{ "type": "Domain", "indicator": "facsur.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/facsur.com", "alexa": "http://www.alexa.com/siteinfo/facsur.com", "indicator": "facsur.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2892215416, "indicator": "facsur.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "668115d703e0a46887c7f08d", "name": "Drive-by Compromise | TEL:Trojan:Win32/Injector | Zeus | Ransomware", "description": "Targeted Individual has experienced attacks on both iOS, Android, MacBooks & PC's. Drive-by Compromise can be accomplished by various methods this can be done, for example: A pop up advert could have an 'X' in the corner that disguises itself as a close button, but actually acts as a catalyst for starting a malicious download once pressed. A tactic used on specific target is a pop-up w/with (a non-Google affiliated disclaimer)'Google' account chooser with Google logo desired email checked. [https://accounts.google.com/AccountChooser?]; checked. Every time TB acquired a new phone, this occurs. A link could appear legitimate, but clicking on it could cause the download to begin. Drive-by Compromise \u00b7 A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript.", "modified": "2024-07-30T08:04:39.977000", "created": "2024-06-30T08:22:47.783000", "tags": [ "vj83", "tsara brashears", "malware", "password bypass", "problems", "threat network", "infrastructure", "checking", "china", "iocs", "download", "relic", "monitoring", "installer", "graph", "server", "domain status", "date", "code", "country", "registrar abuse", "registrar", "whois lookup", "admin city", "redmond admin", "analyzer paste", "urls http", "z1277946686", "slfrd1", "uiebaae", "jid960554243", "samples", "malicious url", "z1767086795", "no data", "tag count", "count blacklist", "tag tag", "sample29", "team alexa", "million", "alexa", "site", "cisco umbrella", "hostname", "united", "mail spammer", "malicious site", "covid19", "cyber threat", "filerepmalware", "phishing site", "heur", "engineering", "keybase", "bank", "malicious", "artemis", "phishing", "div div", "domain", "passive dns", "creation date", "as46606", "content type", "script script", "a div", "unknown", "meta", "process32nextw", "medium", "wizard", "registry", "module load", "t1129", "registry run", "keys", "t1060", "memcommit", "win32", "service", "explorer", "june", "copy", "delphi", "tools", "persistence", "execution", "capture", "a dd", "h3 p", "search", "aaaa", "free", "p div", "virtool", "form", "window", "next", "status", "record value", "showing", "cname", "gmt content", "body", "pulses", "urls", "files ip", "address", "location united", "asn as13335", "whois registrar", "as8075", "access", "scan endpoints", "all scoreblue", "ipv4", "pulse pulses", "yara detections", "push", "filehash", "av detections", "ids detections", "alerts", "analysis date", "sec ch", "xml base64", "ch ua", "ua full", "ua platform", "moved", "whois", "trojan", "entries", "gmt server", "centos", "ransom", "detection list", "alexa top", "bluehost", "e emeseieee", "msie", "windows nt", "wow64", "slcc2", "media center", "dynamicloader", "cryptowall", "malware beacon", "suspicious", "zeus", "write", "bits", "date hash", "avast avg", "mtb dec", "script urls", "typeof", "script domains", "as54600 peg", "li ol", "apple", "ios", "samsung", "tracking", "ms windows", "pe32", "read c", "intel", "pe32 executable", "qt translation", "regsetvalueexa", "write c", "show", "april", "observer", "stream", "local", "e eue", "goatsinacoat" ], "references": [ "espysite.azurewebsites.net", "http://45.159.189.105/bot/regex [command and control infection source]", "http://update.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt", "http://www.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt", "http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11", "http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858", "http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11", "https://twitter.com/PORNO_SEXYBABES", "https://adservice.google.com.uy/clk\t init.ess.apple.com", "WinToFlash-Lite-The-Bootable-USB-Creator-1.13.0000-Setup.exe | Setup.Bin Lockbin1.com", "crl.globalsign.com\tWinPCA.crl gscodesigng2.crl crl.globalsign.net root.crl crl.microsoft.com WinPCA.crl analytics.js tracking.minitool.com launch.php", "VTBehaviour.CommonDataStirage.GoogleAPIs.com\t Playatoms-pa.googleapis.com SongCulture.com bam.nr-data.net", "https://www.google.co.kr/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-686301-28&cid=1048899291.1595287580&jid=1064984308&_v=j83&z=1277946686&slf_rd=1&random=491737294", "Yara Detections: Delphi , ProtectSharewareV11eCompservCMS", "Alerts: stops_service network_icmp network_irc persistence_autorun creates_largekey antisandbox_mouse_hook", "Alerts: infostealer_keylogger rat_pcclient process_interest injection_resumethread stealth_hiddenfile", "Domains Contacted: cdn2.minitool.com www.partitionwizard.com", "https://otx.alienvault.com/indicator/file/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "PWS:Win32/Ymacco: FileHash-SHA256 22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "PWS:Win32/Ymacco: FileHash-MD5 0145b299e0d988750bd", "PWS:Win32/Ymacco: FileHash-SHA1 05d3eef1b402fcceced24bd5e8cc3d613c311419", "samsungdevapi.reverselogix.net", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "https://otx.alienvault.com/indicator/hostname/www.partitionwizard.com", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA256 3a8d5782cd3335cb19bc9f1588a9303e7c8bf46aa0a6dd8d9a8fbada0dc23293", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-MD5 502983a98c69c012c600e2a2a7b2a1af", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA1 217eed43662f43704c5c65bbdb503699b8689d6a", "CVE-2017-0147 CVE-2017-11882 CVE-2017-8570 CVE-2018-8453 CVE-2014-0160", "https://otx.alienvault.com/indicator/url/http://www.pulsesolutions.com/WebService/EasyLoggerWebService.asmx/", "Ransom:Win32/Crowti.A: FileHash-SHA256 3328a110970be661ce1267a553fa2ddf", "Ransom:Win32/Crowti.A: FileHash-SHA1 f7e6be8e6b15e4c67d82ec663abee6f0a292ff77", "Ransom:Win32/Crowti.A: FileHash-MD5 3328a110970be661ce1267a553fa2ddf", "https://otx.alienvault.com/indicator/file/94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9", "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com", "Alerts: procmem_yara injection_inter_process injection_create_remote_thread antiav_servicestop suricata_alert suspicious_command_tools", "Alerts: bcdedit_command stealth_network cape_detected_threat deletes_shadow_copies infostealer_cookies", "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA256 00f4950d49404f58e223c0946f18a2a779c502d82ce67d419ce42f794666d3c8", "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA1 fa773890465396aefe1a6b74d107ce1fee664ef9", "TrojanSpy:Win32/Nivdort.DC: FileHash-MD5 ecd1617974166e34de036ddf859a78f6", "Trojan:Win32/Formbook!MTB: FileHash-SHA256 c72bf65e0b2635221ce291191b40ddae3d599e418601dcef5d3ef4ab6e929d5f", "Trojan:Win32/Formbook!MTB: FileHash-SHA1 3bba9a34622ca39fe8b7132da8056a0d8c9be36c", "Trojan:Win32/Formbook!MTB: FileHash-MD5 1f5c006f1ef8d4998c5a6392c4082aef", "VirTool:Win32/Obfuscator.JM: FileHash-SHA256 b4cbdc6fe310af9d4d089d36141ca51d5b91ce877c6d0f6f78fc8bd8e6ce5b37", "https://saptools.mx/files/aud2txt-linux.zip | linuxeater.com | kent@riboe.se | https://saptools.mx/files/aud2txt-linux.zip", "Related Domains By Email DOMAIN ORGANISATION NAME: citrusea.com - Kent Riboe | linuxeater.com - Kent Riboe [kent@riboe.se]", "https://admin.safeid.io/Account/ResetPassword?token=Bx_9HrVhO0ihjnilL3BfcpM9s_1XmMRCAI4Sr1QWsLNmMlpmaAH0DI8fWkk7MSrh", "Tracking: jrstrackingfunction.com | http://tracking.orca-functions.zoovu.solutions/ | http://tracking.orca-functions.zoovu.solutions/", "Tracking: https://sharepointwow.msnd36.com/tracking/lc/3d8656d6-d66c-4b3b-aec3-a363f4faf30f/9d15012d-b2b5-4d70-abb1-eed6eff85f20/7b92544e-3ea3-dccc-179b-fdc110fc452a/", "Tracking: URL http://45.159.189.105/bot/regex | http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11", "Tracking: http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11 No Expiration\t0\t URL http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858&_r=1&z=1767086795", "IDS Detections: Win32/Kapahyku.A Activity 1 PUP/ASMalwNS.A Checkin Observed Suspicious UA (NSIS_Inetc (Mozilla))", "iappletech.com | init.ess.apple.com | https://appliedinnovation.forms.pia.ai/r | join.appliedpsych.com", "Zeus: FileHash-SHA256 94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9", "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "PWS:Win32/Ymacco", "display_name": "PWS:Win32/Ymacco", "target": "/malware/PWS:Win32/Ymacco" }, { "id": "Win.Malware.Swisyn-7610494-0", "display_name": "Win.Malware.Swisyn-7610494-0", "target": null }, { "id": "Win32:VB-AJKP\\ [Trj]", "display_name": "Win32:VB-AJKP\\ [Trj]", "target": null }, { "id": "Win.Malware.Drivepack-9884589-1", "display_name": "Win.Malware.Drivepack-9884589-1", "target": null }, { "id": "TEL:Trojan:Win32/Injector.AB!MSR", "display_name": "TEL:Trojan:Win32/Injector.AB!MSR", "target": null }, { "id": "Ransom:Win32/Crowti.A", "display_name": "Ransom:Win32/Crowti.A", "target": "/malware/Ransom:Win32/Crowti.A" }, { "id": "Zeus", "display_name": "Zeus", "target": null } ], "attack_ids": [ { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1054", "name": "Indicator Blocking", "display_name": "T1054 - Indicator Blocking" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" } ], "industries": [ "Healthcare", "Civil Society", "Targeted Individuals" ], "TLP": "green", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1324, "FileHash-SHA1": 931, "FileHash-SHA256": 2209, "URL": 1572, "hostname": 1628, "domain": 1711, "email": 10, "CVE": 5, "SSLCertFingerprint": 2 }, "indicator_count": 9392, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "629 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6681f270d3801ae3dfde1cd0", "name": "Drive-by Compromise | TEL:Trojan:Win32/Injector | Zeus | Ransomware ", "description": "", "modified": "2024-07-30T08:04:39.977000", "created": "2024-07-01T00:04:00.567000", "tags": [ "vj83", "tsara brashears", "malware", "password bypass", "problems", "threat network", "infrastructure", "checking", "china", "iocs", "download", "relic", "monitoring", "installer", "graph", "server", "domain status", "date", "code", "country", "registrar abuse", "registrar", "whois lookup", "admin city", "redmond admin", "analyzer paste", "urls http", "z1277946686", "slfrd1", "uiebaae", "jid960554243", "samples", "malicious url", "z1767086795", "no data", "tag count", "count blacklist", "tag tag", "sample29", "team alexa", "million", "alexa", "site", "cisco umbrella", "hostname", "united", "mail spammer", "malicious site", "covid19", "cyber threat", "filerepmalware", "phishing site", "heur", "engineering", "keybase", "bank", "malicious", "artemis", "phishing", "div div", "domain", "passive dns", "creation date", "as46606", "content type", "script script", "a div", "unknown", "meta", "process32nextw", "medium", "wizard", "registry", "module load", "t1129", "registry run", "keys", "t1060", "memcommit", "win32", "service", "explorer", "june", "copy", "delphi", "tools", "persistence", "execution", "capture", "a dd", "h3 p", "search", "aaaa", "free", "p div", "virtool", "form", "window", "next", "status", "record value", "showing", "cname", "gmt content", "body", "pulses", "urls", "files ip", "address", "location united", "asn as13335", "whois registrar", "as8075", "access", "scan endpoints", "all scoreblue", "ipv4", "pulse pulses", "yara detections", "push", "filehash", "av detections", "ids detections", "alerts", "analysis date", "sec ch", "xml base64", "ch ua", "ua full", "ua platform", "moved", "whois", "trojan", "entries", "gmt server", "centos", "ransom", "detection list", "alexa top", "bluehost", "e emeseieee", "msie", "windows nt", "wow64", "slcc2", "media center", "dynamicloader", "cryptowall", "malware beacon", "suspicious", "zeus", "write", "bits", "date hash", "avast avg", "mtb dec", "script urls", "typeof", "script domains", "as54600 peg", "li ol", "apple", "ios", "samsung", "tracking", "ms windows", "pe32", "read c", "intel", "pe32 executable", "qt translation", "regsetvalueexa", "write c", "show", "april", "observer", "stream", "local", "e eue", "goatsinacoat" ], "references": [ "espysite.azurewebsites.net", "http://45.159.189.105/bot/regex [command and control infection source]", "http://update.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt", "http://www.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt", "http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11", "http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858", "http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11", "https://twitter.com/PORNO_SEXYBABES", "https://adservice.google.com.uy/clk\t init.ess.apple.com", "WinToFlash-Lite-The-Bootable-USB-Creator-1.13.0000-Setup.exe | Setup.Bin Lockbin1.com", "crl.globalsign.com\tWinPCA.crl gscodesigng2.crl crl.globalsign.net root.crl crl.microsoft.com WinPCA.crl analytics.js tracking.minitool.com launch.php", "VTBehaviour.CommonDataStirage.GoogleAPIs.com\t Playatoms-pa.googleapis.com SongCulture.com bam.nr-data.net", "https://www.google.co.kr/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-686301-28&cid=1048899291.1595287580&jid=1064984308&_v=j83&z=1277946686&slf_rd=1&random=491737294", "Yara Detections: Delphi , ProtectSharewareV11eCompservCMS", "Alerts: stops_service network_icmp network_irc persistence_autorun creates_largekey antisandbox_mouse_hook", "Alerts: infostealer_keylogger rat_pcclient process_interest injection_resumethread stealth_hiddenfile", "Domains Contacted: cdn2.minitool.com www.partitionwizard.com", "https://otx.alienvault.com/indicator/file/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "PWS:Win32/Ymacco: FileHash-SHA256 22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "PWS:Win32/Ymacco: FileHash-MD5 0145b299e0d988750bd", "PWS:Win32/Ymacco: FileHash-SHA1 05d3eef1b402fcceced24bd5e8cc3d613c311419", "samsungdevapi.reverselogix.net", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "https://otx.alienvault.com/indicator/hostname/www.partitionwizard.com", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA256 3a8d5782cd3335cb19bc9f1588a9303e7c8bf46aa0a6dd8d9a8fbada0dc23293", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-MD5 502983a98c69c012c600e2a2a7b2a1af", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA1 217eed43662f43704c5c65bbdb503699b8689d6a", "CVE-2017-0147 CVE-2017-11882 CVE-2017-8570 CVE-2018-8453 CVE-2014-0160", "https://otx.alienvault.com/indicator/url/http://www.pulsesolutions.com/WebService/EasyLoggerWebService.asmx/", "Ransom:Win32/Crowti.A: FileHash-SHA256 3328a110970be661ce1267a553fa2ddf", "Ransom:Win32/Crowti.A: FileHash-SHA1 f7e6be8e6b15e4c67d82ec663abee6f0a292ff77", "Ransom:Win32/Crowti.A: FileHash-MD5 3328a110970be661ce1267a553fa2ddf", "https://otx.alienvault.com/indicator/file/94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9", "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com", "Alerts: procmem_yara injection_inter_process injection_create_remote_thread antiav_servicestop suricata_alert suspicious_command_tools", "Alerts: bcdedit_command stealth_network cape_detected_threat deletes_shadow_copies infostealer_cookies", "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA256 00f4950d49404f58e223c0946f18a2a779c502d82ce67d419ce42f794666d3c8", "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA1 fa773890465396aefe1a6b74d107ce1fee664ef9", "TrojanSpy:Win32/Nivdort.DC: FileHash-MD5 ecd1617974166e34de036ddf859a78f6", "Trojan:Win32/Formbook!MTB: FileHash-SHA256 c72bf65e0b2635221ce291191b40ddae3d599e418601dcef5d3ef4ab6e929d5f", "Trojan:Win32/Formbook!MTB: FileHash-SHA1 3bba9a34622ca39fe8b7132da8056a0d8c9be36c", "Trojan:Win32/Formbook!MTB: FileHash-MD5 1f5c006f1ef8d4998c5a6392c4082aef", "VirTool:Win32/Obfuscator.JM: FileHash-SHA256 b4cbdc6fe310af9d4d089d36141ca51d5b91ce877c6d0f6f78fc8bd8e6ce5b37", "https://saptools.mx/files/aud2txt-linux.zip | linuxeater.com | kent@riboe.se | https://saptools.mx/files/aud2txt-linux.zip", "Related Domains By Email DOMAIN ORGANISATION NAME: citrusea.com - Kent Riboe | linuxeater.com - Kent Riboe [kent@riboe.se]", "https://admin.safeid.io/Account/ResetPassword?token=Bx_9HrVhO0ihjnilL3BfcpM9s_1XmMRCAI4Sr1QWsLNmMlpmaAH0DI8fWkk7MSrh", "Tracking: jrstrackingfunction.com | http://tracking.orca-functions.zoovu.solutions/ | http://tracking.orca-functions.zoovu.solutions/", "Tracking: https://sharepointwow.msnd36.com/tracking/lc/3d8656d6-d66c-4b3b-aec3-a363f4faf30f/9d15012d-b2b5-4d70-abb1-eed6eff85f20/7b92544e-3ea3-dccc-179b-fdc110fc452a/", "Tracking: URL http://45.159.189.105/bot/regex | http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11", "Tracking: http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11 No Expiration\t0\t URL http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858&_r=1&z=1767086795", "IDS Detections: Win32/Kapahyku.A Activity 1 PUP/ASMalwNS.A Checkin Observed Suspicious UA (NSIS_Inetc (Mozilla))", "iappletech.com | init.ess.apple.com | https://appliedinnovation.forms.pia.ai/r | join.appliedpsych.com", "Zeus: FileHash-SHA256 94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9", "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "PWS:Win32/Ymacco", "display_name": "PWS:Win32/Ymacco", "target": "/malware/PWS:Win32/Ymacco" }, { "id": "Win.Malware.Swisyn-7610494-0", "display_name": "Win.Malware.Swisyn-7610494-0", "target": null }, { "id": "Win32:VB-AJKP\\ [Trj]", "display_name": "Win32:VB-AJKP\\ [Trj]", "target": null }, { "id": "Win.Malware.Drivepack-9884589-1", "display_name": "Win.Malware.Drivepack-9884589-1", "target": null }, { "id": "TEL:Trojan:Win32/Injector.AB!MSR", "display_name": "TEL:Trojan:Win32/Injector.AB!MSR", "target": null }, { "id": "Ransom:Win32/Crowti.A", "display_name": "Ransom:Win32/Crowti.A", "target": "/malware/Ransom:Win32/Crowti.A" }, { "id": "Zeus", "display_name": "Zeus", "target": null } ], "attack_ids": [ { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1054", "name": "Indicator Blocking", "display_name": "T1054 - Indicator Blocking" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" } ], "industries": [ "Healthcare", "Civil Society", "Targeted Individuals" ], "TLP": "green", "cloned_from": "668115d703e0a46887c7f08d", "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1324, "FileHash-SHA1": 931, "FileHash-SHA256": 2209, "URL": 1572, "hostname": 1628, "domain": 1711, "email": 10, "CVE": 5, "SSLCertFingerprint": 2 }, "indicator_count": 9392, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "629 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "655076c123a5ab86eb0c8a34", "name": "Luna Moth/Silent Ransom Group Callback Phishing Extortion Campaign", "description": "", "modified": "2023-12-12T06:03:08.751000", "created": "2023-11-12T06:54:57.966000", "tags": [ "unknown", "as8075", "united", "nxdomain", "a nxdomain", "asnone country", "search", "domain", "creation date", "scan endpoints", "date", "new zealand", "ns nxdomain", "aaaa nxdomain", "asnone united", "cname", "asnone", "soa nxdomain", "australia", "status hostname", "domains show", "domain related", "entrie", "ssl certificate", "whois record", "historical ssl", "resolutions", "whois whois", "referrer", "communicating", "siblings", "moth callback", "threat roundup", "june", "record type", "ttl value", "server", "privacy billing", "redacted for", "privacy admin", "postal code", "email", "admin email", "stateprovince", "city", "code", "pty ltd", "registrar abuse", "wholesale pty", "tpp wholesale", "registrar url", "execution", "contacted", "malware", "IPv4 13.75.251.189 scanning_host", "scanning_host", "phishing" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3487, "domain": 1111, "email": 7, "hostname": 1368, "FileHash-MD5": 102, "FileHash-SHA1": 102, "FileHash-SHA256": 663 }, "indicator_count": 6840, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "860 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "655076c8f26b8ab3f641f4ae", "name": "Luna Moth/Silent Ransom Group Callback Phishing Extortion Campaign", "description": "", "modified": "2023-12-12T06:03:08.751000", "created": "2023-11-12T06:55:04.517000", "tags": [ "unknown", "as8075", "united", "nxdomain", "a nxdomain", "asnone country", "search", "domain", "creation date", "scan endpoints", "date", "new zealand", "ns nxdomain", "aaaa nxdomain", "asnone united", "cname", "asnone", "soa nxdomain", "australia", "status hostname", "domains show", "domain related", "entrie", "ssl certificate", "whois record", "historical ssl", "resolutions", "whois whois", "referrer", "communicating", "siblings", "moth callback", "threat roundup", "june", "record type", "ttl value", "server", "privacy billing", "redacted for", "privacy admin", "postal code", "email", "admin email", "stateprovince", "city", "code", "pty ltd", "registrar abuse", "wholesale pty", "tpp wholesale", "registrar url", "execution", "contacted", "malware", "IPv4 13.75.251.189 scanning_host", "scanning_host", "phishing" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3487, "domain": 1111, "email": 7, "hostname": 1368, "FileHash-MD5": 102, "FileHash-SHA1": 102, "FileHash-SHA256": 663 }, "indicator_count": 6840, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "860 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "iappletech.com | init.ess.apple.com | https://appliedinnovation.forms.pia.ai/r | join.appliedpsych.com", "Zeus: FileHash-SHA256 94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9", "samsungdevapi.reverselogix.net", "Trojan:Win32/Formbook!MTB: FileHash-SHA256 c72bf65e0b2635221ce291191b40ddae3d599e418601dcef5d3ef4ab6e929d5f", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA1 217eed43662f43704c5c65bbdb503699b8689d6a", "VTBehaviour.CommonDataStirage.GoogleAPIs.com\t Playatoms-pa.googleapis.com SongCulture.com bam.nr-data.net", "Ransom:Win32/Crowti.A: FileHash-SHA1 f7e6be8e6b15e4c67d82ec663abee6f0a292ff77", "https://admin.safeid.io/Account/ResetPassword?token=Bx_9HrVhO0ihjnilL3BfcpM9s_1XmMRCAI4Sr1QWsLNmMlpmaAH0DI8fWkk7MSrh", "http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11", "crl.globalsign.com\tWinPCA.crl gscodesigng2.crl crl.globalsign.net root.crl crl.microsoft.com WinPCA.crl analytics.js tracking.minitool.com launch.php", "https://otx.alienvault.com/indicator/url/http://www.pulsesolutions.com/WebService/EasyLoggerWebService.asmx/", "Related Domains By Email DOMAIN ORGANISATION NAME: citrusea.com - Kent Riboe | linuxeater.com - Kent Riboe [kent@riboe.se]", "http://45.159.189.105/bot/regex [command and control infection source]", "Tracking: https://sharepointwow.msnd36.com/tracking/lc/3d8656d6-d66c-4b3b-aec3-a363f4faf30f/9d15012d-b2b5-4d70-abb1-eed6eff85f20/7b92544e-3ea3-dccc-179b-fdc110fc452a/", "https://adservice.google.com.uy/clk\t init.ess.apple.com", "Yara Detections: Delphi , ProtectSharewareV11eCompservCMS", "Alerts: infostealer_keylogger rat_pcclient process_interest injection_resumethread stealth_hiddenfile", "http://www.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt", "Tracking: URL http://45.159.189.105/bot/regex | http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11", "https://otx.alienvault.com/indicator/file/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "Ransom:Win32/Crowti.A: FileHash-SHA256 3328a110970be661ce1267a553fa2ddf", "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA256 00f4950d49404f58e223c0946f18a2a779c502d82ce67d419ce42f794666d3c8", "https://otx.alienvault.com/indicator/file/94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9", "IDS Detections: Win32/Kapahyku.A Activity 1 PUP/ASMalwNS.A Checkin Observed Suspicious UA (NSIS_Inetc (Mozilla))", "espysite.azurewebsites.net", "Tracking: jrstrackingfunction.com | http://tracking.orca-functions.zoovu.solutions/ | http://tracking.orca-functions.zoovu.solutions/", "http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858", "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com", "PWS:Win32/Ymacco: FileHash-MD5 0145b299e0d988750bd", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA256 3a8d5782cd3335cb19bc9f1588a9303e7c8bf46aa0a6dd8d9a8fbada0dc23293", "TrojanSpy:Win32/Nivdort.DC: FileHash-MD5 ecd1617974166e34de036ddf859a78f6", "http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11", "Ransom:Win32/Crowti.A: FileHash-MD5 3328a110970be661ce1267a553fa2ddf", "PWS:Win32/Ymacco: FileHash-SHA256 22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "PWS:Win32/Ymacco: FileHash-SHA1 05d3eef1b402fcceced24bd5e8cc3d613c311419", "WinToFlash-Lite-The-Bootable-USB-Creator-1.13.0000-Setup.exe | Setup.Bin Lockbin1.com", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-MD5 502983a98c69c012c600e2a2a7b2a1af", "Alerts: procmem_yara injection_inter_process injection_create_remote_thread antiav_servicestop suricata_alert suspicious_command_tools", "Domains Contacted: cdn2.minitool.com www.partitionwizard.com", "https://www.google.co.kr/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-686301-28&cid=1048899291.1595287580&jid=1064984308&_v=j83&z=1277946686&slf_rd=1&random=491737294", "Tracking: http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11 No Expiration\t0\t URL http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858&_r=1&z=1767086795", "CVE-2017-0147 CVE-2017-11882 CVE-2017-8570 CVE-2018-8453 CVE-2014-0160", "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA1 fa773890465396aefe1a6b74d107ce1fee664ef9", "https://twitter.com/PORNO_SEXYBABES", "Alerts: bcdedit_command stealth_network cape_detected_threat deletes_shadow_copies infostealer_cookies", "http://update.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt", "Trojan:Win32/Formbook!MTB: FileHash-SHA1 3bba9a34622ca39fe8b7132da8056a0d8c9be36c", "VirTool:Win32/Obfuscator.JM: FileHash-SHA256 b4cbdc6fe310af9d4d089d36141ca51d5b91ce877c6d0f6f78fc8bd8e6ce5b37", "https://saptools.mx/files/aud2txt-linux.zip | linuxeater.com | kent@riboe.se | https://saptools.mx/files/aud2txt-linux.zip", "https://otx.alienvault.com/indicator/hostname/www.partitionwizard.com", "Alerts: stops_service network_icmp network_irc persistence_autorun creates_largekey antisandbox_mouse_hook", "Trojan:Win32/Formbook!MTB: FileHash-MD5 1f5c006f1ef8d4998c5a6392c4082aef" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Win.malware.drivepack-9884589-1", "Ransom:win32/crowti.a", "Win.malware.swisyn-7610494-0", "Pws:win32/ymacco", "Win32:vb-ajkp\\ [trj]", "Zeus", "Malware", "Tel:trojan:win32/injector.ab!msr" ], "industries": [ "Targeted individuals", "Civil society", "Healthcare" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "668115d703e0a46887c7f08d", "name": "Drive-by Compromise | TEL:Trojan:Win32/Injector | Zeus | Ransomware", "description": "Targeted Individual has experienced attacks on both iOS, Android, MacBooks & PC's. Drive-by Compromise can be accomplished by various methods this can be done, for example: A pop up advert could have an 'X' in the corner that disguises itself as a close button, but actually acts as a catalyst for starting a malicious download once pressed. A tactic used on specific target is a pop-up w/with (a non-Google affiliated disclaimer)'Google' account chooser with Google logo desired email checked. [https://accounts.google.com/AccountChooser?]; checked. Every time TB acquired a new phone, this occurs. A link could appear legitimate, but clicking on it could cause the download to begin. Drive-by Compromise \u00b7 A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript.", "modified": "2024-07-30T08:04:39.977000", "created": "2024-06-30T08:22:47.783000", "tags": [ "vj83", "tsara brashears", "malware", "password bypass", "problems", "threat network", "infrastructure", "checking", "china", "iocs", "download", "relic", "monitoring", "installer", "graph", "server", "domain status", "date", "code", "country", "registrar abuse", "registrar", "whois lookup", "admin city", "redmond admin", "analyzer paste", "urls http", "z1277946686", "slfrd1", "uiebaae", "jid960554243", "samples", "malicious url", "z1767086795", "no data", "tag count", "count blacklist", "tag tag", "sample29", "team alexa", "million", "alexa", "site", "cisco umbrella", "hostname", "united", "mail spammer", "malicious site", "covid19", "cyber threat", "filerepmalware", "phishing site", "heur", "engineering", "keybase", "bank", "malicious", "artemis", "phishing", "div div", "domain", "passive dns", "creation date", "as46606", "content type", "script script", "a div", "unknown", "meta", "process32nextw", "medium", "wizard", "registry", "module load", "t1129", "registry run", "keys", "t1060", "memcommit", "win32", "service", "explorer", "june", "copy", "delphi", "tools", "persistence", "execution", "capture", "a dd", "h3 p", "search", "aaaa", "free", "p div", "virtool", "form", "window", "next", "status", "record value", "showing", "cname", "gmt content", "body", "pulses", "urls", "files ip", "address", "location united", "asn as13335", "whois registrar", "as8075", "access", "scan endpoints", "all scoreblue", "ipv4", "pulse pulses", "yara detections", "push", "filehash", "av detections", "ids detections", "alerts", "analysis date", "sec ch", "xml base64", "ch ua", "ua full", "ua platform", "moved", "whois", "trojan", "entries", "gmt server", "centos", "ransom", "detection list", "alexa top", "bluehost", "e emeseieee", "msie", "windows nt", "wow64", "slcc2", "media center", "dynamicloader", "cryptowall", "malware beacon", "suspicious", "zeus", "write", "bits", "date hash", "avast avg", "mtb dec", "script urls", "typeof", "script domains", "as54600 peg", "li ol", "apple", "ios", "samsung", "tracking", "ms windows", "pe32", "read c", "intel", "pe32 executable", "qt translation", "regsetvalueexa", "write c", "show", "april", "observer", "stream", "local", "e eue", "goatsinacoat" ], "references": [ "espysite.azurewebsites.net", "http://45.159.189.105/bot/regex [command and control infection source]", "http://update.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt", "http://www.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt", "http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11", "http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858", "http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11", "https://twitter.com/PORNO_SEXYBABES", "https://adservice.google.com.uy/clk\t init.ess.apple.com", "WinToFlash-Lite-The-Bootable-USB-Creator-1.13.0000-Setup.exe | Setup.Bin Lockbin1.com", "crl.globalsign.com\tWinPCA.crl gscodesigng2.crl crl.globalsign.net root.crl crl.microsoft.com WinPCA.crl analytics.js tracking.minitool.com launch.php", "VTBehaviour.CommonDataStirage.GoogleAPIs.com\t Playatoms-pa.googleapis.com SongCulture.com bam.nr-data.net", "https://www.google.co.kr/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-686301-28&cid=1048899291.1595287580&jid=1064984308&_v=j83&z=1277946686&slf_rd=1&random=491737294", "Yara Detections: Delphi , ProtectSharewareV11eCompservCMS", "Alerts: stops_service network_icmp network_irc persistence_autorun creates_largekey antisandbox_mouse_hook", "Alerts: infostealer_keylogger rat_pcclient process_interest injection_resumethread stealth_hiddenfile", "Domains Contacted: cdn2.minitool.com www.partitionwizard.com", "https://otx.alienvault.com/indicator/file/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "PWS:Win32/Ymacco: FileHash-SHA256 22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "PWS:Win32/Ymacco: FileHash-MD5 0145b299e0d988750bd", "PWS:Win32/Ymacco: FileHash-SHA1 05d3eef1b402fcceced24bd5e8cc3d613c311419", "samsungdevapi.reverselogix.net", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "https://otx.alienvault.com/indicator/hostname/www.partitionwizard.com", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA256 3a8d5782cd3335cb19bc9f1588a9303e7c8bf46aa0a6dd8d9a8fbada0dc23293", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-MD5 502983a98c69c012c600e2a2a7b2a1af", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA1 217eed43662f43704c5c65bbdb503699b8689d6a", "CVE-2017-0147 CVE-2017-11882 CVE-2017-8570 CVE-2018-8453 CVE-2014-0160", "https://otx.alienvault.com/indicator/url/http://www.pulsesolutions.com/WebService/EasyLoggerWebService.asmx/", "Ransom:Win32/Crowti.A: FileHash-SHA256 3328a110970be661ce1267a553fa2ddf", "Ransom:Win32/Crowti.A: FileHash-SHA1 f7e6be8e6b15e4c67d82ec663abee6f0a292ff77", "Ransom:Win32/Crowti.A: FileHash-MD5 3328a110970be661ce1267a553fa2ddf", "https://otx.alienvault.com/indicator/file/94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9", "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com", "Alerts: procmem_yara injection_inter_process injection_create_remote_thread antiav_servicestop suricata_alert suspicious_command_tools", "Alerts: bcdedit_command stealth_network cape_detected_threat deletes_shadow_copies infostealer_cookies", "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA256 00f4950d49404f58e223c0946f18a2a779c502d82ce67d419ce42f794666d3c8", "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA1 fa773890465396aefe1a6b74d107ce1fee664ef9", "TrojanSpy:Win32/Nivdort.DC: FileHash-MD5 ecd1617974166e34de036ddf859a78f6", "Trojan:Win32/Formbook!MTB: FileHash-SHA256 c72bf65e0b2635221ce291191b40ddae3d599e418601dcef5d3ef4ab6e929d5f", "Trojan:Win32/Formbook!MTB: FileHash-SHA1 3bba9a34622ca39fe8b7132da8056a0d8c9be36c", "Trojan:Win32/Formbook!MTB: FileHash-MD5 1f5c006f1ef8d4998c5a6392c4082aef", "VirTool:Win32/Obfuscator.JM: FileHash-SHA256 b4cbdc6fe310af9d4d089d36141ca51d5b91ce877c6d0f6f78fc8bd8e6ce5b37", "https://saptools.mx/files/aud2txt-linux.zip | linuxeater.com | kent@riboe.se | https://saptools.mx/files/aud2txt-linux.zip", "Related Domains By Email DOMAIN ORGANISATION NAME: citrusea.com - Kent Riboe | linuxeater.com - Kent Riboe [kent@riboe.se]", "https://admin.safeid.io/Account/ResetPassword?token=Bx_9HrVhO0ihjnilL3BfcpM9s_1XmMRCAI4Sr1QWsLNmMlpmaAH0DI8fWkk7MSrh", "Tracking: jrstrackingfunction.com | http://tracking.orca-functions.zoovu.solutions/ | http://tracking.orca-functions.zoovu.solutions/", "Tracking: https://sharepointwow.msnd36.com/tracking/lc/3d8656d6-d66c-4b3b-aec3-a363f4faf30f/9d15012d-b2b5-4d70-abb1-eed6eff85f20/7b92544e-3ea3-dccc-179b-fdc110fc452a/", "Tracking: URL http://45.159.189.105/bot/regex | http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11", "Tracking: http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11 No Expiration\t0\t URL http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858&_r=1&z=1767086795", "IDS Detections: Win32/Kapahyku.A Activity 1 PUP/ASMalwNS.A Checkin Observed Suspicious UA (NSIS_Inetc (Mozilla))", "iappletech.com | init.ess.apple.com | https://appliedinnovation.forms.pia.ai/r | join.appliedpsych.com", "Zeus: FileHash-SHA256 94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9", "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "PWS:Win32/Ymacco", "display_name": "PWS:Win32/Ymacco", "target": "/malware/PWS:Win32/Ymacco" }, { "id": "Win.Malware.Swisyn-7610494-0", "display_name": "Win.Malware.Swisyn-7610494-0", "target": null }, { "id": "Win32:VB-AJKP\\ [Trj]", "display_name": "Win32:VB-AJKP\\ [Trj]", "target": null }, { "id": "Win.Malware.Drivepack-9884589-1", "display_name": "Win.Malware.Drivepack-9884589-1", "target": null }, { "id": "TEL:Trojan:Win32/Injector.AB!MSR", "display_name": "TEL:Trojan:Win32/Injector.AB!MSR", "target": null }, { "id": "Ransom:Win32/Crowti.A", "display_name": "Ransom:Win32/Crowti.A", "target": "/malware/Ransom:Win32/Crowti.A" }, { "id": "Zeus", "display_name": "Zeus", "target": null } ], "attack_ids": [ { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1054", "name": "Indicator Blocking", "display_name": "T1054 - Indicator Blocking" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" } ], "industries": [ "Healthcare", "Civil Society", "Targeted Individuals" ], "TLP": "green", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1324, "FileHash-SHA1": 931, "FileHash-SHA256": 2209, "URL": 1572, "hostname": 1628, "domain": 1711, "email": 10, "CVE": 5, "SSLCertFingerprint": 2 }, "indicator_count": 9392, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "629 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6681f270d3801ae3dfde1cd0", "name": "Drive-by Compromise | TEL:Trojan:Win32/Injector | Zeus | Ransomware ", "description": "", "modified": "2024-07-30T08:04:39.977000", "created": "2024-07-01T00:04:00.567000", "tags": [ "vj83", "tsara brashears", "malware", "password bypass", "problems", "threat network", "infrastructure", "checking", "china", "iocs", "download", "relic", "monitoring", "installer", "graph", "server", "domain status", "date", "code", "country", "registrar abuse", "registrar", "whois lookup", "admin city", "redmond admin", "analyzer paste", "urls http", "z1277946686", "slfrd1", "uiebaae", "jid960554243", "samples", "malicious url", "z1767086795", "no data", "tag count", "count blacklist", "tag tag", "sample29", "team alexa", "million", "alexa", "site", "cisco umbrella", "hostname", "united", "mail spammer", "malicious site", "covid19", "cyber threat", "filerepmalware", "phishing site", "heur", "engineering", "keybase", "bank", "malicious", "artemis", "phishing", "div div", "domain", "passive dns", "creation date", "as46606", "content type", "script script", "a div", "unknown", "meta", "process32nextw", "medium", "wizard", "registry", "module load", "t1129", "registry run", "keys", "t1060", "memcommit", "win32", "service", "explorer", "june", "copy", "delphi", "tools", "persistence", "execution", "capture", "a dd", "h3 p", "search", "aaaa", "free", "p div", "virtool", "form", "window", "next", "status", "record value", "showing", "cname", "gmt content", "body", "pulses", "urls", "files ip", "address", "location united", "asn as13335", "whois registrar", "as8075", "access", "scan endpoints", "all scoreblue", "ipv4", "pulse pulses", "yara detections", "push", "filehash", "av detections", "ids detections", "alerts", "analysis date", "sec ch", "xml base64", "ch ua", "ua full", "ua platform", "moved", "whois", "trojan", "entries", "gmt server", "centos", "ransom", "detection list", "alexa top", "bluehost", "e emeseieee", "msie", "windows nt", "wow64", "slcc2", "media center", "dynamicloader", "cryptowall", "malware beacon", "suspicious", "zeus", "write", "bits", "date hash", "avast avg", "mtb dec", "script urls", "typeof", "script domains", "as54600 peg", "li ol", "apple", "ios", "samsung", "tracking", "ms windows", "pe32", "read c", "intel", "pe32 executable", "qt translation", "regsetvalueexa", "write c", "show", "april", "observer", "stream", "local", "e eue", "goatsinacoat" ], "references": [ "espysite.azurewebsites.net", "http://45.159.189.105/bot/regex [command and control infection source]", "http://update.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt", "http://www.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt", "http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11", "http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858", "http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11", "https://twitter.com/PORNO_SEXYBABES", "https://adservice.google.com.uy/clk\t init.ess.apple.com", "WinToFlash-Lite-The-Bootable-USB-Creator-1.13.0000-Setup.exe | Setup.Bin Lockbin1.com", "crl.globalsign.com\tWinPCA.crl gscodesigng2.crl crl.globalsign.net root.crl crl.microsoft.com WinPCA.crl analytics.js tracking.minitool.com launch.php", "VTBehaviour.CommonDataStirage.GoogleAPIs.com\t Playatoms-pa.googleapis.com SongCulture.com bam.nr-data.net", "https://www.google.co.kr/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-686301-28&cid=1048899291.1595287580&jid=1064984308&_v=j83&z=1277946686&slf_rd=1&random=491737294", "Yara Detections: Delphi , ProtectSharewareV11eCompservCMS", "Alerts: stops_service network_icmp network_irc persistence_autorun creates_largekey antisandbox_mouse_hook", "Alerts: infostealer_keylogger rat_pcclient process_interest injection_resumethread stealth_hiddenfile", "Domains Contacted: cdn2.minitool.com www.partitionwizard.com", "https://otx.alienvault.com/indicator/file/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "PWS:Win32/Ymacco: FileHash-SHA256 22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "PWS:Win32/Ymacco: FileHash-MD5 0145b299e0d988750bd", "PWS:Win32/Ymacco: FileHash-SHA1 05d3eef1b402fcceced24bd5e8cc3d613c311419", "samsungdevapi.reverselogix.net", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269", "https://otx.alienvault.com/indicator/hostname/www.partitionwizard.com", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA256 3a8d5782cd3335cb19bc9f1588a9303e7c8bf46aa0a6dd8d9a8fbada0dc23293", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-MD5 502983a98c69c012c600e2a2a7b2a1af", "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA1 217eed43662f43704c5c65bbdb503699b8689d6a", "CVE-2017-0147 CVE-2017-11882 CVE-2017-8570 CVE-2018-8453 CVE-2014-0160", "https://otx.alienvault.com/indicator/url/http://www.pulsesolutions.com/WebService/EasyLoggerWebService.asmx/", "Ransom:Win32/Crowti.A: FileHash-SHA256 3328a110970be661ce1267a553fa2ddf", "Ransom:Win32/Crowti.A: FileHash-SHA1 f7e6be8e6b15e4c67d82ec663abee6f0a292ff77", "Ransom:Win32/Crowti.A: FileHash-MD5 3328a110970be661ce1267a553fa2ddf", "https://otx.alienvault.com/indicator/file/94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9", "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com", "Alerts: procmem_yara injection_inter_process injection_create_remote_thread antiav_servicestop suricata_alert suspicious_command_tools", "Alerts: bcdedit_command stealth_network cape_detected_threat deletes_shadow_copies infostealer_cookies", "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA256 00f4950d49404f58e223c0946f18a2a779c502d82ce67d419ce42f794666d3c8", "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA1 fa773890465396aefe1a6b74d107ce1fee664ef9", "TrojanSpy:Win32/Nivdort.DC: FileHash-MD5 ecd1617974166e34de036ddf859a78f6", "Trojan:Win32/Formbook!MTB: FileHash-SHA256 c72bf65e0b2635221ce291191b40ddae3d599e418601dcef5d3ef4ab6e929d5f", "Trojan:Win32/Formbook!MTB: FileHash-SHA1 3bba9a34622ca39fe8b7132da8056a0d8c9be36c", "Trojan:Win32/Formbook!MTB: FileHash-MD5 1f5c006f1ef8d4998c5a6392c4082aef", "VirTool:Win32/Obfuscator.JM: FileHash-SHA256 b4cbdc6fe310af9d4d089d36141ca51d5b91ce877c6d0f6f78fc8bd8e6ce5b37", "https://saptools.mx/files/aud2txt-linux.zip | linuxeater.com | kent@riboe.se | https://saptools.mx/files/aud2txt-linux.zip", "Related Domains By Email DOMAIN ORGANISATION NAME: citrusea.com - Kent Riboe | linuxeater.com - Kent Riboe [kent@riboe.se]", "https://admin.safeid.io/Account/ResetPassword?token=Bx_9HrVhO0ihjnilL3BfcpM9s_1XmMRCAI4Sr1QWsLNmMlpmaAH0DI8fWkk7MSrh", "Tracking: jrstrackingfunction.com | http://tracking.orca-functions.zoovu.solutions/ | http://tracking.orca-functions.zoovu.solutions/", "Tracking: https://sharepointwow.msnd36.com/tracking/lc/3d8656d6-d66c-4b3b-aec3-a363f4faf30f/9d15012d-b2b5-4d70-abb1-eed6eff85f20/7b92544e-3ea3-dccc-179b-fdc110fc452a/", "Tracking: URL http://45.159.189.105/bot/regex | http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11", "Tracking: http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11 No Expiration\t0\t URL http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858&_r=1&z=1767086795", "IDS Detections: Win32/Kapahyku.A Activity 1 PUP/ASMalwNS.A Checkin Observed Suspicious UA (NSIS_Inetc (Mozilla))", "iappletech.com | init.ess.apple.com | https://appliedinnovation.forms.pia.ai/r | join.appliedpsych.com", "Zeus: FileHash-SHA256 94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9", "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "PWS:Win32/Ymacco", "display_name": "PWS:Win32/Ymacco", "target": "/malware/PWS:Win32/Ymacco" }, { "id": "Win.Malware.Swisyn-7610494-0", "display_name": "Win.Malware.Swisyn-7610494-0", "target": null }, { "id": "Win32:VB-AJKP\\ [Trj]", "display_name": "Win32:VB-AJKP\\ [Trj]", "target": null }, { "id": "Win.Malware.Drivepack-9884589-1", "display_name": "Win.Malware.Drivepack-9884589-1", "target": null }, { "id": "TEL:Trojan:Win32/Injector.AB!MSR", "display_name": "TEL:Trojan:Win32/Injector.AB!MSR", "target": null }, { "id": "Ransom:Win32/Crowti.A", "display_name": "Ransom:Win32/Crowti.A", "target": "/malware/Ransom:Win32/Crowti.A" }, { "id": "Zeus", "display_name": "Zeus", "target": null } ], "attack_ids": [ { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1054", "name": "Indicator Blocking", "display_name": "T1054 - Indicator Blocking" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" } ], "industries": [ "Healthcare", "Civil Society", "Targeted Individuals" ], "TLP": "green", "cloned_from": "668115d703e0a46887c7f08d", "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1324, "FileHash-SHA1": 931, "FileHash-SHA256": 2209, "URL": 1572, "hostname": 1628, "domain": 1711, "email": 10, "CVE": 5, "SSLCertFingerprint": 2 }, "indicator_count": 9392, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "629 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "655076c123a5ab86eb0c8a34", "name": "Luna Moth/Silent Ransom Group Callback Phishing Extortion Campaign", "description": "", "modified": "2023-12-12T06:03:08.751000", "created": "2023-11-12T06:54:57.966000", "tags": [ "unknown", "as8075", "united", "nxdomain", "a nxdomain", "asnone country", "search", "domain", "creation date", "scan endpoints", "date", "new zealand", "ns nxdomain", "aaaa nxdomain", "asnone united", "cname", "asnone", "soa nxdomain", "australia", "status hostname", "domains show", "domain related", "entrie", "ssl certificate", "whois record", "historical ssl", "resolutions", "whois whois", "referrer", "communicating", "siblings", "moth callback", "threat roundup", "june", "record type", "ttl value", "server", "privacy billing", "redacted for", "privacy admin", "postal code", "email", "admin email", "stateprovince", "city", "code", "pty ltd", "registrar abuse", "wholesale pty", "tpp wholesale", "registrar url", "execution", "contacted", "malware", "IPv4 13.75.251.189 scanning_host", "scanning_host", "phishing" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3487, "domain": 1111, "email": 7, "hostname": 1368, "FileHash-MD5": 102, "FileHash-SHA1": 102, "FileHash-SHA256": 663 }, "indicator_count": 6840, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "860 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "655076c8f26b8ab3f641f4ae", "name": "Luna Moth/Silent Ransom Group Callback Phishing Extortion Campaign", "description": "", "modified": "2023-12-12T06:03:08.751000", "created": "2023-11-12T06:55:04.517000", "tags": [ "unknown", "as8075", "united", "nxdomain", "a nxdomain", "asnone country", "search", "domain", "creation date", "scan endpoints", "date", "new zealand", "ns nxdomain", "aaaa nxdomain", "asnone united", "cname", "asnone", "soa nxdomain", "australia", "status hostname", "domains show", "domain related", "entrie", "ssl certificate", "whois record", "historical ssl", "resolutions", "whois whois", "referrer", "communicating", "siblings", "moth callback", "threat roundup", "june", "record type", "ttl value", "server", "privacy billing", "redacted for", "privacy admin", "postal code", "email", "admin email", "stateprovince", "city", "code", "pty ltd", "registrar abuse", "wholesale pty", "tpp wholesale", "registrar url", "execution", "contacted", "malware", "IPv4 13.75.251.189 scanning_host", "scanning_host", "phishing" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3487, "domain": 1111, "email": 7, "hostname": 1368, "FileHash-MD5": 102, "FileHash-SHA1": 102, "FileHash-SHA256": 663 }, "indicator_count": 6840, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "860 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "facsur.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "facsur.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1776703656.1286242 }