{ "type": "URL", "indicator": "https://app.joinchorus.com/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://app.joinchorus.com/", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3927087586, "indicator": "https://app.joinchorus.com/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "692f04e9fa3d782118e94aac", "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed", "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.", "modified": "2026-01-01T15:04:20.907000", "created": "2025-12-02T15:25:29.158000", "tags": [ "levelblue", "open threat", "dynamicloader", "tlsv1", "high", "msie", "windows nt", "delete c", "fwlink", "stream", "powershell", "write", "malware", "local", "united", "flag", "date", "server", "crazy egg", "name server", "gmt flag", "domain address", "markmonitor", "enom", "sugges", "onv incude", "data upload", "find s", "extraction", "types", "type", "indicator", "click", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "dns requests", "contacted hosts", "search", "entries", "read c", "medium", "memcommit", "tls handshake", "failure", "module load", "next", "execution", "dock", "capture", "persistence", "copy", "unknown", "suricata alert", "et info", "bad traffic", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "adversaries", "spawns", "t1480 execution", "file defense", "write c", "x02x82", "xe6x15c6", "x16f", "xc0xc0xc0", "revengerat", "guard", "service", "encrypt", "entries yara", "delphi", "win32", "jordan", "delete app" ], "references": [ "https://otx.alienvault.com/indicator/domain/Tamlegal.com", "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz", "endgames.com \u2022 endgames.us \u2022 endgamesystems.com \u2022 http://www.onyx-ware.com/lander", "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Vmprotect-9880726-0", "display_name": "Win.Malware.Vmprotect-9880726-0", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" } ], "industries": [ "Technology", "Legal" ], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4624, "FileHash-SHA256": 2021, "FileHash-MD5": 51, "FileHash-SHA1": 20, "SSLCertFingerprint": 10, "hostname": 1433, "domain": 728 }, "indicator_count": 8887, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "107 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "692cb6dc24da17618e3d9da6", "name": "Mirai Botnet | HackTool Powershell targets LinkedIn User | 192.168.1.1 \u2022 Remote Inbound Outbound Connection", "description": "Linux Malware - LinkedIn- True Mirai Botnet (192.168.1.1) (Never Connect) Incredibly powerful attack targeting LinkedIn users. In this instance the target is an ex husband of a target. |\nNDO Group relationships seen. This is a Botnet. \n\nMay be \u2018framing\u2019 attack that was launched in 2014. Attackers sent a clear message to target that she + husband would be arrested and charged with possession of 1000\u2019s of \u2018child pornography\u2019 pictures. \n\nAttack 10/10 malicious. Worked from separate system in separate location. Hackers unlocked a device, zero clicks, removed PSW. Tulach malware seen a profile \u2018Michael Robert\u2019s of Rexxfield\u2019 may be entity (NSA) with a face like Tulach. Uses the most WILD compromises. Government contractors? \n\nSame attackers brought down Prudentials \u2018Assurance\u2019 Medicare system forever.\n ESET hackers only allowing \u2018bad traffic\u2019 .", "modified": "2025-12-30T19:04:40.430000", "created": "2025-11-30T21:27:56.239000", "tags": [ "enter", "extract", "enter source", "urls", "address", "remote connect", "private ip", "sql", "inject", "montserrat", "script urls", "germany unknown", "xml title", "wiesinger", "style", "ip address", "script domains", "body doctype", "encrypt", "botnet", "dropper", "unix", "resolverror", "et exploit", "outbound", "mirai variant", "useragent", "inbound", "et trojan", "et webserver", "scan mirai", "hello", "execution", "mirai", "malware", "shell", "nids", "ids detections", "wget command", "http headers", "dlink devices", "home network", "mvpower dvr", "shell uce", "mirai elf", "linux malware", "is__elf", "cnc", "meta http", "content", "gmt server", "files", "reverse dns", "germany", "ismaning", "germany asn", "as5539 spacenet", "germany https", "auto generated security (?)", "redacted for", "name servers", "aaaa", "search", "for privacy", "title", "intel", "ms windows", "pe32", "process32nextw", "write c", "mssql port", "hash", "beapy", "bit32bit", "agent", "write", "hacktool", "win32", "next", "suspicious user", "pybeapy cnc", "checkin", "w32beapy cnc", "beacon", "module load", "external ip", "lookup", "home assistant", "intptr", "uint32", "type", "parameter", "oldprotectflag", "mandatory", "throw", "position", "lkshkdandl", "success", "info", "powershell", "null", "error", "date hash", "next yara", "detections name", "medium", "graph tree", "sample", "sample hash", "exec bypass", "c ipconfig", "world", "jaws webserver", "chmod usage", "strings", "extraction", "data upload", "extre", "include data", "hos hos", "y se", "sugges", "find s", "typ hos", "hos data", "hos hostname", "hos host", "extr data", "tethering", "tulach", "114.114.114.114", "passive dns", "pulse pulses", "http", "related nids", "files location", "united", "flag united", "files domain", "next associated", "ipv4 add", "delphi", "read c", "packing t1045", "t1045", "worm", "code", "june", "irc nick command", "irc", "meta", "status", "record value", "unknown aaaa", "expiration", "url http", "indicator role", "pulses url", "no expiration", "url https", "url url", "o url", "request review", "hosting", "unknown", "medium security", "extra data", "failed", "linkedin", "url add", "ireland flag", "ireland", "dublin", "ireland asn", "as16509", "spyware", "nso", "nso group", "pegasus related", "nso related", "framing", "porn", "python", "flag", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "dns requests", "domain address", "contacted hosts", "apple", "192.168.1.1", "law", "attorney" ], "references": [ "192.168.1.1 - WOW! Use your old equipment in a non - residential environment", "http://xn.com/ \u2022 www.xn--linkedinxn-6u6e.com \u2022 http://www.linkedin-xn.com/ \u2022 www.linkedin-xn.com", "Powerful Exploit: https://otx.alienvault.com/indicator/file/ba32802bdd1f0b91cf8c667b94426d73ee654ba0", "Mirai Botnet - *Inbound & Outbound connection", "IDS Detections: *WGET Command Specifying Output in HTTP Headers", "IDS Detections: *D-Link Devices Home Network Administration Protocol Command Execution", "IDS Detections: *JAWS Webserver Unauthenticated Shell Command Execution", "IDS Detections: *MVPower DVR Shell UCE *Mirai Variant User-Agent (Outbound)", "Yara : Yara Detections : SUSP_XORed_Mozilla , Linux_MiningSoftware , is__elf", "Alerts : dead_host nids_exploit_alert nids_malware_alert persistency_initd network_icmp", "Alerts : tcp_syn_scan nolookup_communication network_cnc_http network_http", "Alerts : network_http_post nids_alert chmod_syscall writes_to_stdout", "Other Mitre ATT&CK T1480 T1553.00 T1027.013 T1057 T1069.002 T1071\tT1071.004", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.pornhub.com/video/search?search=tsara+brashears", "http://www.anyxxxtube.net/search-porn/tsara-brashears", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "pornokind.vgt.pl \u2022 https://pornokind.vgt.pl \u2022 https://www.pornokind.vgt.pl \u2022 https://www.pornokind.vgt.pl/", "pornlynx.com \u2022 www.pornhub.com \u2022 www.anyxxxtube.com", "https://frostty12ice.info/ \u2022 https://lawhubh.info", "Needs researching: http://lib.jerusalem.muni.il.il \u2022 https://lib.jerusalem.muni.il.il" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Unix.Dropper.Botnet-6566040-0", "display_name": "Unix.Dropper.Botnet-6566040-0", "target": null }, { "id": "NIDS", "display_name": "NIDS", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Montserrat", "display_name": "Montserrat", "target": null }, { "id": "Beapy", "display_name": "Beapy", "target": null }, { "id": "HackTool:Win32/PowerSploit!rfn", "display_name": "HackTool:Win32/PowerSploit!rfn", "target": "/malware/HackTool:Win32/PowerSploit!rfn" }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Worm:Win32/Mydoom.PB!MTB", "display_name": "Worm:Win32/Mydoom.PB!MTB", "target": "/malware/Worm:Win32/Mydoom.PB!MTB" } ], "attack_ids": [ { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "TA0036", "name": "Exfiltration", "display_name": "TA0036 - Exfiltration" }, { "id": "TA0039", "name": "Remote Service Effects", "display_name": "TA0039 - Remote Service Effects" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1016.001", "name": "Internet Connection Discovery", "display_name": "T1016.001 - Internet Connection Discovery" }, { "id": "T1583.004", "name": "Server", "display_name": "T1583.004 - Server" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1098", "name": "Account Manipulation", "display_name": "T1098 - Account Manipulation" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1019", "name": "System Firmware", "display_name": "T1019 - System Firmware" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553.001", "name": "Gatekeeper Bypass", "display_name": "T1553.001 - Gatekeeper Bypass" }, { "id": "T1027.005", "name": "Indicator Removal from Tools", "display_name": "T1027.005 - Indicator Removal from Tools" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1585.001", "name": "Social Media Accounts", "display_name": "T1585.001 - Social Media Accounts" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1609", "name": "Container Administration Command", "display_name": "T1609 - Container Administration Command" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1059.006", "name": "Python", "display_name": "T1059.006 - Python" } ], "industries": [ "Government", "Legal", "Healthcare", "Insurance", "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4147, "domain": 871, "hostname": 2194, "FileHash-MD5": 279, "FileHash-SHA1": 257, "FileHash-SHA256": 2183, "CVE": 6, "email": 3, "SSLCertFingerprint": 1 }, "indicator_count": 9941, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "109 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "IDS Detections: *WGET Command Specifying Output in HTTP Headers", "IDS Detections: *JAWS Webserver Unauthenticated Shell Command Execution", "pornokind.vgt.pl \u2022 https://pornokind.vgt.pl \u2022 https://www.pornokind.vgt.pl \u2022 https://www.pornokind.vgt.pl/", "192.168.1.1 - WOW! Use your old equipment in a non - residential environment", "http://www.anyxxxtube.net/search-porn/tsara-brashears", "endgames.com \u2022 endgames.us \u2022 endgamesystems.com \u2022 http://www.onyx-ware.com/lander", "IDS Detections: *D-Link Devices Home Network Administration Protocol Command Execution", "Yara : Yara Detections : SUSP_XORed_Mozilla , Linux_MiningSoftware , is__elf", "https://otx.alienvault.com/indicator/domain/Tamlegal.com", "Other Mitre ATT&CK T1480 T1553.00 T1027.013 T1057 T1069.002 T1071\tT1071.004", "Alerts : network_http_post nids_alert chmod_syscall writes_to_stdout", "Needs researching: http://lib.jerusalem.muni.il.il \u2022 https://lib.jerusalem.muni.il.il", "Mirai Botnet - *Inbound & Outbound connection", "Alerts : dead_host nids_exploit_alert nids_malware_alert persistency_initd network_icmp", "http://xn.com/ \u2022 www.xn--linkedinxn-6u6e.com \u2022 http://www.linkedin-xn.com/ \u2022 www.linkedin-xn.com", "Alerts : tcp_syn_scan nolookup_communication network_cnc_http network_http", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.pornhub.com/video/search?search=tsara+brashears", "pornlynx.com \u2022 www.pornhub.com \u2022 www.anyxxxtube.com", "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev", "IDS Detections: *MVPower DVR Shell UCE *Mirai Variant User-Agent (Outbound)", "https://frostty12ice.info/ \u2022 https://lawhubh.info", "Powerful Exploit: https://otx.alienvault.com/indicator/file/ba32802bdd1f0b91cf8c667b94426d73ee654ba0", "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz", "http://www.anyxxxtube.net/search-porn/tsara-brashears/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Beapy", "Unix.dropper.botnet-6566040-0", "Tulach", "Montserrat", "Nids", "Win.malware.vmprotect-9880726-0", "Mirai", "Hacktool:win32/powersploit!rfn", "Worm:win32/mydoom.pb!mtb", "Other malware" ], "industries": [ "Healthcare", "Insurance", "Civil society", "Technology", "Government", "Legal" ], "unique_indicators": 18547 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/joinchorus.com", "whois": "http://whois.domaintools.com/joinchorus.com", "domain": "joinchorus.com", "hostname": "app.joinchorus.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "692f04e9fa3d782118e94aac", "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed", "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.", "modified": "2026-01-01T15:04:20.907000", "created": "2025-12-02T15:25:29.158000", "tags": [ "levelblue", "open threat", "dynamicloader", "tlsv1", "high", "msie", "windows nt", "delete c", "fwlink", "stream", "powershell", "write", "malware", "local", "united", "flag", "date", "server", "crazy egg", "name server", "gmt flag", "domain address", "markmonitor", "enom", "sugges", "onv incude", "data upload", "find s", "extraction", "types", "type", "indicator", "click", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "dns requests", "contacted hosts", "search", "entries", "read c", "medium", "memcommit", "tls handshake", "failure", "module load", "next", "execution", "dock", "capture", "persistence", "copy", "unknown", "suricata alert", "et info", "bad traffic", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "adversaries", "spawns", "t1480 execution", "file defense", "write c", "x02x82", "xe6x15c6", "x16f", "xc0xc0xc0", "revengerat", "guard", "service", "encrypt", "entries yara", "delphi", "win32", "jordan", "delete app" ], "references": [ "https://otx.alienvault.com/indicator/domain/Tamlegal.com", "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz", "endgames.com \u2022 endgames.us \u2022 endgamesystems.com \u2022 http://www.onyx-ware.com/lander", "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Vmprotect-9880726-0", "display_name": "Win.Malware.Vmprotect-9880726-0", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" } ], "industries": [ "Technology", "Legal" ], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4624, "FileHash-SHA256": 2021, "FileHash-MD5": 51, "FileHash-SHA1": 20, "SSLCertFingerprint": 10, "hostname": 1433, "domain": 728 }, "indicator_count": 8887, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "107 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "692cb6dc24da17618e3d9da6", "name": "Mirai Botnet | HackTool Powershell targets LinkedIn User | 192.168.1.1 \u2022 Remote Inbound Outbound Connection", "description": "Linux Malware - LinkedIn- True Mirai Botnet (192.168.1.1) (Never Connect) Incredibly powerful attack targeting LinkedIn users. In this instance the target is an ex husband of a target. |\nNDO Group relationships seen. This is a Botnet. \n\nMay be \u2018framing\u2019 attack that was launched in 2014. Attackers sent a clear message to target that she + husband would be arrested and charged with possession of 1000\u2019s of \u2018child pornography\u2019 pictures. \n\nAttack 10/10 malicious. Worked from separate system in separate location. Hackers unlocked a device, zero clicks, removed PSW. Tulach malware seen a profile \u2018Michael Robert\u2019s of Rexxfield\u2019 may be entity (NSA) with a face like Tulach. Uses the most WILD compromises. Government contractors? \n\nSame attackers brought down Prudentials \u2018Assurance\u2019 Medicare system forever.\n ESET hackers only allowing \u2018bad traffic\u2019 .", "modified": "2025-12-30T19:04:40.430000", "created": "2025-11-30T21:27:56.239000", "tags": [ "enter", "extract", "enter source", "urls", "address", "remote connect", "private ip", "sql", "inject", "montserrat", "script urls", "germany unknown", "xml title", "wiesinger", "style", "ip address", "script domains", "body doctype", "encrypt", "botnet", "dropper", "unix", "resolverror", "et exploit", "outbound", "mirai variant", "useragent", "inbound", "et trojan", "et webserver", "scan mirai", "hello", "execution", "mirai", "malware", "shell", "nids", "ids detections", "wget command", "http headers", "dlink devices", "home network", "mvpower dvr", "shell uce", "mirai elf", "linux malware", "is__elf", "cnc", "meta http", "content", "gmt server", "files", "reverse dns", "germany", "ismaning", "germany asn", "as5539 spacenet", "germany https", "auto generated security (?)", "redacted for", "name servers", "aaaa", "search", "for privacy", "title", "intel", "ms windows", "pe32", "process32nextw", "write c", "mssql port", "hash", "beapy", "bit32bit", "agent", "write", "hacktool", "win32", "next", "suspicious user", "pybeapy cnc", "checkin", "w32beapy cnc", "beacon", "module load", "external ip", "lookup", "home assistant", "intptr", "uint32", "type", "parameter", "oldprotectflag", "mandatory", "throw", "position", "lkshkdandl", "success", "info", "powershell", "null", "error", "date hash", "next yara", "detections name", "medium", "graph tree", "sample", "sample hash", "exec bypass", "c ipconfig", "world", "jaws webserver", "chmod usage", "strings", "extraction", "data upload", "extre", "include data", "hos hos", "y se", "sugges", "find s", "typ hos", "hos data", "hos hostname", "hos host", "extr data", "tethering", "tulach", "114.114.114.114", "passive dns", "pulse pulses", "http", "related nids", "files location", "united", "flag united", "files domain", "next associated", "ipv4 add", "delphi", "read c", "packing t1045", "t1045", "worm", "code", "june", "irc nick command", "irc", "meta", "status", "record value", "unknown aaaa", "expiration", "url http", "indicator role", "pulses url", "no expiration", "url https", "url url", "o url", "request review", "hosting", "unknown", "medium security", "extra data", "failed", "linkedin", "url add", "ireland flag", "ireland", "dublin", "ireland asn", "as16509", "spyware", "nso", "nso group", "pegasus related", "nso related", "framing", "porn", "python", "flag", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "dns requests", "domain address", "contacted hosts", "apple", "192.168.1.1", "law", "attorney" ], "references": [ "192.168.1.1 - WOW! Use your old equipment in a non - residential environment", "http://xn.com/ \u2022 www.xn--linkedinxn-6u6e.com \u2022 http://www.linkedin-xn.com/ \u2022 www.linkedin-xn.com", "Powerful Exploit: https://otx.alienvault.com/indicator/file/ba32802bdd1f0b91cf8c667b94426d73ee654ba0", "Mirai Botnet - *Inbound & Outbound connection", "IDS Detections: *WGET Command Specifying Output in HTTP Headers", "IDS Detections: *D-Link Devices Home Network Administration Protocol Command Execution", "IDS Detections: *JAWS Webserver Unauthenticated Shell Command Execution", "IDS Detections: *MVPower DVR Shell UCE *Mirai Variant User-Agent (Outbound)", "Yara : Yara Detections : SUSP_XORed_Mozilla , Linux_MiningSoftware , is__elf", "Alerts : dead_host nids_exploit_alert nids_malware_alert persistency_initd network_icmp", "Alerts : tcp_syn_scan nolookup_communication network_cnc_http network_http", "Alerts : network_http_post nids_alert chmod_syscall writes_to_stdout", "Other Mitre ATT&CK T1480 T1553.00 T1027.013 T1057 T1069.002 T1071\tT1071.004", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.pornhub.com/video/search?search=tsara+brashears", "http://www.anyxxxtube.net/search-porn/tsara-brashears", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "pornokind.vgt.pl \u2022 https://pornokind.vgt.pl \u2022 https://www.pornokind.vgt.pl \u2022 https://www.pornokind.vgt.pl/", "pornlynx.com \u2022 www.pornhub.com \u2022 www.anyxxxtube.com", "https://frostty12ice.info/ \u2022 https://lawhubh.info", "Needs researching: http://lib.jerusalem.muni.il.il \u2022 https://lib.jerusalem.muni.il.il" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Unix.Dropper.Botnet-6566040-0", "display_name": "Unix.Dropper.Botnet-6566040-0", "target": null }, { "id": "NIDS", "display_name": "NIDS", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Montserrat", "display_name": "Montserrat", "target": null }, { "id": "Beapy", "display_name": "Beapy", "target": null }, { "id": "HackTool:Win32/PowerSploit!rfn", "display_name": "HackTool:Win32/PowerSploit!rfn", "target": "/malware/HackTool:Win32/PowerSploit!rfn" }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Worm:Win32/Mydoom.PB!MTB", "display_name": "Worm:Win32/Mydoom.PB!MTB", "target": "/malware/Worm:Win32/Mydoom.PB!MTB" } ], "attack_ids": [ { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "TA0036", "name": "Exfiltration", "display_name": "TA0036 - Exfiltration" }, { "id": "TA0039", "name": "Remote Service Effects", "display_name": "TA0039 - Remote Service Effects" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1016.001", "name": "Internet Connection Discovery", "display_name": "T1016.001 - Internet Connection Discovery" }, { "id": "T1583.004", "name": "Server", "display_name": "T1583.004 - Server" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1098", "name": "Account Manipulation", "display_name": "T1098 - Account Manipulation" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1019", "name": "System Firmware", "display_name": "T1019 - System Firmware" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553.001", "name": "Gatekeeper Bypass", "display_name": "T1553.001 - Gatekeeper Bypass" }, { "id": "T1027.005", "name": "Indicator Removal from Tools", "display_name": "T1027.005 - Indicator Removal from Tools" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1585.001", "name": "Social Media Accounts", "display_name": "T1585.001 - Social Media Accounts" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1609", "name": "Container Administration Command", "display_name": "T1609 - Container Administration Command" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1059.006", "name": "Python", "display_name": "T1059.006 - Python" } ], "industries": [ "Government", "Legal", "Healthcare", "Insurance", "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4147, "domain": 871, "hostname": 2194, "FileHash-MD5": 279, "FileHash-SHA1": 257, "FileHash-SHA256": 2183, "CVE": 6, "email": 3, "SSLCertFingerprint": 1 }, "indicator_count": 9941, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "109 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://app.joinchorus.com/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://app.joinchorus.com/", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776597227.5794332 }