{ "type": "URL", "indicator": "https://accounts.com-website33.org", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://accounts.com-website33.org", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3825484511, "indicator": "https://accounts.com-website33.org", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "65c7b86fa120d19bbc88f367", "name": "Hijacker", "description": "Hackers hired to humiliate, threaten,steal data, evidence, recordings , spy and intimidate.", "modified": "2024-03-11T17:01:59.026000", "created": "2024-02-10T17:54:55.243000", "tags": [ "ssl certificate", "whois record", "contacted", "tsara brashears", "referrer", "communicating", "resolutions", "historical ssl", "high level", "hackers", "hacktool", "download", "malware", "crypto", "hijacker", "monitoring", "installer", "tofsee", "domains domains", "domains files", "files files", "script", "kgs0", "kls0", "relic", "iframe", "pe32 executable", "ms windows", "intel", "win16 ne", "os2 executable", "generic windos", "executable", "dos executable", "generic", "rticon neutral", "info compiler", "products id", "header intel", "name md5", "contained", "type", "language", "ico rtgroupicon", "neutral", "first", "utc submissions", "submitters", "company limited", "computer", "amazonaes", "china telecom", "group", "csc corporate", "domains", "malware spreading evader", "cnc", "malvertizing", "milehighmedia", "trojandropper", "moved", "passive dns", "urls", "as14576", "backdoor", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "trojan", "encrypt", "body", "date", "date hash", "avast avg", "mtb may", "kratona", "threat", "paste", "iocs", "analyze", "hostnames", "urls https", "script urls", "united", "meta", "unknown", "emails", "name servers", "search", "as62597 nsone", "a domains", "as397241", "media", "next", "december", "unlocker", "threat round", "apple ios", "apple phone", "project", "blister", "agent tesla", "open", "execution", "videos", "strong", "porn videos", "watch", "daddy", "free", "top rated", "most viewed", "cancel anytime", "views", "play", "black", "enjoy", "czech", "hunk", "virtool", "cryp", "creation date", "otx telemetry", "expiration date", "servers", "status", "win32", "showing", "domain", "nxdomain", "as8075", "shell code", "threat", "cyber espionage", "cyber stalking", "danger", "critical", "attack", "treats", "as15169 google", "aaaa", "record value", "error", "entries", "hostname", "url http", "http", "files domain", "files related", "shinjiru msc", "sdn bhd", "dnssec", "protect", "as54455 madeit", "phishing", "backdoor", "contextualizing", "elevated exposure", "malvertizing", "ransom", "msil", "hackers for hire", "hashes", "http method", "get http", "http requests", "get dns", "ip traffic", "memory pattern", "pattern ips", "@emreimer", "iextract2", "cp cyber", "denver", "security", "siem compliance", "skip", "cybersecurity", "larimer st", "suite", "resources cyber", "risk assessment", "bill", "mind", "delaware", "pa", "arizona", "colorado", "stalkers", "deuteronomy 28:7", "hitmen" ], "references": [ "honey.exe", "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550", "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community", "CS Sigma Rules: Python Initiated Connection by frack113", "CS Sigma Rules: Use Remove-Item to Delete File by frack113", "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)", "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+", "api.login.live.com", "http://appleid.icloud.com-website33.org/", "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]", "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5 [tracking]", "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]", "message.htm.com", "http://pornhub.com/gay/video/search", "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111", "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "W32.Sality.PE", "display_name": "W32.Sality.PE", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Relic", "display_name": "Relic", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Virus.Win32.Virut.q", "display_name": "Virus.Win32.Virut.q", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "TrojanDropper:Win32", "display_name": "TrojanDropper:Win32", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "TA0001", "name": "Initial Access", "display_name": "TA0001 - Initial Access" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0008", "name": "Lateral Movement", "display_name": "TA0008 - Lateral Movement" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0010", "name": "Exfiltration", "display_name": "TA0010 - Exfiltration" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "display_name": "T1036.004 - Masquerade Task or Service" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1415", "name": "URL Scheme Hijacking", "display_name": "T1415 - URL Scheme Hijacking" }, { "id": "T1122", "name": "Component Object Model Hijacking", "display_name": "T1122 - Component Object Model Hijacking" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 54, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6303, "FileHash-MD5": 215, "FileHash-SHA1": 192, "FileHash-SHA256": 2663, "domain": 2673, "hostname": 2686, "CVE": 2, "email": 16 }, "indicator_count": 14750, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "769 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65a94472aa9ff38469be19b0", "name": "trojan.mydoom/memscan | .911porn.org embedded, interacting, Google PlayStore products", "description": "Found in a compromised android phone. Redline Stealer, WebToolbar, SearchSuite. Pseudo Google Chrome. Google PlayStore Wallet won't credit $100's victims Visa & Google Play card . Unhelpful if any responses, multiple complaints by others with same issue. Why not research. Target/ client complained, unhelpful response from developers, Google Chrome changed to a china based pseudo Chrome.", "modified": "2024-02-17T08:04:16.055000", "created": "2024-01-18T15:32:02.682000", "tags": [ "ioc search", "new ioc", "teams api", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "samples", "ssl certificate", "contacted", "network", "whois record", "historical ssl", "malware", "resolutions", "communicating", "referrer", "domains", "registrar", "thnic", "dynadot inc", "final url", "urls", "whois whois", "execution", "contacted urls", "apple", "redline stealer", "core", "subdomains", "first", "utc submissions", "submitters", "ltd dba", "com laude", "edgecast", "gandi sas", "csc corporate", "summary iocs", "facebook", "fbnoscript1", "as14061", "united", "whitelisted", "as16276", "a domains", "united kingdom", "script urls", "name servers", "as9009 m247", "backdoor", "ransom", "meta", "msil", "date", "malvertizing", "elevated exposure", "contextualizing", "cve -2023-22518", "cve-2017-17215", "contains-pe", "upx", "contains-macho attachment", "contains-embedded-js", "nsis", "pecompact", "wear os", "android phone", "gmail app", "smart reply", "meet respond", "meet", "respond", "google", "google chat", "gmail", "et", "playstore", "dns", "browser events", "critical", "tsara brashears", "unhacker" ], "references": [ "http://911porn.org/home.php?mod=space&uid=47570&do=profile&from=space", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "youjazz.911porn.org", "gimmebar.com", "datafoundry.com", "dataconnector.corp.google.com", "js.stripe.com [url redirects to]", "CVE-2023-22518", "https://bi.phncdn.com/www-static/js/lib/generated-lib.js?cache=2017051919", "206.189.61.126 [command and control]", "https://quantilnetworks.com/ [phishing]", "brazzersnetwork.com", "brazzers.com", "http://missing.hi2.ro/missing.html [malware hosting]", "nsscacheserver2.corp.google.com", "xred.mooo.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Netherlands", "Romania", "Russian Federation", "Japan" ], "malware_families": [ { "id": "ALF:Trojan:BAT/EnvVarCharReplacement.Custom", "display_name": "ALF:Trojan:BAT/EnvVarCharReplacement.Custom", "target": null }, { "id": "ALF:Trojan:Win64/PsBanker.MFP!MTB", "display_name": "ALF:Trojan:Win64/PsBanker.MFP!MTB", "target": null }, { "id": "Backdoor:MSIL/AsyncRAT.ZB!MTB", "display_name": "Backdoor:MSIL/AsyncRAT.ZB!MTB", "target": "/malware/Backdoor:MSIL/AsyncRAT.ZB!MTB" }, { "id": "Ransom:Win32/Somhoveran.C", "display_name": "Ransom:Win32/Somhoveran.C", "target": "/malware/Ransom:Win32/Somhoveran.C" }, { "id": "Ransom:Win32/Genasom.AM", "display_name": "Ransom:Win32/Genasom.AM", "target": "/malware/Ransom:Win32/Genasom.AM" }, { "id": "PWS:Win32/PrimaryPass.AD!MTB", "display_name": "PWS:Win32/PrimaryPass.AD!MTB", "target": "/malware/PWS:Win32/PrimaryPass.AD!MTB" }, { "id": "MSIL:GenMalicious-ZC\\ [Trj]", "display_name": "MSIL:GenMalicious-ZC\\ [Trj]", "target": null }, { "id": "Backdoor:Win32/VB.KQ", "display_name": "Backdoor:Win32/VB.KQ", "target": "/malware/Backdoor:Win32/VB.KQ" }, { "id": "Backdoor:Win32/Tofsee.T", "display_name": "Backdoor:Win32/Tofsee.T", "target": "/malware/Backdoor:Win32/Tofsee.T" }, { "id": "Backdoor:MSIL/Bladabindi.AJ", "display_name": "Backdoor:MSIL/Bladabindi.AJ", "target": "/malware/Backdoor:MSIL/Bladabindi.AJ" }, { "id": "trojan.mydoom/memscan", "display_name": "trojan.mydoom/memscan", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "NSIS", "display_name": "NSIS", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 566, "FileHash-SHA1": 324, "FileHash-SHA256": 1828, "URL": 3171, "domain": 1145, "hostname": 1556, "CVE": 2, "email": 4 }, "indicator_count": 8596, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "792 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65aab9b6e5834eef98066f6d", "name": "Author avatar trojan.mydoom/memscan | .911porn.org Google embedded interacting, ", "description": "", "modified": "2024-02-17T08:04:16.055000", "created": "2024-01-19T18:04:38.254000", "tags": [ "ioc search", "new ioc", "teams api", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "samples", "ssl certificate", "contacted", "network", "whois record", "historical ssl", "malware", "resolutions", "communicating", "referrer", "domains", "registrar", "thnic", "dynadot inc", "final url", "urls", "whois whois", "execution", "contacted urls", "apple", "redline stealer", "core", "subdomains", "first", "utc submissions", "submitters", "ltd dba", "com laude", "edgecast", "gandi sas", "csc corporate", "summary iocs", "facebook", "fbnoscript1", "as14061", "united", "whitelisted", "as16276", "a domains", "united kingdom", "script urls", "name servers", "as9009 m247", "backdoor", "ransom", "meta", "msil", "date", "malvertizing", "elevated exposure", "contextualizing", "cve -2023-22518", "cve-2017-17215", "contains-pe", "upx", "contains-macho attachment", "contains-embedded-js", "nsis", "pecompact", "wear os", "android phone", "gmail app", "smart reply", "meet respond", "meet", "respond", "google", "google chat", "gmail", "et", "playstore", "dns", "browser events", "critical", "tsara brashears", "unhacker" ], "references": [ "http://911porn.org/home.php?mod=space&uid=47570&do=profile&from=space", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "youjazz.911porn.org", "gimmebar.com", "datafoundry.com", "dataconnector.corp.google.com", "js.stripe.com [url redirects to]", "CVE-2023-22518", "https://bi.phncdn.com/www-static/js/lib/generated-lib.js?cache=2017051919", "206.189.61.126 [command and control]", "https://quantilnetworks.com/ [phishing]", "brazzersnetwork.com", "brazzers.com", "http://missing.hi2.ro/missing.html [malware hosting]", "nsscacheserver2.corp.google.com", "xred.mooo.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Netherlands", "Romania", "Russian Federation", "Japan" ], "malware_families": [ { "id": "ALF:Trojan:BAT/EnvVarCharReplacement.Custom", "display_name": "ALF:Trojan:BAT/EnvVarCharReplacement.Custom", "target": null }, { "id": "ALF:Trojan:Win64/PsBanker.MFP!MTB", "display_name": "ALF:Trojan:Win64/PsBanker.MFP!MTB", "target": null }, { "id": "Backdoor:MSIL/AsyncRAT.ZB!MTB", "display_name": "Backdoor:MSIL/AsyncRAT.ZB!MTB", "target": "/malware/Backdoor:MSIL/AsyncRAT.ZB!MTB" }, { "id": "Ransom:Win32/Somhoveran.C", "display_name": "Ransom:Win32/Somhoveran.C", "target": "/malware/Ransom:Win32/Somhoveran.C" }, { "id": "Ransom:Win32/Genasom.AM", "display_name": "Ransom:Win32/Genasom.AM", "target": "/malware/Ransom:Win32/Genasom.AM" }, { "id": "PWS:Win32/PrimaryPass.AD!MTB", "display_name": "PWS:Win32/PrimaryPass.AD!MTB", "target": "/malware/PWS:Win32/PrimaryPass.AD!MTB" }, { "id": "MSIL:GenMalicious-ZC\\ [Trj]", "display_name": "MSIL:GenMalicious-ZC\\ [Trj]", "target": null }, { "id": "Backdoor:Win32/VB.KQ", "display_name": "Backdoor:Win32/VB.KQ", "target": "/malware/Backdoor:Win32/VB.KQ" }, { "id": "Backdoor:Win32/Tofsee.T", "display_name": "Backdoor:Win32/Tofsee.T", "target": "/malware/Backdoor:Win32/Tofsee.T" }, { "id": "Backdoor:MSIL/Bladabindi.AJ", "display_name": "Backdoor:MSIL/Bladabindi.AJ", "target": "/malware/Backdoor:MSIL/Bladabindi.AJ" }, { "id": "trojan.mydoom/memscan", "display_name": "trojan.mydoom/memscan", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "NSIS", "display_name": "NSIS", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65a94472aa9ff38469be19b0", "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 566, "FileHash-SHA1": 324, "FileHash-SHA256": 1828, "URL": 3171, "domain": 1145, "hostname": 1556, "CVE": 2, "email": 4 }, "indicator_count": 8596, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "792 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "api.login.live.com", "js.stripe.com [url redirects to]", "CVE-2023-22518", "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+", "nsscacheserver2.corp.google.com", "https://quantilnetworks.com/ [phishing]", "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]", "CS Sigma Rules: Python Initiated Connection by frack113", "youjazz.911porn.org", "brazzers.com", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "http://appleid.icloud.com-website33.org/", "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550", "http://pornhub.com/gay/video/search", "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community", "gimmebar.com", "206.189.61.126 [command and control]", "brazzersnetwork.com", "http://missing.hi2.ro/missing.html [malware hosting]", "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111", "honey.exe", "https://bi.phncdn.com/www-static/js/lib/generated-lib.js?cache=2017051919", "dataconnector.corp.google.com", "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5 [tracking]", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net", "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)", "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "xred.mooo.com", "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats", "datafoundry.com", "CS Sigma Rules: Use Remove-Item to Delete File by frack113", "http://911porn.org/home.php?mod=space&uid=47570&do=profile&from=space", "message.htm.com" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Alf:trojan:win64/psbanker.mfp!mtb", "Pws:win32/primarypass.ad!mtb", "Tofsee", "W32.sality.pe", "Trojandropper:win32", "Msil:genmalicious-zc\\ [trj]", "Backdoor:msil/bladabindi.aj", "Alf:trojan:bat/envvarcharreplacement.custom", "Virus.win32.virut.q", "Backdoor:win32/tofsee.t", "Backdoor:msil/asyncrat.zb!mtb", "Trojanspy", "Virtool", "Relic", "Ransom:win32/genasom.am", "Nsis", "Ransom:win32/somhoveran.c", "Redline stealer", "Hacktool", "Trojan.mydoom/memscan", "Backdoor:win32/vb.kq" ], "industries": [], "unique_indicators": 23997 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/com-website33.org", "whois": "http://whois.domaintools.com/com-website33.org", "domain": "com-website33.org", "hostname": "accounts.com-website33.org" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "65c7b86fa120d19bbc88f367", "name": "Hijacker", "description": "Hackers hired to humiliate, threaten,steal data, evidence, recordings , spy and intimidate.", "modified": "2024-03-11T17:01:59.026000", "created": "2024-02-10T17:54:55.243000", "tags": [ "ssl certificate", "whois record", "contacted", "tsara brashears", "referrer", "communicating", "resolutions", "historical ssl", "high level", "hackers", "hacktool", "download", "malware", "crypto", "hijacker", "monitoring", "installer", "tofsee", "domains domains", "domains files", "files files", "script", "kgs0", "kls0", "relic", "iframe", "pe32 executable", "ms windows", "intel", "win16 ne", "os2 executable", "generic windos", "executable", "dos executable", "generic", "rticon neutral", "info compiler", "products id", "header intel", "name md5", "contained", "type", "language", "ico rtgroupicon", "neutral", "first", "utc submissions", "submitters", "company limited", "computer", "amazonaes", "china telecom", "group", "csc corporate", "domains", "malware spreading evader", "cnc", "malvertizing", "milehighmedia", "trojandropper", "moved", "passive dns", "urls", "as14576", "backdoor", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "trojan", "encrypt", "body", "date", "date hash", "avast avg", "mtb may", "kratona", "threat", "paste", "iocs", "analyze", "hostnames", "urls https", "script urls", "united", "meta", "unknown", "emails", "name servers", "search", "as62597 nsone", "a domains", "as397241", "media", "next", "december", "unlocker", "threat round", "apple ios", "apple phone", "project", "blister", "agent tesla", "open", "execution", "videos", "strong", "porn videos", "watch", "daddy", "free", "top rated", "most viewed", "cancel anytime", "views", "play", "black", "enjoy", "czech", "hunk", "virtool", "cryp", "creation date", "otx telemetry", "expiration date", "servers", "status", "win32", "showing", "domain", "nxdomain", "as8075", "shell code", "threat", "cyber espionage", "cyber stalking", "danger", "critical", "attack", "treats", "as15169 google", "aaaa", "record value", "error", "entries", "hostname", "url http", "http", "files domain", "files related", "shinjiru msc", "sdn bhd", "dnssec", "protect", "as54455 madeit", "phishing", "backdoor", "contextualizing", "elevated exposure", "malvertizing", "ransom", "msil", "hackers for hire", "hashes", "http method", "get http", "http requests", "get dns", "ip traffic", "memory pattern", "pattern ips", "@emreimer", "iextract2", "cp cyber", "denver", "security", "siem compliance", "skip", "cybersecurity", "larimer st", "suite", "resources cyber", "risk assessment", "bill", "mind", "delaware", "pa", "arizona", "colorado", "stalkers", "deuteronomy 28:7", "hitmen" ], "references": [ "honey.exe", "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550", "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community", "CS Sigma Rules: Python Initiated Connection by frack113", "CS Sigma Rules: Use Remove-Item to Delete File by frack113", "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)", "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+", "api.login.live.com", "http://appleid.icloud.com-website33.org/", "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]", "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5 [tracking]", "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]", "message.htm.com", "http://pornhub.com/gay/video/search", "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111", "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "W32.Sality.PE", "display_name": "W32.Sality.PE", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Relic", "display_name": "Relic", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Virus.Win32.Virut.q", "display_name": "Virus.Win32.Virut.q", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "TrojanDropper:Win32", "display_name": "TrojanDropper:Win32", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "TA0001", "name": "Initial Access", "display_name": "TA0001 - Initial Access" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0008", "name": "Lateral Movement", "display_name": "TA0008 - Lateral Movement" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0010", "name": "Exfiltration", "display_name": "TA0010 - Exfiltration" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "display_name": "T1036.004 - Masquerade Task or Service" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1415", "name": "URL Scheme Hijacking", "display_name": "T1415 - URL Scheme Hijacking" }, { "id": "T1122", "name": "Component Object Model Hijacking", "display_name": "T1122 - Component Object Model Hijacking" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 54, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6303, "FileHash-MD5": 215, "FileHash-SHA1": 192, "FileHash-SHA256": 2663, "domain": 2673, "hostname": 2686, "CVE": 2, "email": 16 }, "indicator_count": 14750, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "769 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65a94472aa9ff38469be19b0", "name": "trojan.mydoom/memscan | .911porn.org embedded, interacting, Google PlayStore products", "description": "Found in a compromised android phone. Redline Stealer, WebToolbar, SearchSuite. Pseudo Google Chrome. Google PlayStore Wallet won't credit $100's victims Visa & Google Play card . Unhelpful if any responses, multiple complaints by others with same issue. Why not research. Target/ client complained, unhelpful response from developers, Google Chrome changed to a china based pseudo Chrome.", "modified": "2024-02-17T08:04:16.055000", "created": "2024-01-18T15:32:02.682000", "tags": [ "ioc search", "new ioc", "teams api", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "samples", "ssl certificate", "contacted", "network", "whois record", "historical ssl", "malware", "resolutions", "communicating", "referrer", "domains", "registrar", "thnic", "dynadot inc", "final url", "urls", "whois whois", "execution", "contacted urls", "apple", "redline stealer", "core", "subdomains", "first", "utc submissions", "submitters", "ltd dba", "com laude", "edgecast", "gandi sas", "csc corporate", "summary iocs", "facebook", "fbnoscript1", "as14061", "united", "whitelisted", "as16276", "a domains", "united kingdom", "script urls", "name servers", "as9009 m247", "backdoor", "ransom", "meta", "msil", "date", "malvertizing", "elevated exposure", "contextualizing", "cve -2023-22518", "cve-2017-17215", "contains-pe", "upx", "contains-macho attachment", "contains-embedded-js", "nsis", "pecompact", "wear os", "android phone", "gmail app", "smart reply", "meet respond", "meet", "respond", "google", "google chat", "gmail", "et", "playstore", "dns", "browser events", "critical", "tsara brashears", "unhacker" ], "references": [ "http://911porn.org/home.php?mod=space&uid=47570&do=profile&from=space", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "youjazz.911porn.org", "gimmebar.com", "datafoundry.com", "dataconnector.corp.google.com", "js.stripe.com [url redirects to]", "CVE-2023-22518", "https://bi.phncdn.com/www-static/js/lib/generated-lib.js?cache=2017051919", "206.189.61.126 [command and control]", "https://quantilnetworks.com/ [phishing]", "brazzersnetwork.com", "brazzers.com", "http://missing.hi2.ro/missing.html [malware hosting]", "nsscacheserver2.corp.google.com", "xred.mooo.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Netherlands", "Romania", "Russian Federation", "Japan" ], "malware_families": [ { "id": "ALF:Trojan:BAT/EnvVarCharReplacement.Custom", "display_name": "ALF:Trojan:BAT/EnvVarCharReplacement.Custom", "target": null }, { "id": "ALF:Trojan:Win64/PsBanker.MFP!MTB", "display_name": "ALF:Trojan:Win64/PsBanker.MFP!MTB", "target": null }, { "id": "Backdoor:MSIL/AsyncRAT.ZB!MTB", "display_name": "Backdoor:MSIL/AsyncRAT.ZB!MTB", "target": "/malware/Backdoor:MSIL/AsyncRAT.ZB!MTB" }, { "id": "Ransom:Win32/Somhoveran.C", "display_name": "Ransom:Win32/Somhoveran.C", "target": "/malware/Ransom:Win32/Somhoveran.C" }, { "id": "Ransom:Win32/Genasom.AM", "display_name": "Ransom:Win32/Genasom.AM", "target": "/malware/Ransom:Win32/Genasom.AM" }, { "id": "PWS:Win32/PrimaryPass.AD!MTB", "display_name": "PWS:Win32/PrimaryPass.AD!MTB", "target": "/malware/PWS:Win32/PrimaryPass.AD!MTB" }, { "id": "MSIL:GenMalicious-ZC\\ [Trj]", "display_name": "MSIL:GenMalicious-ZC\\ [Trj]", "target": null }, { "id": "Backdoor:Win32/VB.KQ", "display_name": "Backdoor:Win32/VB.KQ", "target": "/malware/Backdoor:Win32/VB.KQ" }, { "id": "Backdoor:Win32/Tofsee.T", "display_name": "Backdoor:Win32/Tofsee.T", "target": "/malware/Backdoor:Win32/Tofsee.T" }, { "id": "Backdoor:MSIL/Bladabindi.AJ", "display_name": "Backdoor:MSIL/Bladabindi.AJ", "target": "/malware/Backdoor:MSIL/Bladabindi.AJ" }, { "id": "trojan.mydoom/memscan", "display_name": "trojan.mydoom/memscan", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "NSIS", "display_name": "NSIS", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 566, "FileHash-SHA1": 324, "FileHash-SHA256": 1828, "URL": 3171, "domain": 1145, "hostname": 1556, "CVE": 2, "email": 4 }, "indicator_count": 8596, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "792 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65aab9b6e5834eef98066f6d", "name": "Author avatar trojan.mydoom/memscan | .911porn.org Google embedded interacting, ", "description": "", "modified": "2024-02-17T08:04:16.055000", "created": "2024-01-19T18:04:38.254000", "tags": [ "ioc search", "new ioc", "teams api", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "samples", "ssl certificate", "contacted", "network", "whois record", "historical ssl", "malware", "resolutions", "communicating", "referrer", "domains", "registrar", "thnic", "dynadot inc", "final url", "urls", "whois whois", "execution", "contacted urls", "apple", "redline stealer", "core", "subdomains", "first", "utc submissions", "submitters", "ltd dba", "com laude", "edgecast", "gandi sas", "csc corporate", "summary iocs", "facebook", "fbnoscript1", "as14061", "united", "whitelisted", "as16276", "a domains", "united kingdom", "script urls", "name servers", "as9009 m247", "backdoor", "ransom", "meta", "msil", "date", "malvertizing", "elevated exposure", "contextualizing", "cve -2023-22518", "cve-2017-17215", "contains-pe", "upx", "contains-macho attachment", "contains-embedded-js", "nsis", "pecompact", "wear os", "android phone", "gmail app", "smart reply", "meet respond", "meet", "respond", "google", "google chat", "gmail", "et", "playstore", "dns", "browser events", "critical", "tsara brashears", "unhacker" ], "references": [ "http://911porn.org/home.php?mod=space&uid=47570&do=profile&from=space", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "youjazz.911porn.org", "gimmebar.com", "datafoundry.com", "dataconnector.corp.google.com", "js.stripe.com [url redirects to]", "CVE-2023-22518", "https://bi.phncdn.com/www-static/js/lib/generated-lib.js?cache=2017051919", "206.189.61.126 [command and control]", "https://quantilnetworks.com/ [phishing]", "brazzersnetwork.com", "brazzers.com", "http://missing.hi2.ro/missing.html [malware hosting]", "nsscacheserver2.corp.google.com", "xred.mooo.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Netherlands", "Romania", "Russian Federation", "Japan" ], "malware_families": [ { "id": "ALF:Trojan:BAT/EnvVarCharReplacement.Custom", "display_name": "ALF:Trojan:BAT/EnvVarCharReplacement.Custom", "target": null }, { "id": "ALF:Trojan:Win64/PsBanker.MFP!MTB", "display_name": "ALF:Trojan:Win64/PsBanker.MFP!MTB", "target": null }, { "id": "Backdoor:MSIL/AsyncRAT.ZB!MTB", "display_name": "Backdoor:MSIL/AsyncRAT.ZB!MTB", "target": "/malware/Backdoor:MSIL/AsyncRAT.ZB!MTB" }, { "id": "Ransom:Win32/Somhoveran.C", "display_name": "Ransom:Win32/Somhoveran.C", "target": "/malware/Ransom:Win32/Somhoveran.C" }, { "id": "Ransom:Win32/Genasom.AM", "display_name": "Ransom:Win32/Genasom.AM", "target": "/malware/Ransom:Win32/Genasom.AM" }, { "id": "PWS:Win32/PrimaryPass.AD!MTB", "display_name": "PWS:Win32/PrimaryPass.AD!MTB", "target": "/malware/PWS:Win32/PrimaryPass.AD!MTB" }, { "id": "MSIL:GenMalicious-ZC\\ [Trj]", "display_name": "MSIL:GenMalicious-ZC\\ [Trj]", "target": null }, { "id": "Backdoor:Win32/VB.KQ", "display_name": "Backdoor:Win32/VB.KQ", "target": "/malware/Backdoor:Win32/VB.KQ" }, { "id": "Backdoor:Win32/Tofsee.T", "display_name": "Backdoor:Win32/Tofsee.T", "target": "/malware/Backdoor:Win32/Tofsee.T" }, { "id": "Backdoor:MSIL/Bladabindi.AJ", "display_name": "Backdoor:MSIL/Bladabindi.AJ", "target": "/malware/Backdoor:MSIL/Bladabindi.AJ" }, { "id": "trojan.mydoom/memscan", "display_name": "trojan.mydoom/memscan", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "NSIS", "display_name": "NSIS", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65a94472aa9ff38469be19b0", "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 566, "FileHash-SHA1": 324, "FileHash-SHA256": 1828, "URL": 3171, "domain": 1145, "hostname": 1556, "CVE": 2, "email": 4 }, "indicator_count": 8596, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "792 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://accounts.com-website33.org", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://accounts.com-website33.org", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776671690.7876403 }