizer.c", "classes.tmpl", "SCRecordingOutput.h", "master.cf", "xml_syntax_error.c", "VZGenericPlatformConfiguration.h", "VTBase.h", "testprint", "CFOpenDirectoryConstants.h", "VZUSBController.h", "ExmanProcessMutex", "database.h", "VZError.h", "SWStartCollaborationAction.h", "shells", "backup.c", "SWCollaborationOptionsPickerGroup.h", "VZUSBControllerConfiguration.h", "MTLDrawable.h", "VZVirtioTraditionalMemoryBalloonDevice.h", "create-printer-subscription.test", "VZDirectorySharingDevice.h", "MTLResource.h", "VZMacGraphicsDevice.h", "VZSocketDeviceConfiguration.h", "get-notifications.test", "VZFileHandleSerialPortAttachment.h", "get-job-attributes.test", "error.c", "MTLFunctionDescriptor.h", "SharedWithYouCore.tbd", "MTLRasterizationRate.h", "MTLVertexDescriptor.h", "SCStream.h", "xml_text.c", "https://quantcast.mgr.consensu.org/tcfv2/27/cmp2.js?referer=m", "jobs-header.tmpl", "VTSession.h", "SWCollaborationShareOptions.h", "print-job-password.test", "APConfigurationSystem.tbd", "MTLIndirectCommandEncoder.h", "VZEFIBootLoader.h", "VZMacGraphicsDisplayConfiguration.h", "VZSerialPortConfiguration.h", "SCScreenshotManager.h", "arm64e-apple-ios-macabi.swiftinterface", "choose-serial.tmpl", "list-available-printers.tmpl", "version.rb", "https://www.everestjs.net/static/le/last-event-tag-latest.min.js", "MTLRenderPass.h", "MTLStageInputOutputDescriptor.h", "CodeResources", "generic", "chromeExtensions.csv", "A53749AF-3855-4842-A1E7-4AEFA60BD2AC", "irbrc", "VZMacOSConfigurationRequirements.h", "VZMacKeyboardConfiguration.h", "VZDefines.h", "header.tmpl", "VZVirtioFileSystemDeviceConfiguration.h", "bashrc", "VZMemoryBalloonDevice.h", "MTLTexture.h", "VTRAWProcessingProperties.h", "csh.login", "VTMultiPassStorage.h", "ODQuery.h", "printers-header.tmpl", "Virtualization.h", "VZVirtualMachineView.h", "find.codes", "VZSingleDirectoryShare.h", "MCNearbyServiceAdvertiser.h", "mime.types", "VZNetworkBlockDeviceStorageDeviceAttachment.h", "CFOpenDirectory.h", "VZMacHardwareModel.h", "VZEFIVariableStore.h", "ipp-2.0.test", "rc.common", "transport", "SCContentSharingPicker.h", "MTLDeviceCertification.h", "printer.tmpl", "VZMacOSVirtualMachineStartOptions.h", "VZSharedDirectory.h", "utf8.c", "error.tmpl", "SBApplication.h", "alut.h", "xml_processing_instruction.c", "VideoToolbox.apinotes", "MTLFunctionHandle.h", "VZLinuxRosettaAbstractSocketCachingOptions.h", "set-attrs-hold.test", "VZVirtioConsolePortArray.h", "rbBinaryCFPropertyList.rb", "arm64e-apple-macos.swiftinterface" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "DragonForce Malaysia Hacker Group", "DragonForce Hacker Group Malaysia" ], "malware_families": [ "Firstname", "Cftyperef", "Vzbootloader", "Lastname", "Gc", "Typeerror" ], "industries": [ "Media" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "6879093e8658df9f35683846", "name": "Worm:Win32/Benjamin continues to impact network", "description": "Worm:Win32/Benjamin continues to impact network operations of a little known, limited national cybers space organization. P2P-Worm.\n*IDS Detections: \n\u2022 Win32.Worm.Benjamin.A CnC Checkin Alerts\n\u2022 nids_malware_alert\n\u2022 network_icmp\n\u2022 network_irc\n\u2022 persistence_autorun\n| Multiple network issues from outages, stolen password keychains, credentials dumping, impressive espionage attacks. Likely goes unnoticed to many. Widely regarded/reported as an outage that is really an unpatched, ongoing cyber attack.", "modified": "2025-08-16T14:00:26.166000", "created": "2025-07-17T14:31:26.824000", "tags": [ "include review", "data upload", "extraction", "read c", "search", "medium", "show", "msie", "windows nt", "wow64", "slcc2", "media center", "entries", "dock", "write", "execution", "capture", "next", "copy", "date", "aaaa", "present may", "present nov", "passive dns", "ip address", "domain", "status", "next associated", "delete", "iocs", "failed", "sc data", "type", "extr data", "included", "review iocs", "memcommit", "user execution", "module load", "t1129", "icmp traffic", "high", "collection", "cmd c", "t1055", "enter", "extract", "enter sc", "drop or", "browse t", "oprop", "extraction data", "enter source", "url or", "texorag", "browse", "urls", "dnssec", "hostname add", "pulse pulses", "files", "files ip", "domainadmin", "showing", "ttl value", "thumbprint", "onlv", "find", "extri data", "dran anu", "extr", "manually add", "review exclude", "sugges", "find s", "typ hos", "se data", "include data", "review locs", "exclude", "suggested es", "intel", "ms windows", "write c", "pe32", "pe32 executable", "copy c", "worm", "win32", "benjamin", "june", "delphi", "malware", "nids", "icmp delphi", "yara detections", "malware traffic", "checkin", "code", "name servers", "servers", "pulses", "expiration date", "united", "body", "cookie", "related tags", "file type", "pe packer", "pm size", "sha1 sha256", "imphash pehash", "virustotal api", "screenshots", "comments" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 50, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 536, "FileHash-SHA1": 465, "FileHash-SHA256": 1836, "domain": 766, "hostname": 960, "URL": 2879, "CVE": 1, "email": 4 }, "indicator_count": 7447, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "289 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67f5555b6ce863d998e83e26", "name": "macOS Threat Infrastructure Leveraging Remote Agents via remotewd.com and rtmsprod.net", "description": "This pulse identifies an actively observed macOS-focused remote access infrastructure abusing trusted native Apple agents (ARDAgent.app, SSMenuAgent.app) and communicating with a distributed network of C2-like endpoints under domains such as remotewd.com, idsremoteurlconnectionagent.app, and rtmsprod.net.\n\nThe infrastructure is composed of dynamically generated subdomains \u2014 many in the form of device-.remotewd.com \u2014 indicative of automated deployment, system tracking, or per-host remote access configurations.\n\nAdditional indicators include HTTP/S URLs pointing directly to embedded binary paths within macOS agents, suggesting possible delivery vectors, staging, or persistence techniques.\n\nThis campaign shows signs of structured, programmatic targeting and is highly likely to be pre-operational infrastructure for wide-scale surveillance or access operations. All listed indicators should be considered high-risk. If observed in your environment, initiate a full forensic and IR process immediately.", "modified": "2025-05-11T19:03:59.885000", "created": "2025-04-08T16:56:59.641000", "tags": [ "generated from", "do not", "edit uri", "urls", "edit", "rewriteengine", "rewritecond", "rewriterule", "r301", "xml2encalias", "beralloct", "berbvarrayadd", "berbvarrayfree", "berbvdup", "berbvecadd", "berbvecfree", "berbvfree", "berdump", "berdup", "berdupbv", "laerrordomain", "laerrornoncekey", "lamechanismtree", "lacontext", "ladomainstate", "laenvironment", "lanotification", "laprivatekey", "lapublickey", "laright", "apple swift", "o librarylevel", "combine import", "foundation", "swift import", "mcpeerid", "mcsession", "property", "copyright", "protocol", "class", "bonjour", "ascii lowercase", "abc company", "section", "bonjour txt", "note", "ui element", "utf8 encoding", "nscopying", "nsdictionary", "nsstring", "mcextern", "attribute", "mcextern extern", "mcexternweak", "nsenum", "nsinteger", "mcerrorcode", "mcerrorunknown", "mcerrortimedout", "peer", "example", "bonjour apis", "stop", "tags", "session", "nsprogress", "nserror", "nsurl", "nsarray", "create", "nsuinteger", "notifies", "mcsession api", "interface", "dbictrace", "dbivporth", "dbictracelevel", "dbdtffoo", "dbihseterrchar", "dbicstate", "dbictraceflags", "provides macros", "dbi release", "only", "sqlsuccess", "odbc", "sqlok", "tim bunce", "england", "sql cli", "sql datatype", "sqlguid", "sqlwlongvarchar", "main", "beware", "sv sth", "sv dbh", "impsth", "impdbh", "sv keysv", "sv params", "sv attr", "sv attribs", "sv drh", "void", "fri jul", "mixed", "dbixsrevision", "plsvundef", "license", "spagain", "perlioprintf", "dbiclogpio", "putback", "ireland", "gnu general", "super", "magic", "dbicflags", "dbis", "svrv", "null", "imp2com", "dbicactivekids", "dbicfiadestroy", "sv h", "dbicdbistate", "code", "copy", "refer", "trace", "error", "unknown", "hookopcheckh", "startexternc", "hookopcheckcb", "userdata", "endexternc", "isinternalbuild", "kickmcxdforuid", "loadappkit", "ardconfig", "authenticator", "dsauthenticator", "dsnode", "dsrecord", "group", "hostconfig", "apfsvolumelock", "apfsvolumerole", "aoskgetosinfo", "aoskgetuserinfo", "aosaddappleid", "aosdisablepcs", "aosenablepcs", "aoslog", "aoslogforce", "aosrelaycookie", "didfailcallback", "kaosaccountkey", "kapcsbundle", "kapcspath", "kjsonextension", "apcsbucketid", "apcsreports", "apconfiguration", "apversiondata", "apversionhelper", "systemvolumesvm", "name size", "identifier", "gb disk0s3", "devdisk3", "apfs container", "scheme", "physical store", "macintosh hd", "apfs snapshot", "preboot", "refs address", "size wired", "name", "version", "uuid", "linked against", "renderer", "helper", "chrome helper", "contains", "cloud ui", "macintosh", "khtml", "gecko", "ui helper", "plugin", "service", "good", "battery power", "apfs encryption", "jumpcloud go", "chrome web", "store", "privacy badger", "flowcrypt", "encrypt gmail", "simple", "google", "b2b phone", "number", "apollo", "future", "exccrash", "sigkill", "code signature", "invalid", "sigabrt", "protonvpn", "excguard", "excbreakpoint", "sigtrap", "excbadaccess", "appl", "english", "adobe crash", "adobe", "acrobat dcadobe", "processor", "uninstaller", "assistant", "install", "cloud", "dock", "calendar", "music", "terminal", "tips", "installer", "updater", "proton", "tools", "stub", "python", "clock", "powershell", "team", "rave scout", "cookies", "public folder", "key cert", "sign", "crl sign", "root ca", "authority", "public primary", "global root", "verisign", "academic", "premium", "adaptive", "interactive", "background", "standard", "launchd sandbox", "s mdworker", "agent", "command line", "progress", "yubico", "macos13action", "disableoverride", "disableairdrop", "denyactivation", "enable", "loginwindowtext", "jumpcloud", "autoupdate", "loggingoption", "enablefirewall", "arm64e", "apple m2", "mac142", "kjqqtw7pqt", "daemon", "server", "open directory", "user", "account", "kerberos admin", "kerberos change", "device daemon", "network", "desktop", "screensaver", "bridge", "aesxtsarm", "aesecbarm", "sha512vngarmhw", "sha384vngarmhw", "sha256vngarm", "sha1vngarm", "darwin kernel", "wed mar", "wkarraycreate", "wkbooleancreate", "wkcontextcreate", "wkdatacreate", "wkdatagettypeid", "wkdoublecreate", "wkframecopyurl", "wkgettypeid", "wkimagecreate", "wkpagecandelete", "webview", "notice", "this software", "including", "but not", "limited to", "redistribution", "is provided", "by apple", "direct", "damage", "apiavailable", "webkit", "nsswiftname", "document", "a block", "as is", "hasinclude", "wkdownload", "abstract", "wkerrorcode", "wkerrorunknown", "discussion", "bool", "whether", "wkcontentworld", "wkwebview", "javascript", "nsunavailable", "vaargs", "nsswiftasync", "wkswiftasync", "wkcookiepolicy", "wkswiftuiactor", "nshttpcookie", "targetosiphone", "wknavigation", "decides", "boolean value", "apideprecated", "methodkind", "wkerrordomain", "wkscriptmessage", "promise", "fulfill", "const", "url scheme", "mark", "wkuserscript", "targetosvision", "param", "wkframeinfo", "targetosios", "pass", "window", "mime type", "link", "nsimage", "returns", "nsset", "checks", "matches", "a boolean", "defaults", "wkwebextension", "cgsize", "uiimage", "apis", "nsdate", "wkcontentmode", "wkextern", "possible", "cgfloat", "media", "cgrect", "apiunavailable", "framework", "nsswiftuiactor", "targetoswatch", "confirms", "apple upgrade", "nsstring user", "nsobject", "provider", "apple", "password", "uicontrol", "nscontrol", "asuseragerange", "check", "opaque user", "apple id", "initiate", "asauthorization", "operation", "state", "nserrorenum", "nsdata", "relying party", "asapiavailable", "perform", "realm", "http response", "authorization", "http", "oauth", "saml", "a byte", "nsdata userid", "relying", "a string", "nsdata readdata", "bool didwrite", "a cose", "nsdata first", "nsdata second", "nsstring name", "bool appid", "targetosxr", "nsstring appid", "bluetooth", "mdm profile", "nsurl url", "returns yes", "a state", "a json", "web token", "private seckeys", "enables", "keychain", "asswiftsendable", "cose algorithm", "ecdsa", "sha256", "cose curve", "p256", "nullable", "bool success", "remove", "call", "complete", "initializes", "time code", "extensions", "asextern extern", "asextern", "nsswiftsendable", "prepare", "list", "nsextension", "attempt", "nsstring label", "creates", "nsstring code", "a key", "webauthn", "nssecurecoding", "input", "output", "initialize", "nsinteger rank", "json", "inputs", "hash", "nsstring origin", "settings app", "extension", "https urls", "safari", "cancel", "nsuuid uuid", "r uftpexu", "nsmutabledata", "vnsdate", "mprcjy", "postfix", "domain", "canonical", "tables", "ldap", "post", "replace user", "address", "wietse venema", "bugs", "mail", "aliases", "postfix version", "restrict", "sample", "person", "basic system", "general", "reject empty", "postfix smtp", "ipv6 host", "reject", "reply", "access", "prior", "hold", "info", "mail delivery", "charset", "system", "report", "postfix dsn", "mail returned", "this", "generic", "smtp", "isp mail", "mime", "headerchecks", "readme files", "filters while", "posix", "empty", "body", "write", "date", "smtp server", "specify", "mx host", "unix password", "user unknown", "pathbin", "postfix queue", "unix", "cyrus", "path", "uucp", "shell", "local", "program", "agreement", "contributor", "recipient", "contribution", "the program", "corporation", "contributors", "product x", "as expressly", "arch", "arch x8664", "pipe wall", "wimplicit", "ranlib", "warn", "switch", "start", "systype", "outlook", "postfix master", "begin", "server admin", "mail backend", "modern smtp", "iana", "many", "postfix pipe", "recent cyrus", "amos gouaux", "old example", "or even", "lutz jaenicke", "technology", "cottbus", "germany", "openssl package", "openssl project", "europe", "remember that", "use of", "file", "update", "usrsbin", "file format", "no group", "daemondirectory", "deliver mail", "transport", "description", "result format", "virtual", "virtual alias", "redirect mail", "relocated", "matches user", "synopsis", "lastname", "firstname", "apple computer", "tcpip", "supported", "quantum", "facility", "level", "level info", "broadcast", "ignore", "rules", "sender", "automounter map", "use directory", "get home", "home autohome", "true", "t option", "mount", "force", "environment", "automountdenv", "promptcommand", "shellsessiondir", "histfile", "histfilesize", "myvar", "histtimeformat", "arrange", "bashrematch", "tell", "ps1h", "make bash", "s checkwinsize", "etcbashrc", "termprogram", "inpck", "nnnbaud", "berkeley", "parity", "pc entry", "pass8", "parenb istrip", "fixed speed", "entry", "clocal mode", "maxhistsize", "promptmode", "verbose end", "etcirbrcloaded", "default", "setup", "history file", "kernel", "readline", "jabber", "group database", "dovecot", "postfix scsd", "networkd", "searchpaths", "freebsd", "tmpdir", "fcodes", "prunepaths", "vartmp", "prunedirs", "filesystems", "nroff", "manpath", "uncomment", "manpager", "whatispager", "manlocale", "every", "manpath optman", "maybe", "troff", "status mailfrom", "returnpath via", "pidfile", "flags", "bcgjnuwz", "bin usrsbin", "sbin", "default pf", "care", "audio", "user database", "unix copy", "gate daemon", "bashno", "r etcbashrc", "rfc1323", "m1460", "macos x", "signature", "linux", "opera", "xp sp1", "windows sp1", "nmap syn", "m265", "synack", "mind", "macos", "warp", "ipv6", "internet", "icmp", "cisco", "monitoring", "argus", "chaos", "rsvp", "encapsulation", "aris", "isis", "netbootmount", "netbootshadow", "computername", "localonly", "localnetbootdir", "netboot", "define", "purpose", "networkonly", "waiting", "networkup", "term", "devnull", "common setup", "configure", "set command", "dns hostname", "dns query", "see also", "kame", "sunnet manager", "rpcsrc", "netlicense", "ftpd", "bindash binksh", "binsh bintcsh", "jumpcloud ldap", "smb2", "security", "workgroup", "standalone", "samba server", "enforce", "smb3", "example share", "improper use", "ctrlc", "none", "fax reception", "hardwired", "0007", "must", "visudo", "blocksize", "charset lang", "language lcall", "lines columns", "lscolors", "sshauthsock", "orion", "setup user", "home", "zdotdir", "delete", "beep", "vendor", "kf10", "kf11", "kf12", "kf13", "backspace", "insert", "resume", "termsessionid", "savehist", "sharehistory", "h do", "volume", "de l", "l uuid", "m tra", "n est", "suuid", "prfen", "fusion", "syst", "look", "executant", "alla", "over", "test", "overie", "zapis", "rapid", "disco usa", "de macos", "nie s", "i denne", "adgjmpsvx", "diskgthis disk", "01k8x j", "34disk", "levy kytt", "dict", "array", "plist", "apple root", "code signing", "inode64r", "xofkoxzh", "integer", "doctype", "brain", "abcd", "ogwo", "boaw", "cobwa", "uhawavauatsh", "ip bitmap", "foewdc", "could", "ip block", "funcs", "cogwo", "trash", "double", "hunt", "affa", "carr", "crypto", "docwbac", "q1b0", "q1 0", "h h5", "docwbag", "slice", "format", "zero", "alfa", "hera", "lelei", "hehe", "hisp", "fail", "katy", "zakk", "eodwcbgao", "hhk8di", "alma", "topo", "open", "huhk", "piper", "hehx", "eh ui", "h20hph", "hif h", "hmhhihqhyla hq", "r11b0", "target", "uus10u", "hifh", "loghookfailed", "loghook", "hell", "q1b 0", "f duh", "aqw1", "1160" ], "references": [ "index.html.en", "bind.html", "caching.html", "BUILDING", "configuring.html", "content-negotiation.html", "custom-error.html", "convenience.map", "LDAP.tbd", "lber.h", "ldap.h", "LocalAuthentication.tbd", "arm64e-apple-macos.swiftinterface", "x86_64-apple-ios-macabi.swiftinterface", "arm64e-apple-ios-macabi.swiftinterface", "x86_64-apple-macos.swiftinterface", "MultipeerConnectivity.tbd", "module.modulemap", "MCNearbyServiceAdvertiser.h", "MCPeerID.h", "MCError.h", "MCNearbyServiceBrowser.h", "MCAdvertiserAssistant.h", "MultipeerConnectivity.apinotes", "MultipeerConnectivity.h", "MCSession.h", "MCBrowserViewController.h", "dbivport.h", "dbi_sql.h", "dbd_xsh.h", "dbixs_rev.h", "Driver_xst.h", "DBIXS.h", "hook_op_check.h", "Admin.tbd", "AirPlayReceiver.tbd", "apfs_boot_mount.tbd", "AOSKit.tbd", "APConfigurationSystem.tbd", "AppleFirmwareUpdate.tbd", "launchdaemons.txt", "preboot_archive_errors.log", "mounts.txt", "launchagents.txt", "disk_structure.txt", "user_launchagents.txt", "security_status.txt", "kexts.txt", "process_list.txt", "battery.csv", "diskEncryption.csv", "chromeExtensions.csv", "crashes.csv", "interfaceAddrs.csv", "kernel.csv", "interfaceDetails.csv", "etcHosts.csv", "applications.csv", "mounts.csv", "sharedFolders.csv", "certificates.csv", "sharingPreferences.csv", "launchD.csv", "usbDevices.csv", "managedPolicies.csv", "systemInfo.csv", "users.csv", "sipConfig.csv", "systemControls.csv", "canonical", "aliases", "custom_header_checks", "access", "bounce.cf.default", "generic", "header_checks", "main.cf.default", "LICENSE", "makedefs.out", "main.cf", "master.cf.default", "main.cf.proto", "master.cf.proto", "master.cf", "TLS_LICENSE", "postfix-files", "transport", "virtual", "relocated", "afpovertcp.cfg", "asl.conf", "auto_home", "auto_master", "autofs.conf", "bashrc_Apple_Terminal", "com.apple.screensharing.agent.launchd", "bashrc", "command_args.json", "csh.cshrc", "csh.login", "find.codes", "csh.logout", "ftpusers", "gettytab", "irbrc", "kern_loader.conf", "group", "locate.rc", "man.conf", "mail.rc", "manpaths", "networks", "nfs.conf", "newsyslog.conf", "ntp_opendirectory.conf", "ntp.conf", "notify.conf", "paths", "pf.conf", "passwd", "profile", "pf.os", "protocols", "rc.netboot", "rc.common", "rmtab", "resolv.conf", "rtadvd.conf", "rpc", "shells", "smb.conf", "sudo_lecture", "ttys", "syslog.conf", "xtab", "sudoers", "zprofile", "zshrc", "zshrc_Apple_Terminal", "CodeResources", "version.plist", "Info.plist" ], "public": 1, "adversary": "DragonForce Malaysia Hacker Group", "targeted_countries": [], "malware_families": [ { "id": "Lastname", "display_name": "Lastname", "target": null }, { "id": "Firstname", "display_name": "Firstname", "target": null } ], "attack_ids": [ { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 66, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 4449, "domain": 3847, "URL": 14263, "FileHash-SHA256": 2356, "FileHash-MD5": 223, "FileHash-SHA1": 523, "email": 223, "CVE": 40, "CIDR": 12, "SSLCertFingerprint": 302 }, "indicator_count": 26238, "is_author": false, "is_subscribing": null, "subscriber_count": 37, "modified_text": "386 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66f9ae71e7d4851280fa367f", "name": "The Jane Doe Syndrome Files: Credential Dumping and Data Exfiltration", "description": "This pulse outlines a series of techniques (Tactics) utilized in a cyber intrusion targeting Jane Doe's MacBook. These techniques span various stages of the attack lifecycle, including credential dumping (T1003), system discovery (T1016, T1082), and data exfiltration methods (T1114, T1560). The attacker employed advanced obfuscation strategies (T1027) and input capture methods (T1056) to maintain persistence and evade detection, while also utilizing command and scripting interpreters (T1059) to execute malicious commands.\n\nFurthermore, the adversary manipulated system tokens (T1134) and leveraged remote access software (T1219) to control the compromised system. Techniques for data destruction (T1485) and artifact hiding (T1564) indicate a concerted effort to cover tracks and minimize detection.\n\nBy examining these techniques, we can better understand the methods used in this intrusion, facilitating enhanced detection and prevention strategies for future incidents.", "modified": "2024-11-08T00:03:35.782000", "created": "2024-09-29T19:45:53.583000", "tags": [ "autogenerated", "please", "class", "hp laserjet", "duplexer", "modify", "printer", "description", "location", "share", "printer make", "ppd file", "model", "driver", "ipp everywhere", "printers", "hardware", "baud rate", "parity", "odd data", "flow control", "software", "rtscts", "dtrdsr", "input", "type", "name", "value", "hidden", "delete class", "form", "h2 class", "warning", "p align", "allow", "advanced", "use kerberos", "save", "max clients", "maximum", "metadata", "documents", "max log", "img src", "width", "height", "align", "absmiddle", "indicator", "status", "printername", "idle", "edit", "cupsdconf", "error", "blockquote", "unknown", "h3 class", "jobs", "help jobs", "helptitle", "qtext", "topic", "bmtext", "qptext", "cups", "search", "online help", "documents all", "hold job", "server default", "shared", "test page", "pause class", "accept jobs", "move all", "jobs cancel", "all jobs", "class delete", "cancel", "move job", "destination", "release", "reprint", "action", "method", "name user", "size pages", "state control", "jobid", "withheld", "held", "change settings", "label", "input type", "select name", "multiple size", "option", "inches feet", "table", "submit", "set default", "prev", "next", "last", "accept", "options", "default", "delete printer", "form action", "pause", "reject", "resume", "print", "self test", "pause printer", "location make", "model status", "test", "please stand", "allowed users", "prevent", "whichjobs", "standard rom", "standard", "copyright", "standard font", "cups ppd", "easy software", "apache license", "license", "symbol special", "deskjet", "cups sample", "hplaserjet", "laserjet", "hpdeskjet", "hpdeskjet2", "epson", "stylus color", "stylus photo", "escp", "epson9pin", "zebra", "dymo3x0", "dymo", "labelwriter", "advance", "leading", "move", "black", "gold", "rotate", "never", "cyan", "yellow", "turn", "long edge", "edge", "oversize", "address", "b1jis b1", "adobe", "small", "image", "apple mime", "xhtml", "pict string", "cgimageio", "radiance", "fujifilm", "preview", "os x", "colorsync", "airprint", "do not", "this file", "it is", "you install", "versions of", "base mime", "format", "postscript", "language", "pattern match", "ras2", "pwgraster", "comment", "attr", "group", "attr language", "attr integer", "attr name", "attributes", "attr keyword", "post", "resource admin", "operation", "group operation", "create", "withvalue", "display", "d recipienturi", "expect", "tv d", "member", "createjob", "senddocument", "create faxout", "get list", "display jobname", "cupsgetdevices", "get job", "expect jobstate", "job template", "get printer", "cupsgetppd", "cupsgetppds", "get ppd", "attr text", "product", "psversion", "version", "message", "hello", "cupsgetprinters", "beep", "sound", "count", "ingroup", "oftype keyword", "oftype integer", "oftype text", "oftype charset", "oftype enum", "az09", "withallvalues", "mediaregex", "oftype", "print file", "printjob", "test printjob", "file", "ippurischeme", "member integer", "print test", "printuri", "post resource", "validatejob", "validate", "printjob group", "repeatmatch", "choice", "envelope", "resolution", "modelname", "inputslot", "pcfilename", "modelnumber", "attribute", "false", "darkness", "media", "generic", "mark", "dark", "tear", "cupsbanner show", "header printer", "footer printer", "notice cups", "header cover", "page footer", "cover page", "header top", "secret footer", "top secret", "header secret", "footer secret", "vzefibootloader", "nsunavailable", "virtualization", "base class", "vzbootloader", "network device", "initialize", "host network", "property", "return", "define", "nsarray", "bsd name", "ethernet", "vzconsoledevice", "console port", "defines", "a directory", "vzexport extern", "apiavailable", "bool", "nsenum", "nsinteger", "local file", "raw format", "nsurl", "nserror", "file handle", "storage device", "nserror error", "nsfilehandle", "boot loader", "efi rom", "efi boot", "vzerrorcode", "vzerrordomain", "error type", "nserror domain", "vzerrorsave", "nbd server", "nbd client", "nsoptions", "nsuinteger", "nsswiftname", "nvram", "write", "sorcvbuf", "sosndbuf", "mtu value", "data", "data sent", "true", "graphics", "intel", "indicate", "enable", "nsdata", "opaque", "host audio", "host output", "host input", "cgsize", "new display", "protocol", "unix domain", "socket", "rosetta", "caching", "rosetta daemon", "nsstring", "abstract socket", "rosetta support", "linux", "arm64", "availability", "download", "vzmacaddress", "mac address", "a vzmacaddress", "linux kernel", "ram disk", "linux boot", "a mac", "configuration", "mac hardware", "describes", "mac platform", "mac keyboard", "usb keyboard", "mac machine", "apple silicon", "rosetta runtime", "nsobject", "handle", "init", "url property", "whether", "recovery", "block", "nullable", "load", "mac trackpad", "usb pointing", "cpus", "overwrite", "nsdictionary", "directory share", "check", "namemax", "vznetworkdevice", "nbd url", "nbd uniform", "nbd protocol", "url error", "nat attachment", "a network", "nvm express", "nsscreen", "nssize", "serial port", "directory", "spice agent", "spice guest", "a console", "vzsocketdevice", "vzstoragedevice", "vzexport", "usb controller", "vzusbcontroller", "usb device", "device uuid", "nsuuid uuid", "usb mass", "vzusbdevice", "virtio block", "device", "storage storage", "virtio console", "delegate object", "a class", "extra care", "virtio entropy", "nsstring name", "array", "virtio file", "system device", "discussion", "nsstring tag", "port", "bool isconsole", "a virtio", "virtio graphics", "virtio gpu", "virtio", "port array", "utf8", "virtio network", "macaddress", "virtio socket", "close", "does nothing", "virtio sound", "nsarray streams", "pointer", "device input", "a pcm", "audio stream", "source", "sink", "device output", "device stream", "memory balloon", "target memory", "return yes", "start", "stop", "usb xhci", "automatically", "nsview", "virtual machine", "cpucount", "verify", "apple swift", "o librarylevel", "swift", "cachingoptions", "vzaudiodevice", "vzdebugstub", "swiftname", "targetosiphone", "targetososx", "targetosios", "apple computer", "targetostv", "targetosvision", "targetostvos", "targetosxr", "vtbaseh", "vtint32point", "vtint32size", "iphonena", "apiunavailable", "vtexport const", "abstract", "cfstringref", "readwrite", "cfnumber", "cfboolean", "optional", "null", "macos", "cmnullable", "pass null", "call", "video toolbox", "contains", "cmtime duration", "cvimagebuffer", "vterrorsh", "cfoptions", "12914", "uint32", "osstatus", "12900", "12901", "12902", "12903", "17690", "vtexport", "encoder", "zero", "alpha", "requires", "cmsamplebuffer", "prototype", "osstatus status", "cfrelease", "cvpixelbuffer", "iosurface", "hdr metadata", "hdr per", "frame metadata", "cf type", "cfretain", "a mechanism", "cmbridgedtype", "interface", "specifies", "a reference", "pixel rotation", "session", "a pixel", "cf object", "vtframesilo", "returns", "vtframesiloh", "vtframesiloref", "pass", "pixel transfer", "vtexport void", "media extension", "video raw", "processors", "standard video", "metal device", "metal", "rawprocessors", "cfstring", "copy", "vtsessionh", "cfdictionaryref", "apis", "vtsessionref", "raw processor", "a cfdictionary", "cfswiftname", "vtutilitiesh", "cgimage", "builds", "cfarrayref", "raw processing", "list", "list element", "cfdictionaries", "skipper", "vdspdftexecute", "vdspdftexecuted", "vdspdftzop", "vdspfft16copv", "vdspfft16zopv", "vdspfft32copv", "vdspfft32zopv", "vdspbiquad", "vdspbiquadd", "vdspbiquadm", "project version", "created", "elana stettin", "apple", "swextern", "title", "typedef", "param", "nsstring title", "represents", "nsitemprovider", "const", "swhidden extern", "swdefines", "swextern extern", "sha256 hash", "merkle tree", "sociallayer", "swperson", "devin clary", "swaction", "sbappcontext", "sbapplocator", "sbapplication", "sbelementarray", "sbobject", "scriptingbridge", "objecttype", "finder", "bridge", "index", "apple event", "target", "urls", "locator", "scripting", "desctype", "receiver", "track", "code", "sccontentfilter", "bgra format", "rgha format", "const nonnull", "nserrorenum", "nsurl outputurl", "avfiletypempeg4", "provides", "scwindow", "scdisplay", "cgrect frame", "bool indicating", "pixel", "scstream", "control center", "takes", "cfdictionary", "rbhash", "initvmrandom", "initvmtranscode", "initarray", "initbarevm", "initbignum", "initcomplex", "initcont", "initdir", "initfile", "libxml", "require", "cfpropertylist", "xml parser", "libxmlparser", "xml file", "plist", "cfplisterror", "exception", "format error", "easy", "kruse", "mit license", "standarderror", "cfformaterror", "cftypeerror", "nokogiri", "parserinterface", "cftype", "cfdate", "cfinteger", "blob", "ruby string", "uidfixnum", "ruby integer", "date", "format constant", "formatbinary", "formatxml", "magicnumber", "enumerator", "cfdata", "ruby", "example", "john", "path", "plainparser", "ascii", "cfreal", "importplain", "escapechar", "read", "length", "utf16be", "cfarray", "offsetsize", "integer", "rexml", "rexmlparser", "float", "appledtd plist", "dom node", "prefix", "config", "item", "bindir", "libruby", "rubypath", "fileoperations", "arch", "installer", "template", "install", "major", "yesno", "todo", "kwargs", "makefiles", "miniportile", "cmakecmd", "configure", "cmakefile", "cmake", "keyringname", "debug", "targetos", "ldflags", "gpgexe", "digest", "stdout", "patch", "installerror", "savefile", "task", "packages", "dlext", "minero aoki", "rubyversion", "loaderror", "sqlite3", "was sqlite3", "apiobjects", "database", "pragmas", "resultset", "sqlite3ruby faq", "sqliteruby faq", "value klass", "qnil", "sqliteok", "sqliteerror", "sqliteinternal", "sqliteperm", "sqliteabort", "sqlitebusy", "sqlitelocked", "datagetstruct", "int2num", "main", "done", "stringvalueptr", "note", "sqlite3ruby", "sqlite3rubyptr", "unused", "gnuc", "lclint", "usasciip", "utf8p", "utf16lep", "utf16le", "utf16bep", "sqlite3stmtruby", "rubyplatform", "darwin", "rcarchs", "libpkgconfig", "pkgconfigpath", "pkgconf", "mswin", "cflags", "install sqlite3", "int2fix", "rbignumlen", "sizeofbdigits", "charbit", "bdigit", "bmax", "value unused", "sqliteopenuri", "open", "requireopendb", "nilp", "qtrue", "id2sym", "requireopenstmt", "donep", "rstringlen", "num2int", "attrs", "deal", "xsd module", "xmlparser", "nokogiri xml", "simply", "rubyengine", "slop decorator", "css3 selector", "xpath", "nokogiri class", "parse", "html", "xml document", "0x30", "0x41", "0x61", "gumbogentable", "gumboasciicntrl", "gumboasciispace", "gumboasciidigit", "constfn", "gumboasciih", "gumboasciialpha", "gumboasciialnum", "c0 control", "gumbocharrefh", "gumboattributeh", "gumboattribute", "craig barnes", "google inc", "as is", "basis", "or conditions", "any kind", "gumboerrorh", "gumbotag", "additional", "gumbovector", "encoding", "gumboerrparser", "gumboerrortype", "html tag", "minwordlength", "maxwordlength", "maxhashvalue", "ansic code", "m100 n", "computed", "totalkeywords", "minhashvalue", "doctype", "capacity", "doctype system", "sourcelength", "sourcetext", "silence", "html5", "a struct", "text", "gumbo", "gumboh", "anything", "gumboparserh", "output", "library", "oopstyle", "gumboparser", "const localname", "string", "ietfdtd html", "w3cdtd html", "level", "html strict", "terminator", "final", "buffer", "gnucatleast", "hasattribute", "macrosh", "printf", "returnsnonnull", "win32", "unusedifndebug", "malloc", "pure", "m100", "gumbotaglookuph", "gumbotag tag", "taghashslot", "gumbotagunknown", "gumbotokentypeh", "gumbotokencdata", "gumbotokennull", "gumbotokeneof", "gumbotokentype", "gumbotaglast", "position", "gumbotokenizerh", "struct", "gumbotoken", "spec", "stack", "emittoken", "continue", "current", "utf8iterator", "utf8accept", "parser", "html5 spec", "rest", "gumboutf8h", "unicode code", "html5 parser", "utf8 decoding", "func", "gumbodebug", "gumboutilh", "utility", "debug wrapper", "script", "attribute value", "comment end", "doctype name", "cdata section", "rcdata end", "rawtext end", "initialcapacity", "gumboalloc", "vector", "memmove", "gumbovectorh", "initializes", "ownership", "stringvaluecstr", "rtest", "xmlchar", "html document", "nokogiristrnew2", "html4", "value get", "qfalse", "a list", "value list", "attrsdepr", "attrsopt", "chunk", "pushparser", "xmlsax", "value chunk", "w3c dom", "xmlelementnode", "finds", "qundef", "value val", "value args", "value exc", "libxml2patches", "rbconfig", "packagerootdir", "cppflags", "libs", "dldflags", "nokogiri test", "attributedecl", "defaultvalue", "atype", "tree", "ctxt", "noreturn", "xmldocptr doc", "private", "nokogirinative", "nokogiristrnew", "xmldoc", "value setvalue", "value content", "xmlchar value", "xmlnode cur", "content", "cdata", "cdata element", "value argv", "value rbnode", "document", "value document", "value getname", "pcdata", "element", "mult", "datawrapstruct", "value ctxtval", "mydoc", "userdata", "encodinghandler", "value key", "delete", "elementdecl", "id iddocument", "etype", "value prefix", "orig", "externalid", "systemid", "nodenr", "xmlnodeset", "nodeset", "nodetab", "xmldtd", "value hash", "publicid", "notation", "hash", "rbfuncall", "parseargs", "xmlnode", "without", "href", "xmlns", "namespace node", "nodes", "value rbreader", "relaxng schema", "relaxng", "value name", "nokogirisaxself", "rbivget", "rbstrorqnil", "xmlchar name", "xmlparserctxt", "text element", "value string", "schema", "xmlschema", "context", "stringval", "wrapper", "emp0001n", "emp0002n", "xslt", "handler", "handlerstate", "checktype", "tarray", "id documentid", "comment element", "node", "first", "prop", "typeerror", "gc", "pkpublicchannel", "pkpushpayload", "pkpushregistry", "pkpushtypevoip", "pushkit", "object", "pkpushtype type", "forward", "http", "apple push", "pkexport extern", "nsstringenum", "payload data", "voip", "json format", "callkit", "pkpushtype", "framework", "apps", "push", "odsessioncreate", "odattributemap", "odconfiguration", "odcontext", "odmappings", "odmoduleentry", "odnode", "odquery", "odrecord", "odrecordmap", "nsavailablemac", "original code", "nsstring value", "custom", "modifications", "apple public", "source license", "of any", "nsavailable", "nsrunloop", "objc", "sets", "odsession", "sfauthorization", "will", "odsessionref", "cfexport", "odqueryref", "odnoderef", "cfexport bool", "odrecordref", "cfdataref", "cfexport const", "utf8 encoding", "odattributetype", "odrecordtype", "attribute type", "local", "realm", "cftyperef", "odnodegetdsref", "odnodegettypeid", "odrecorddelete", "odtriggercancel", "odnodeinit", "odquerycreate", "odqueryinit", "odsessioninit", "albuffer3i", "albufferdata", "albufferf", "albufferfv", "albufferi", "albufferiv", "aldistancemodel", "aldopplerfactor", "algetbooleanv", "algetbuffer3f", "alcapi", "alcapientry", "alcboolean", "targetosmac", "alcdevice", "alcenum param", "alalch", "alcchar", "alcsizei", "capture", "alenum param", "alapi", "aluint sid", "alfloat", "aluint bid", "alsizei", "alint", "alfloat value", "alapientry", "aluint", "play", "speed", "bits", "alutapi alvoid", "alvoid data", "alsizei size", "alsizei freq", "gnu library", "general public", "aluth", "alenum format", "openalopenalh", "umbrella header", "alvoid", "openal", "alvoid nonnull", "alenum", "roger beep", "sendable", "preconcurrency", "rawvalue", "network import", "failure", "service", "must", "number", "stride", "brief", "descriptor", "matrix", "mtlpackedfloat3", "infinity", "metalversion", "minimum point", "maximum point", "interpolation", "translation", "offset", "acceleration", "declare", "prior", "insert", "nonnull", "nsrange", "mtldevice", "t argname", "mtlstructtype", "mtlarraytype", "mtltype", "mtlpointertype", "instance", "methodkind", "swiftprivate", "mtlbuffer", "nullability", "mtlcommandqueue", "mtlresource", "mtlresidencyset", "command encoder", "individual", "mtlexport", "xcode", "gpu trace", "apideprecated", "mtlcapturescope", "remarks", "mtlallocation", "metal command", "mtldispatchtype", "mtlorigin", "mtlsize", "mtlblitoption", "flush", "gpu work", "marks", "specify", "mtlinline", "mtlintern", "stdcversion", "mtlextern", "definition", "inline", "nsstring label", "stencil", "defaults", "allocate", "typical", "nsprocessinfo", "mtldrawable", "present", "cftimeinterval", "gpustarttime", "gpuendtime", "mtlcountersh", "mtlcounter", "mtlcounterset", "mtllibrary", "a container", "mtlfence", "mtldatatype", "default usage", "mtlfunction", "mtllogcontainer", "mtlsharedevent", "mtlevent", "synchronously", "a function", "cpu cache", "requiredsize", "behavior", "mtlheap", "query device", "dispatch", "metal shading", "language guide", "raytriangle", "vends", "groups", "encodes", "mtliofilehandle", "mtlextern sizet", "mtlextern void", "mtlstoreaction", "mtlloglevel", "enum", "mtlmutability", "astcetc2bc", "normal", "astc", "clamptoedge", "depth", "mtlcoordinate2d", "nsnumber", "controls", "mtlclearcolor", "adds", "mtlregion", "cpu mapping", "mtltexture", "mtlindextype", "filter option", "clamp", "mtlrenderstages", "draw", "mtlstepfunction", "vertex", "compute", "gpu resource", "nsuinteger x", "identify", "nsuinteger y", "nsuinteger z", "mtlsize size", "mtlvertexformat", "nsuintegermax", "mtlpixelformat", "mtltexturetype", "slice", "swiftui", "coregraphics", "swift import", "previewregistry", "libraryitem", "category", "dict", "apple root", "code signing", "public", "uus10u", "GUANGZHOU FIVE SIX TECHNOLOGY", "Havana Syndrome", "Aishah Lazim", "Al-Arqam", "Brooklyn" ], "references": [ "httpd.exp", "metadata.json", "add-class.tmpl", "choose-make.tmpl", "choose-model.tmpl", "choose-device.tmpl", "add-printer.tmpl", "choose-serial.tmpl", "class-added.tmpl", "choose-uri.tmpl", "class-confirm.tmpl", "admin.tmpl", "class-deleted.tmpl", "class-modified.tmpl", "classes-header.tmpl", "command.tmpl", "classes.tmpl", "edit-config.tmpl", "error-op.tmpl", "class-jobs-header.tmpl", "error.tmpl", "header.tmpl", "help-header.tmpl", "help-printable.tmpl", "help-trailer.tmpl", "job-hold.tmpl", "class.tmpl", "job-cancel.tmpl", "job-move.tmpl", "job-moved.tmpl", "job-release.tmpl", "job-restart.tmpl", "list-available-printers.tmpl", "jobs.tmpl", "norestart.tmpl", "option-boolean.tmpl", "option-header.tmpl", "option-conflict.tmpl", "option-pickmany.tmpl", "option-pickone.tmpl", "modify-printer.tmpl", "option-trailer.tmpl", "pager.tmpl", "printer-cancel-jobs.tmpl", "printer-added.tmpl", "printer-accept.tmpl", "printer-configured.tmpl", "printer-default.tmpl", "printer-confirm.tmpl", "printer-deleted.tmpl", "printer-jobs-header.tmpl", "printer-modified.tmpl", "jobs-header.tmpl", "printer-stop.tmpl", "modify-class.tmpl", "printer-reject.tmpl", "printers-header.tmpl", "printer-start.tmpl", "printer.tmpl", "printers.tmpl", "set-printer-options-trailer.tmpl", "test-page.tmpl", "restart.tmpl", "users.tmpl", "set-printer-options-header.tmpl", "search.tmpl", "trailer.tmpl", "font.defs", "hp.h", "epson.h", "label.h", "raster.defs", "media.defs", "apple.types", "apple.convs", "mime.convs", "mime.types", "cancel-current-job.test", "create-job-sheets.test", "create-job.test", "create-job-format.test", "create-job-timeout.test", "create-printer-subscription.test", "cups-create-local-printer.test", "fax-job.test", "get-completed-jobs.test", "get-devices.test", "get-job-attributes.test", "get-job-attributes2.test", "get-notifications.test", "get-jobs.test", "get-job-template-attributes.test", "get-ppd-printer.test", "get-ppds-drv-only.test", "get-ppd.test", "get-ppds-make-and-model.test", "get-ppds-make.test", "get-ppds-product.test", "get-ppds-psversion.test", "get-ppds-language.test", "get-printer-description-attributes.test", "get-ppds.test", "get-printer-attributes.test", "get-subscriptions.test", "identify-printer-display.test", "get-printers-printer-id.test", "identify-printer-multiple.test", "get-printers.test", "identify-printer.test", "get-printer-attributes-suite.test", "ipp-2.0.test", "ipp-2.2.test", "ipp-backend.test", "ipp-2.1.test", "print-job-and-wait.test", "print-job-deflate.test", "print-job-hold.test", "print-job-gzip.test", "ipp-1.1.test", "print-job-manual.test", "print-job-password.test", "print-job.test", "print-job-media-col.test", "print-uri.test", "print-job-letter.test", "set-attrs-hold.test", "validate-job.test", "ipp-everywhere.test", "sample.drv", "testprint", "classified", "standard", "topsecret", "secret", "confidential", "unclassified", "ntp_opendirectory.conf", "ntp.conf", "notify.conf", "nfs.conf", "nsmb.conf", "xtab", "6015FED9-D723-4332-87D9-C478CF341407.aamdownload", "AuraService-fda-test", "com.adobe.acrobat.rna.AcroCefBrowserLock.DC", "ExmanProcessMutex", "proxy.xml", "A53749AF-3855-4842-A1E7-4AEFA60BD2AC", "XPdb-wal", "VZBootLoader.h", "VZAudioInputStreamSource.h", "VZBridgedNetworkDeviceAttachment.h", "VZAudioOutputStreamSink.h", "VZBridgedNetworkInterface.h", "VZConsoleDeviceConfiguration.h", "VZConsoleDevice.h", "VZConsolePortConfiguration.h", "VZDirectorySharingDevice.h", "VZDirectoryShare.h", "VZDefines.h", "VZDiskImageStorageDeviceAttachment.h", "VZDiskSynchronizationMode.h", "VZDiskBlockDeviceStorageDeviceAttachment.h", "Virtualization.h", "VZDirectorySharingDeviceConfiguration.h", "VZEntropyDeviceConfiguration.h", "VZEFIBootLoader.h", "VZError.h", "VZEFIVariableStore.h", "VZFileHandleNetworkDeviceAttachment.h", "VZFileHandleSerialPortAttachment.h", "VZFileSerialPortAttachment.h", "VZGraphicsDevice.h", "VZGenericPlatformConfiguration.h", "VZGenericMachineIdentifier.h", "VZGraphicsDeviceConfiguration.h", "VZGraphicsDisplayConfiguration.h", "VZHostAudioOutputStreamSink.h", "VZKeyboardConfiguration.h", "VZHostAudioInputStreamSource.h", "VZGraphicsDisplay.h", "VZAudioDeviceConfiguration.h", "VZLinuxRosettaUnixSocketCachingOptions.h", "VZLinuxRosettaAbstractSocketCachingOptions.h", "VZLinuxRosettaDirectoryShare.h", "VZMACAddress.h", "VZLinuxBootLoader.h", "VZMacGraphicsDevice.h", "VZMacGraphicsDisplay.h", "VZMacGraphicsDeviceConfiguration.h", "VZMacHardwareModel.h", "VZMacKeyboardConfiguration.h", "VZMacMachineIdentifier.h", "VZMacOSBootLoader.h", "VZLinuxRosettaCachingOptions.h", "VZMacOSInstaller.h", "VZMacOSVirtualMachineStartOptions.h", "VZMacOSRestoreImage.h", "VZMacTrackpadConfiguration.h", "VZMacOSConfigurationRequirements.h", "VZMemoryBalloonDevice.h", "VZMemoryBalloonDeviceConfiguration.h", "VZMacAuxiliaryStorage.h", "VZMultipleDirectoryShare.h", "VZMacPlatformConfiguration.h", "VZNetworkDevice.h", "VZNetworkBlockDeviceStorageDeviceAttachment.h", "VZNATNetworkDeviceAttachment.h", "VZNetworkDeviceAttachment.h", "VZPlatformConfiguration.h", "VZPointingDeviceConfiguration.h", "VZNetworkDeviceConfiguration.h", "VZSharedDirectory.h", "VZSerialPortAttachment.h", "VZNVMExpressControllerDeviceConfiguration.h", "VZMacGraphicsDisplayConfiguration.h", "VZSerialPortConfiguration.h", "VZSingleDirectoryShare.h", "VZSpiceAgentPortAttachment.h", "VZSocketDeviceConfiguration.h", "VZSocketDevice.h", "VZStorageDevice.h", "VZStorageDeviceAttachment.h", "VZStorageDeviceConfiguration.h", "VZUSBControllerConfiguration.h", "VZUSBDeviceConfiguration.h", "VZUSBMassStorageDevice.h", "VZUSBKeyboardConfiguration.h", "VZUSBController.h", "VZUSBDevice.h", "VZVirtioBlockDeviceConfiguration.h", "VZUSBScreenCoordinatePointingDeviceConfiguration.h", "VZUSBMassStorageDeviceConfiguration.h", "VZVirtioConsoleDevice.h", "VZVirtioConsoleDeviceConfiguration.h", "VZVirtioConsoleDeviceSerialPortConfiguration.h", "VZVirtioEntropyDeviceConfiguration.h", "VZVirtioConsolePort.h", "VZVirtioConsolePortConfigurationArray.h", "VZVirtioFileSystemDevice.h", "VZVirtioConsolePortConfiguration.h", "VZVirtioGraphicsDevice.h", "VZVirtioGraphicsDeviceConfiguration.h", "VZVirtioGraphicsScanout.h", "VZVirtioGraphicsScanoutConfiguration.h", "VZVirtioConsolePortArray.h", "VZVirtioFileSystemDeviceConfiguration.h", "VZVirtioNetworkDeviceConfiguration.h", "VZVirtioSocketConnection.h", "VZVirtioSocketDevice.h", "VZVirtioSoundDeviceConfiguration.h", "VZVirtioSocketListener.h", "VZVirtioSoundDeviceInputStreamConfiguration.h", "VZVirtioSocketDeviceConfiguration.h", "VZVirtioSoundDeviceOutputStreamConfiguration.h", "VZVirtioSoundDeviceStreamConfiguration.h", "VZVirtioTraditionalMemoryBalloonDeviceConfiguration.h", "VZVirtualMachineDelegate.h", "VZVirtualMachineStartOptions.h", "VZVirtioTraditionalMemoryBalloonDevice.h", "VZVirtualMachine.h", "VZXHCIControllerConfiguration.h", "VZVirtualMachineView.h", "VZVirtualMachineConfiguration.h", "VZXHCIController.h", "x86_64-apple-macos.swiftinterface", "arm64e-apple-macos.swiftinterface", "module.modulemap", "Virtualization.tbd", "VideoToolbox.apinotes", "VideoToolbox.h", "VTBase.h", "VTDecompressionProperties.h", "VTCompressionSession.h", "VTErrors.h", "VTCompressionProperties.h", "VTDecompressionSession.h", "VTHDRPerFrameMetadataGenerationSession.h", "VTMultiPassStorage.h", "VTPixelRotationSession.h", "VTFrameSilo.h", "VTPixelRotationProperties.h", "VTPixelTransferSession.h", "VTProfessionalVideoWorkflow.h", "VTRAWProcessingProperties.h", "VTPixelTransferProperties.h", "VTSession.h", "VTUtilities.h", "VTVideoEncoderList.h", "VTRAWProcessingSession.h", "libvDSP.tbd", "SharedWithYouCore.h", "SWAction.h", "SWCollaborationActionHandler.h", "SWCollaborationCoordinator.h", "SWCollaborationMetadata.h", "SWCollaborationOption.h", "SWCollaborationOptionsPickerGroup.h", "SWCollaborationOptionsGroup.h", "SWCollaborationShareOptions.h", "SWDefines.h", "SWPersonIdentity.h", "SWPerson.h", "SWStartCollaborationAction.h", "SWPersonIdentityProof.h", "SWUpdateCollaborationParticipantsAction.h", "SharedWithYouCore.tbd", "ScriptingBridge.tbd", "SBElementArray.h", "ScriptingBridge.apinotes", "ScriptingBridge.h", "SBApplication.h", "SBObject.h", "SCScreenshotManager.h", "SCError.h", "SCRecordingOutput.h", "ScreenCaptureKit.h", "SCShareableContent.h", "SCContentSharingPicker.h", "SCStream.h", "Ruby.tbd", "rbLibXMLParser.rb", "rbCFPlistError.rb", "rbNokogiriParser.rb", "rbCFTypes.rb", "rbCFPropertyList.rb", "rbPlainCFPropertyList.rb", "rbBinaryCFPropertyList.rb", "rbREXMLParser.rb", "cfpropertylist.rb", "setup.rb", "libxml.rb", "xml.rb", "mini_portile_cmake.rb", "version.rb", "mini_portile.rb", "sqlite3.rb", "faq.rb", "exception.c", "backup.h", "backup.c", "database.h", "exception.h", "sqlite3_ruby.h", "statement.h", "extconf.rb", "sqlite3.c", "database.c", "statement.c", "nokogiri.rb", "ascii.c", "ascii.h", "char_ref.h", "attribute.h", "attribute.c", "error.h", "foreign_attrs.c", "insertion_mode.h", "error.c", "gumbo.h", "parser.h", "replacement.h", "parser.c", "string_buffer.h", "string_buffer.c", "string_piece.c", "macros.h", "svg_attrs.c", "tag_lookup.h", "svg_tags.c", "tag_lookup.c", "token_type.h", "tag.c", "token_buffer.h", "token_buffer.c", "tokenizer.h", "tokenizer.c", "utf8.c", "utf8.h", "util.c", "util.h", "tokenizer_states.h", "vector.c", "vector.h", "html4_document.c", "html4_entity_lookup.c", "html4_element_description.c", "html4_sax_push_parser.c", "libxml2_backwards_compat.c", "nokogiri.c", "test_global_handlers.c", "xml_attribute_decl.c", "nokogiri.h", "xml_attr.c", "xml_cdata.c", "xml_document_fragment.c", "xml_document.c", "xml_element_content.c", "html4_sax_parser_context.c", "xml_encoding_handler.c", "xml_element_decl.c", "xml_entity_decl.c", "xml_node_set.c", "xml_dtd.c", "gumbo.c", "xml_namespace.c", "xml_processing_instruction.c", "xml_reader.c", "xml_relax_ng.c", "xml_entity_reference.c", "xml_sax_parser.c", "xml_sax_push_parser.c", "xml_sax_parser_context.c", "xml_text.c", "xml_schema.c", "xml_xpath_context.c", "xslt_stylesheet.c", "xml_syntax_error.c", "xml_comment.c", "xml_node.c", "PushKit.tbd", "PKPushCredentials.h", "PKDefines.h", "PKPushPayload.h", "PushKit.h", "PKPushRegistry.h", "PushKit.apinotes", "OpenDirectory.tbd", "ODAttributeMap.h", "ODMappings.h", "NSOpenDirectory.h", "ODConfiguration.h", "ODQuery.h", "ODNode.h", "OpenDirectory.h", "ODRecordMap.h", "ODSession.h", "ODModuleEntry.h", "ODRecord.h", "CFODContext.h", "CFODSession.h", "CFOpenDirectory.h", "CFODQuery.h", "CFODNode.h", "CFODRecord.h", "CFOpenDirectoryConstants.h", "CFOpenDirectory.tbd", "OpenAL.tbd", "alc.h", "al.h", "alut.h", "OpenAL.h", "MacOSX_OALExtensions.h", "arm64e-apple-ios-macabi.swiftinterface", "x86_64-apple-ios-macabi.swiftinterface", "SwiftUI.swiftoverlay", "MTLAccelerationStructure.h", "Metal.h", "MTLAccelerationStructureTypes.h", "MTLAccelerationStructureCommandEncoder.h", "MTLArgumentEncoder.h", "MTLArgument.h", "MTLBinaryArchive.h", "Metal.apinotes", "MTLBlitPass.h", "MTLBuffer.h", "MTLCaptureManager.h", "MTLCaptureScope.h", "MTLAllocation.h", "MTLCommandEncoder.h", "MTLCommandBuffer.h", "MTLComputePass.h", "MTLBlitCommandEncoder.h", "MTLCommandQueue.h", "MTLDefines.h", "MTLDepthStencil.h", "MTLComputePipeline.h", "MTLDeviceCertification.h", "MTLDrawable.h", "MTLCounters.h", "MTLComputeCommandEncoder.h", "MTLDynamicLibrary.h", "MTLFence.h", "MTLFunctionConstantValues.h", "MTLFunctionDescriptor.h", "MTLFunctionLog.h", "MTLFunctionHandle.h", "MTLEvent.h", "MTLFunctionStitching.h", "MTLHeap.h", "MTLDevice.h", "MTLIndirectCommandBuffer.h", "MTLIntersectionFunctionTable.h", "MTLIOCommandQueue.h", "MTLLinkedFunctions.h", "MTLIOCommandBuffer.h", "MTLIOCompressor.h", "MTLParallelRenderCommandEncoder.h", "MTLLogState.h", "MTLPipeline.h", "MTLLibrary.h", "MTLPixelFormat.h", "MTLRasterizationRate.h", "MTLRenderPass.h", "MTLRenderPipeline.h", "MTLResidencySet.h", "MTLResourceStateCommandEncoder.h", "MTLResourceStatePass.h", "MTLResource.h", "MTLIndirectCommandEncoder.h", "MTLSampler.h", "MTLRenderCommandEncoder.h", "MTLStageInputOutputDescriptor.h", "MTLVisibleFunctionTable.h", "MTLTypes.h", "MTLVertexDescriptor.h", "MTLTexture.h", "WebKit.arm64e.bridgesupport", "WebKit.bridgesupport" ], "public": 1, "adversary": "DragonForce Hacker Group Malaysia", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "VZBootLoader", "display_name": "VZBootLoader", "target": null }, { "id": "TypeError", "display_name": "TypeError", "target": null }, { "id": "GC", "display_name": "GC", "target": null }, { "id": "CFTypeRef", "display_name": "CFTypeRef", "target": null } ], "attack_ids": [ { "id": "T1123", "name": "Audio Capture", "display_name": "T1123 - Audio Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1135", "name": "Network Share Discovery", "display_name": "T1135 - Network Share Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1124", "name": "System Time Discovery", "display_name": "T1124 - System Time Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1550", "name": "Use Alternate Authentication Material", "display_name": "T1550 - Use Alternate Authentication Material" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" } ], "industries": [ "Media" ], "TLP": "white", "cloned_from": null, "export_count": 49, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 346, "FileHash-SHA256": 272, "domain": 110, "hostname": 101, "email": 1, "CVE": 2, "FileHash-SHA1": 1 }, "indicator_count": 833, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "571 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62925b989eba65cefe8c5f88", "name": "Mathworks.com (work in progress) extractor is malfunctioning", "description": "defineProperty(t,n), Object.prototype, E.S.D, e.CmpApiModel, \"DeepClone\", \"deepClones\" - a description of all the functions in this.", "modified": "2022-05-28T17:43:49.055000", "created": "2022-05-28T17:27:52.332000", "tags": [ "optin", "elqsitevisited", "qnew date", "rnew date", "dlkey", "dllookup", "image", "httponly", "typeof e", "typeerror", "typeof symbol", "string", "array", "date", "efunction", "sfunction", "target", "typeof h", "typeof t", "typeof n", "typeof", "copyright", "event", "jquery", "typeof u", "uspapi", "confirmation", "matlab", "matlab speaks", "video", "system toolbox", "international", "learning", "computer vision", "analytics", "toolbox", "shell", "loans", "b0b6c1", "send", "caced6", "qualaroo", "thank", "ffd700", "simulink", "blank", "pass", "undef", "false", "null", "martin", "6464", "12224", "survey", "close", "tools", "python", "typeof require", "error", "modulenotfound", "abcdef", "typeof visitor", "adcloud", "typeof alloy" ], "references": [ "https://quantcast.mgr.consensu.org/tcfv2/27/cmp2.js?referer=m", "https://www.everestjs.net/static/le/last-event-tag-latest.min.js", "https://s3.amazonaws.com/ki.js/49559/ahy.js", "https://rules.quantcount.com/rules-p-zfNtLVVEHXE-1.js", "https://secure.quantserve.com/quant.js", "https://quantcast.mgr.consensu.org/tcfv2/27/cmp2.js?referer=mathworks.com", "https://img03.en25.com/i/elqCfg.min.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 156, "hostname": 192, "URL": 608, "FileHash-SHA256": 22, "FileHash-MD5": 2 }, "indicator_count": 980, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "1465 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "f.read", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "f.read", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780389138.671496 }