{ "type": "URL", "indicator": "https://bb.darkchemistry.net", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://bb.darkchemistry.net", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 2827087352, "indicator": "https://bb.darkchemistry.net", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 9, "pulses": [ { "id": "659fa1fad840744f75eb2d14", "name": "Worm:Win32/Benjamin IoC's", "description": "https://otx.alienvault.com/malware/Worm:Win32%2FBenjamin/samples | \nFiles Matching Antivirus Detection - 296,250 \nNetwork Icmp\nPersistence Autorun\nNetwork Http\nDynamic Function Loading\nProcmem Yara\nInjection Rwx\nPowershell Request\nDead Connect\nSuricata Alert\nPe Features\nPacker Entropy\nAntivm Memory Available\nAllocates Rwx\nCreates Exe\nPacker Polymorphic\nNids Alert\nDead Host\nNolookup Communication", "modified": "2024-02-10T07:03:55.140000", "created": "2024-01-11T08:08:26.689000", "tags": [ "worm", "win32", "benjamin", "passive dns", "as47846", "germany unknown", "urls", "next", "scan endpoints", "all octoseek", "unknown", "threat roundup", "ssl certificate", "whois record", "august", "april", "execution", "october", "july", "march", "contacted", "june", "emotet", "quasar", "core", "hacktool", "goldfinder", "sibot", "ryuk", "drxk0gdg2s06f8p", "cfom2jtlf", "k60zzli http", "whois whois", "historical ssl", "resolutions", "referrer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 144, "FileHash-SHA1": 145, "FileHash-SHA256": 2888, "hostname": 1075, "domain": 1007, "URL": 4964, "CVE": 1 }, "indicator_count": 10224, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "799 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a975e2a76dd4ddaec80a", "name": "Remote Access attack | Agent Tesla | C2 | BatLoader | C2 | Dridex", "description": "", "modified": "2023-12-06T17:03:49.269000", "created": "2023-12-06T17:03:49.269000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 8, "FileHash-SHA256": 2173, "domain": 584, "hostname": 1707, "URL": 4145, "FileHash-SHA1": 545, "FileHash-MD5": 1071 }, "indicator_count": 10233, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a79534c615a8f10f3380", "name": "Qakbot | Info Stealer | Sourced: Part-RU", "description": "", "modified": "2023-12-06T16:55:49.669000", "created": "2023-12-06T16:55:49.669000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2383, "hostname": 1027, "domain": 418, "URL": 2673, "FileHash-MD5": 99, "FileHash-SHA1": 98 }, "indicator_count": 6698, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657080a3b9d26b3fb0e6762f", "name": "DianeTrautman.com ~ former Harris County Clerk, Texas (2019 - 2020)", "description": "", "modified": "2023-12-06T14:09:39.170000", "created": "2023-12-06T14:09:39.170000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 871, "domain": 259, "hostname": 567, "URL": 1052, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 2752, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "652c33c45c1f1566c4b8c6a2", "name": "Remote Access attack | Agent Tesla | C2 | BatLoader | C2 | Dridex", "description": "https://login.live.com/oauth20_remoteconnect.srf\nInvalid CRDS Token\nI suffered quite an attack on my devices. My personal experience, phone service changed, embedding., privilege escalation adversaries, remote probe, obvious unauthorized microsoft usage multiple logins. embedded phone service apps, injected, unknown apps, dumping. connect/shared/ tethered to other clouds, apps devices, decrypted phone., cookies turned off after attack, no Google, other search engine access, passwords compromised malicious Google sorry index w/Azorult. I am targeted. Usual suspects\nPrior: 'D241 connect test was successful messages'. Wifi and cellular issues.\nAftermath, Zombie devices. C2. Calls don't connect, keyloggers, etc", "modified": "2023-11-14T17:01:45.019000", "created": "2023-10-15T18:47:32.354000", "tags": [ "whois record", "historical ssl", "ssl certificate", "communicating", "referrer", "united", "mail spammer", "detection list", "ip address", "blacklist", "possiblecerber", "outlook", "covid19", "artemis", "unsafe", "cisco umbrella", "site", "safe site", "phishing site", "malicious site", "malware", "malware site", "alexa top", "million", "phishingms", "exploit", "live", "blacklist https", "javascript", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "p3p cp", "pragma", "whois whois", "contacted", "threat network", "pe resource", "uatrue url", "typepv", "probe", "execution", "core", "emotet", "remcos", "nokoyawa", "asyncrat", "heur", "anonymizer", "firehol", "trojanx", "agent", "riskware", "trojan", "binder", "small", "downloader", "hupigon", "crypt", "cobalt strike", "union", "team", "agent tesla", "malicious", "fakealert", "dbatloader", "stealer", "nanocore rat", "formbook", "dropper", "dridex", "hawkeye", "netwire", "download", "opencandy", "bladabindi", "phishing", "bank", "alexa", "trojanspy", "maltiverse", "uatrue", "processorx86", "langen", "generic malware", "fakedout threat", "ip summary", "url summary", "summary", "sample", "samples", "injected", "mitre", "attack", "cybercrime", "Suspicious.Save", "dns server", "scanning ip's", "Backdoor.Remcos", "Threats200220200050", "IOC_19052020", "behaves like emotet" ], "references": [ "https://login.live.com/oauth20_remoteconnect.srf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "France" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Dridex", "display_name": "Dridex", "target": null }, { "id": "Agent Tesla - S0331", "display_name": "Agent Tesla - S0331", "target": null }, { "id": "HawkEye Keylogger", "display_name": "HawkEye Keylogger", "target": null }, { "id": "Suspicious.Save", "display_name": "Suspicious.Save", "target": null }, { "id": "Application.Generic", "display_name": "Application.Generic", "target": null }, { "id": "Backdoor.RemoteManipulator", "display_name": "Backdoor.RemoteManipulator", "target": null }, { "id": "Gen:Heur.Ransom.HiddenTears", "display_name": "Gen:Heur.Ransom.HiddenTears", "target": null }, { "id": "XOR.DDoS", "display_name": "XOR.DDoS", "target": null }, { "id": "Backdoor.Remcos", "display_name": "Backdoor.Remcos", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1593.002", "name": "Search Engines", "display_name": "T1593.002 - Search Engines" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 34, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1071, "FileHash-SHA1": 545, "FileHash-SHA256": 2173, "domain": 584, "hostname": 1707, "URL": 4145, "CVE": 8 }, "indicator_count": 10233, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "887 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1c989df5416bd0ff3d38", "name": "Remote Access attack | Agent Tesla | C2 | BatLoader | C2 | Dridex", "description": "", "modified": "2023-11-14T17:01:45.019000", "created": "2023-10-30T03:01:44.846000", "tags": [ "whois record", "historical ssl", "ssl certificate", "communicating", "referrer", "united", "mail spammer", "detection list", "ip address", "blacklist", "possiblecerber", "outlook", "covid19", "artemis", "unsafe", "cisco umbrella", "site", "safe site", "phishing site", "malicious site", "malware", "malware site", "alexa top", "million", "phishingms", "exploit", "live", "blacklist https", "javascript", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "p3p cp", "pragma", "whois whois", "contacted", "threat network", "pe resource", "uatrue url", "typepv", "probe", "execution", "core", "emotet", "remcos", "nokoyawa", "asyncrat", "heur", "anonymizer", "firehol", "trojanx", "agent", "riskware", "trojan", "binder", "small", "downloader", "hupigon", "crypt", "cobalt strike", "union", "team", "agent tesla", "malicious", "fakealert", "dbatloader", "stealer", "nanocore rat", "formbook", "dropper", "dridex", "hawkeye", "netwire", "download", "opencandy", "bladabindi", "phishing", "bank", "alexa", "trojanspy", "maltiverse", "uatrue", "processorx86", "langen", "generic malware", "fakedout threat", "ip summary", "url summary", "summary", "sample", "samples", "injected", "mitre", "attack", "cybercrime", "Suspicious.Save", "dns server", "scanning ip's", "Backdoor.Remcos", "Threats200220200050", "IOC_19052020", "behaves like emotet" ], "references": [ "https://login.live.com/oauth20_remoteconnect.srf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "France" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Dridex", "display_name": "Dridex", "target": null }, { "id": "Agent Tesla - S0331", "display_name": "Agent Tesla - S0331", "target": null }, { "id": "HawkEye Keylogger", "display_name": "HawkEye Keylogger", "target": null }, { "id": "Suspicious.Save", "display_name": "Suspicious.Save", "target": null }, { "id": "Application.Generic", "display_name": "Application.Generic", "target": null }, { "id": "Backdoor.RemoteManipulator", "display_name": "Backdoor.RemoteManipulator", "target": null }, { "id": "Gen:Heur.Ransom.HiddenTears", "display_name": "Gen:Heur.Ransom.HiddenTears", "target": null }, { "id": "XOR.DDoS", "display_name": "XOR.DDoS", "target": null }, { "id": "Backdoor.Remcos", "display_name": "Backdoor.Remcos", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1593.002", "name": "Search Engines", "display_name": "T1593.002 - Search Engines" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [], "TLP": "white", "cloned_from": "652c33c45c1f1566c4b8c6a2", "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1071, "FileHash-SHA1": 545, "FileHash-SHA256": 2173, "domain": 584, "hostname": 1707, "URL": 4145, "CVE": 8 }, "indicator_count": 10233, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "887 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6519c4b76612eda702942ad6", "name": "Qakbot | Info Stealer | Sourced: Part-RU", "description": "Info Stealer\nET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 789", "modified": "2023-10-31T16:03:29.760000", "created": "2023-10-01T19:12:55.573000", "tags": [ "ssl certificate", "contacted", "whois record", "execution", "bundled", "resolutions", "referrer", "communicating", "network", "historical ssl", "malware", "twitter", "hacktool", "june" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 99, "FileHash-SHA1": 98, "FileHash-SHA256": 2383, "URL": 2673, "domain": 418, "hostname": 1027 }, "indicator_count": 6698, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "901 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1344cd54f3a86745a617", "name": "Qakbot | Info Stealer | Sourced: Part-RU", "description": "", "modified": "2023-10-31T16:03:29.760000", "created": "2023-10-30T02:21:56.497000", "tags": [ "ssl certificate", "contacted", "whois record", "execution", "bundled", "resolutions", "referrer", "communicating", "network", "historical ssl", "malware", "twitter", "hacktool", "june" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "6519c4b76612eda702942ad6", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 99, "FileHash-SHA1": 98, "FileHash-SHA256": 2383, "URL": 2673, "domain": 418, "hostname": 1027 }, "indicator_count": 6698, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "901 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "622631688a3eb4bf2d5969dd", "name": "DianeTrautman.com ~ former Harris County Clerk, Texas (2019 - 2020)", "description": "", "modified": "2022-04-06T00:02:16.312000", "created": "2022-03-07T16:23:04.024000", "tags": [], "references": [ "DianeTrautman.com.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1052, "domain": 259, "hostname": 567, "FileHash-SHA256": 871, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 2752, "is_author": false, "is_subscribing": null, "subscriber_count": 407, "modified_text": "1474 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://login.live.com/oauth20_remoteconnect.srf", "DianeTrautman.com.pdf" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Agent tesla - s0331", "Suspicious.save", "Xor.ddos", "Trojanspy", "Maltiverse", "Application.generic", "Hawkeye keylogger", "Gen:heur.ransom.hiddentears", "Backdoor.remcos", "Backdoor.remotemanipulator", "Dridex" ], "industries": [], "unique_indicators": 29128 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/darkchemistry.net", "whois": "http://whois.domaintools.com/darkchemistry.net", "domain": "darkchemistry.net", "hostname": "bb.darkchemistry.net" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 9, "pulses": [ { "id": "659fa1fad840744f75eb2d14", "name": "Worm:Win32/Benjamin IoC's", "description": "https://otx.alienvault.com/malware/Worm:Win32%2FBenjamin/samples | \nFiles Matching Antivirus Detection - 296,250 \nNetwork Icmp\nPersistence Autorun\nNetwork Http\nDynamic Function Loading\nProcmem Yara\nInjection Rwx\nPowershell Request\nDead Connect\nSuricata Alert\nPe Features\nPacker Entropy\nAntivm Memory Available\nAllocates Rwx\nCreates Exe\nPacker Polymorphic\nNids Alert\nDead Host\nNolookup Communication", "modified": "2024-02-10T07:03:55.140000", "created": "2024-01-11T08:08:26.689000", "tags": [ "worm", "win32", "benjamin", "passive dns", "as47846", "germany unknown", "urls", "next", "scan endpoints", "all octoseek", "unknown", "threat roundup", "ssl certificate", "whois record", "august", "april", "execution", "october", "july", "march", "contacted", "june", "emotet", "quasar", "core", "hacktool", "goldfinder", "sibot", "ryuk", "drxk0gdg2s06f8p", "cfom2jtlf", "k60zzli http", "whois whois", "historical ssl", "resolutions", "referrer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 144, "FileHash-SHA1": 145, "FileHash-SHA256": 2888, "hostname": 1075, "domain": 1007, "URL": 4964, "CVE": 1 }, "indicator_count": 10224, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "799 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a975e2a76dd4ddaec80a", "name": "Remote Access attack | Agent Tesla | C2 | BatLoader | C2 | Dridex", "description": "", "modified": "2023-12-06T17:03:49.269000", "created": "2023-12-06T17:03:49.269000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 8, "FileHash-SHA256": 2173, "domain": 584, "hostname": 1707, "URL": 4145, "FileHash-SHA1": 545, "FileHash-MD5": 1071 }, "indicator_count": 10233, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a79534c615a8f10f3380", "name": "Qakbot | Info Stealer | Sourced: Part-RU", "description": "", "modified": "2023-12-06T16:55:49.669000", "created": "2023-12-06T16:55:49.669000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2383, "hostname": 1027, "domain": 418, "URL": 2673, "FileHash-MD5": 99, "FileHash-SHA1": 98 }, "indicator_count": 6698, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657080a3b9d26b3fb0e6762f", "name": "DianeTrautman.com ~ former Harris County Clerk, Texas (2019 - 2020)", "description": "", "modified": "2023-12-06T14:09:39.170000", "created": "2023-12-06T14:09:39.170000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 871, "domain": 259, "hostname": 567, "URL": 1052, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 2752, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "652c33c45c1f1566c4b8c6a2", "name": "Remote Access attack | Agent Tesla | C2 | BatLoader | C2 | Dridex", "description": "https://login.live.com/oauth20_remoteconnect.srf\nInvalid CRDS Token\nI suffered quite an attack on my devices. My personal experience, phone service changed, embedding., privilege escalation adversaries, remote probe, obvious unauthorized microsoft usage multiple logins. embedded phone service apps, injected, unknown apps, dumping. connect/shared/ tethered to other clouds, apps devices, decrypted phone., cookies turned off after attack, no Google, other search engine access, passwords compromised malicious Google sorry index w/Azorult. I am targeted. Usual suspects\nPrior: 'D241 connect test was successful messages'. Wifi and cellular issues.\nAftermath, Zombie devices. C2. Calls don't connect, keyloggers, etc", "modified": "2023-11-14T17:01:45.019000", "created": "2023-10-15T18:47:32.354000", "tags": [ "whois record", "historical ssl", "ssl certificate", "communicating", "referrer", "united", "mail spammer", "detection list", "ip address", "blacklist", "possiblecerber", "outlook", "covid19", "artemis", "unsafe", "cisco umbrella", "site", "safe site", "phishing site", "malicious site", "malware", "malware site", "alexa top", "million", "phishingms", "exploit", "live", "blacklist https", "javascript", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "p3p cp", "pragma", "whois whois", "contacted", "threat network", "pe resource", "uatrue url", "typepv", "probe", "execution", "core", "emotet", "remcos", "nokoyawa", "asyncrat", "heur", "anonymizer", "firehol", "trojanx", "agent", "riskware", "trojan", "binder", "small", "downloader", "hupigon", "crypt", "cobalt strike", "union", "team", "agent tesla", "malicious", "fakealert", "dbatloader", "stealer", "nanocore rat", "formbook", "dropper", "dridex", "hawkeye", "netwire", "download", "opencandy", "bladabindi", "phishing", "bank", "alexa", "trojanspy", "maltiverse", "uatrue", "processorx86", "langen", "generic malware", "fakedout threat", "ip summary", "url summary", "summary", "sample", "samples", "injected", "mitre", "attack", "cybercrime", "Suspicious.Save", "dns server", "scanning ip's", "Backdoor.Remcos", "Threats200220200050", "IOC_19052020", "behaves like emotet" ], "references": [ "https://login.live.com/oauth20_remoteconnect.srf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "France" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Dridex", "display_name": "Dridex", "target": null }, { "id": "Agent Tesla - S0331", "display_name": "Agent Tesla - S0331", "target": null }, { "id": "HawkEye Keylogger", "display_name": "HawkEye Keylogger", "target": null }, { "id": "Suspicious.Save", "display_name": "Suspicious.Save", "target": null }, { "id": "Application.Generic", "display_name": "Application.Generic", "target": null }, { "id": "Backdoor.RemoteManipulator", "display_name": "Backdoor.RemoteManipulator", "target": null }, { "id": "Gen:Heur.Ransom.HiddenTears", "display_name": "Gen:Heur.Ransom.HiddenTears", "target": null }, { "id": "XOR.DDoS", "display_name": "XOR.DDoS", "target": null }, { "id": "Backdoor.Remcos", "display_name": "Backdoor.Remcos", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1593.002", "name": "Search Engines", "display_name": "T1593.002 - Search Engines" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 34, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1071, "FileHash-SHA1": 545, "FileHash-SHA256": 2173, "domain": 584, "hostname": 1707, "URL": 4145, "CVE": 8 }, "indicator_count": 10233, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "887 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1c989df5416bd0ff3d38", "name": "Remote Access attack | Agent Tesla | C2 | BatLoader | C2 | Dridex", "description": "", "modified": "2023-11-14T17:01:45.019000", "created": "2023-10-30T03:01:44.846000", "tags": [ "whois record", "historical ssl", "ssl certificate", "communicating", "referrer", "united", "mail spammer", "detection list", "ip address", "blacklist", "possiblecerber", "outlook", "covid19", "artemis", "unsafe", "cisco umbrella", "site", "safe site", "phishing site", "malicious site", "malware", "malware site", "alexa top", "million", "phishingms", "exploit", "live", "blacklist https", "javascript", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "p3p cp", "pragma", "whois whois", "contacted", "threat network", "pe resource", "uatrue url", "typepv", "probe", "execution", "core", "emotet", "remcos", "nokoyawa", "asyncrat", "heur", "anonymizer", "firehol", "trojanx", "agent", "riskware", "trojan", "binder", "small", "downloader", "hupigon", "crypt", "cobalt strike", "union", "team", "agent tesla", "malicious", "fakealert", "dbatloader", "stealer", "nanocore rat", "formbook", "dropper", "dridex", "hawkeye", "netwire", "download", "opencandy", "bladabindi", "phishing", "bank", "alexa", "trojanspy", "maltiverse", "uatrue", "processorx86", "langen", "generic malware", "fakedout threat", "ip summary", "url summary", "summary", "sample", "samples", "injected", "mitre", "attack", "cybercrime", "Suspicious.Save", "dns server", "scanning ip's", "Backdoor.Remcos", "Threats200220200050", "IOC_19052020", "behaves like emotet" ], "references": [ "https://login.live.com/oauth20_remoteconnect.srf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "France" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Dridex", "display_name": "Dridex", "target": null }, { "id": "Agent Tesla - S0331", "display_name": "Agent Tesla - S0331", "target": null }, { "id": "HawkEye Keylogger", "display_name": "HawkEye Keylogger", "target": null }, { "id": "Suspicious.Save", "display_name": "Suspicious.Save", "target": null }, { "id": "Application.Generic", "display_name": "Application.Generic", "target": null }, { "id": "Backdoor.RemoteManipulator", "display_name": "Backdoor.RemoteManipulator", "target": null }, { "id": "Gen:Heur.Ransom.HiddenTears", "display_name": "Gen:Heur.Ransom.HiddenTears", "target": null }, { "id": "XOR.DDoS", "display_name": "XOR.DDoS", "target": null }, { "id": "Backdoor.Remcos", "display_name": "Backdoor.Remcos", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1593.002", "name": "Search Engines", "display_name": "T1593.002 - Search Engines" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [], "TLP": "white", "cloned_from": "652c33c45c1f1566c4b8c6a2", "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1071, "FileHash-SHA1": 545, "FileHash-SHA256": 2173, "domain": 584, "hostname": 1707, "URL": 4145, "CVE": 8 }, "indicator_count": 10233, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "887 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6519c4b76612eda702942ad6", "name": "Qakbot | Info Stealer | Sourced: Part-RU", "description": "Info Stealer\nET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 789", "modified": "2023-10-31T16:03:29.760000", "created": "2023-10-01T19:12:55.573000", "tags": [ "ssl certificate", "contacted", "whois record", "execution", "bundled", "resolutions", "referrer", "communicating", "network", "historical ssl", "malware", "twitter", "hacktool", "june" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 99, "FileHash-SHA1": 98, "FileHash-SHA256": 2383, "URL": 2673, "domain": 418, "hostname": 1027 }, "indicator_count": 6698, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "901 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1344cd54f3a86745a617", "name": "Qakbot | Info Stealer | Sourced: Part-RU", "description": "", "modified": "2023-10-31T16:03:29.760000", "created": "2023-10-30T02:21:56.497000", "tags": [ "ssl certificate", "contacted", "whois record", "execution", "bundled", "resolutions", "referrer", "communicating", "network", "historical ssl", "malware", "twitter", "hacktool", "june" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "6519c4b76612eda702942ad6", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 99, "FileHash-SHA1": 98, "FileHash-SHA256": 2383, "URL": 2673, "domain": 418, "hostname": 1027 }, "indicator_count": 6698, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "901 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "622631688a3eb4bf2d5969dd", "name": "DianeTrautman.com ~ former Harris County Clerk, Texas (2019 - 2020)", "description": "", "modified": "2022-04-06T00:02:16.312000", "created": "2022-03-07T16:23:04.024000", "tags": [], "references": [ "DianeTrautman.com.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1052, "domain": 259, "hostname": 567, "FileHash-SHA256": 871, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 2752, "is_author": false, "is_subscribing": null, "subscriber_count": 407, "modified_text": "1474 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://bb.darkchemistry.net", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://bb.darkchemistry.net", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776642140.560128 }