{ "type": "URL", "indicator": "https://code.yengo.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://code.yengo.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3658246763, "indicator": "https://code.yengo.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 10, "pulses": [ { "id": "6926228c245602830fd82fe5", "name": "hxxps://www[.]cloudflare[.]com/5xx-error-landing - 11.25.25", "description": "Cloudflare Abuse", "modified": "2025-12-25T21:00:52.783000", "created": "2025-11-25T21:41:32.156000", "tags": [ "sandbox", "static analyzer", "emulation", "analyzer", "url", "scanner", "reputation", "phishing", "malware", "cloudflare", "warning icon", "share report", "domain", "systems", "host", "amazon web", "services", "varnish", "onetrust", "error", "bunny", "write", "virus", "trojan", "ransomware", "static", "analysis", "indicator of compromise", "ioc", "extraction", "online", "submit", "sample", "download", "platform", "vxstream", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "javascript", "ansi", "runtime data", "file string", "dumps", "varchar", "null", "integer default", "localappdata", "integer not", "license", "path", "date", "facebook", "close", "roboto", "meta", "title", "span", "body", "blink", "win64", "contact", "mexico", "protect", "enterprise", "project", "suspicious", "hybrid", "mendoza", "mini", "code", "galileo", "4629", "false", "media", "critical", "fast", "stream", "cloud", "click", "hosts", "dorv", "lion", "cascade", "august", "general", "strings", "malicious" ], "references": [ "https://app.threat.zone/submission/5b29d473-2767-440f-8f03-12e48c58fd29/url-analysis-report", "https://urlquery.net/report/4eec9c27-98f9-4826-96ee-3e02a77c3646", "https://www.filescan.io/uploads/69261defaf4aba3912d48f77/reports/ad684d0b-2509-498d-8ab4-3c67a075029f/ioc", "https://hybrid-analysis.com/sample/fa4f8265e8be5eb4d59ced85c040c15fadf017ce9ae2ffe4869da356ec184582", "https://www.virustotal.com/gui/url/72220e2a2e1b36610c2efcd3585aa08ba8021ad13891821e47bbfd1f26709128/details", "https://hybrid-analysis.com/sample/fa4f8265e8be5eb4d59ced85c040c15fadf017ce9ae2ffe4869da356ec184582/64ddb54ab6da189fe1047708" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1498", "name": "Network Denial of Service", "display_name": "T1498 - Network Denial of Service" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 520, "FileHash-MD5": 136, "FileHash-SHA1": 82, "domain": 120, "hostname": 275, "FileHash-SHA256": 136, "email": 12 }, "indicator_count": 1281, "is_author": false, "is_subscribing": null, "subscriber_count": 129, "modified_text": "114 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "688ef0516013ca78448bf4e5", "name": "Foundry \u2022 Reflected Networks Pornhub Malvertising Subsidiary", "description": "Foundry ? Pornhub\nsanfoundry.com\ncompliance.fifoundry.net- Pornhub subsidiary. Targets networks, devices, routers, used for promoting pornography and her music. Producer revealed her hooks were used for Justin Bieber & Tori Kelly songs that. A producer stated her songs had been grifted. Both Tsara Brashears & a studio were in Pegasus & attacked by \u2018Lazarus\u2019 Group. She was told in detail how her songs can be used by music insiders if they choose. Target trolled by mocking hackers re: the JB and Kelly song.. Trojan:Win32/DisableUAC.A!bit\n, MSIL:Suspicious:ScreenCapture.S01\nIDS Detections\nLokiBot Checkin\nLokiBot User-Agent (Charon/Inferno)\nLokiBot Application/Credential Data Exfiltration Detected M1\nLokiBot Request for C2 Commands Detected M1\nLokiBot Application/Credential Data Exfiltration Detected M2\nLokiBot Request for C2 Commands Detected M2\nTrojan Generic - POST To gate.php with no referer\nSSL excessive fatal alerts (possible POODLE attack against server)\nI will revisit this. Gloryhole Foundation?", "modified": "2025-09-02T04:01:31.218000", "created": "2025-08-03T05:14:57.402000", "tags": [ "united", "moved", "entries", "passive dns", "detected m1", "next associated", "mtb apr", "mtb aug", "server", "gmt content", "trojandropper", "trojan", "body", "lokibot request", "c2 commands", "detected m2", "otx telemetry", "historical otx", "twitter running", "open ports", "cves", "time", "dynamicloader", "port", "search", "show", "destination", "alerts", "copy", "dynamic", "medium", "write", "creation date", "hostmaster", "urls", "domain", "showing", "hostname add", "pulse pulses", "date", "flag", "falcon sandbox", "name server", "markmonitor", "analysis", "mitre att", "anonymous", "upgrade", "hybrid", "contact", "usa windows", "december", "input threat", "level analysis", "summary", "february", "hwp support", "january", "october", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "calls", "command", "javascript", "object model", "model", "windir", "json data", "localappdata", "ascii text", "temp", "getprocaddress", "script", "license", "runtime process", "copy md5", "facebook", "roboto", "error", "win64", "path", "blink", "meta", "factory", "general", "comspec", "click", "strings", "damage", "mini", "stop", "core", "expl", "win32", "gmt server", "ecacc saa83dd", "ipv4 add", "twitter", "cobalt strike", "mozilla" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 263, "FileHash-SHA1": 256, "FileHash-SHA256": 837, "hostname": 4415, "URL": 1918, "domain": 1884, "email": 2, "SSLCertFingerprint": 2 }, "indicator_count": 9577, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "229 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e298af236c03fdd49226dd", "name": "IOC's from my personal devices for the week starting 08/21/23 - Pure Linux", "description": "It's becoming quite the wrestling match trying to get these pulses's created especially trying to utilize OTX's native uploader for the actual pulse; but after taking another persistent OS instance as a casualty I'm finally getting a workflow down. \n\nThis is all Linux starting this week; with a metric f*ck ton and frankly overwhelming amount of Yara matches I could only get a few to play outside of local analysis. But those include an apprently rooted libgo that landed on an Arch ISO as well as a CAchyOS ISO; a Dockerd that was hiding in the source {~/docker/bundles/binary) directory after cloning from gtihub earlier today as well as an unsolicited dsniff executable. Whatever this is also decided to leech off of and make a home out of the Cuda lib (/opt/cuda/ --- and as soon as I can get it uploaded a malicious ISO, and kernel out of the docker-desktop (/opt/docker-desktop) directory. Never a dull moment.", "modified": "2024-02-14T21:44:03.410000", "created": "2023-08-20T22:50:23.225000", "tags": [ "dukexternaldecl", "dukfilemacro", "duklinemacro", "duktape", "dukapinoreturn", "dukcompileeval", "dukcompilesafe", "null", "vaargs", "ecmascript", "date", "error", "push", "local", "internal", "returns", "value", "boostnocwchar", "indeterminate", "boostusefacet", "brief returns", "boosthasfacet", "gregor", "boost software", "license", "banner", "ipaddr", "author", "usage", "version", "anhth", "atlassian2", "cdn2", "devadmin", "haproxy3", "false", "team", "abba", "abcd", "acid", "adonis", "aeon", "afrodita", "agent", "akira", "alabama", "aldebaran", "aleph", "alex", "alexa", "alfa", "alien", "alina", "alisa", "alma", "alpha", "amigo", "amos", "anarchy", "andromeda", "angela", "anime", "anis", "anna", "anubis", "apache", "apollo", "april", "arch", "archie", "argos", "argus", "aria", "aris", "armageddon", "artemis", "asahi", "ashley", "assassin", "astra", "atom", "atomic", "august", "auriga", "aurora", "austin", "autorun", "avalanche", "avalon", "avenger", "aviator", "avril", "azrael", "baba", "babe", "baby", "babylon", "bach", "baidu", "bandung", "bank", "baobab", "bara", "baran", "baron", "barry", "bart", "basket", "batman", "bazar", "beer", "belarus", "belka", "belle", "benchmark", "benjamin", "benny", "bill", "bingo", "blackbox", "blackcat", "blackhole", "blacksun", "blaze", "blizzard", "blondie", "blood", "bluesky", "bnet", "bobo", "bomb", "bomber", "boom", "borg", "bounce", "bouncer", "boxer", "bridge", "buddy", "bullet", "bumblebee", "bunny", "burn", "caca", "caesar", "calendar", "calgary", "camel", "candle", "canvas", "cardinal", "cargo", "carpediem", "carrier", "casino", "casper", "cassini", "celine", "cerberus", "cetus", "chacha", "chantal", "cheap", "chester", "chewbacca", "chin", "citadel", "clarity", "class", "click", "clock", "cluster", "cobalt", "cobra", "coco", "coconut", "code", "coke", "combo", "comet", "comment", "comp", "conan", "config", "connector", "contact", "cookie", "cool", "corona", "cracker", "crash", "crawl", "crazy", "crew", "crime", "crimson", "crypton", "crystal", "cuba", "cyber", "cyrus", "dada", "dani", "daniel", "dark", "darkman", "darkness", "darkside", "darkstar", "daum", "david", "davis", "dbase", "death", "deimos", "delphi", "delta", "demo", "democracy", "dennis", "depot", "derek", "designer", "desktop", "dexter", "dharma", "diablo", "dialer", "diego", "diesel", "digi", "dima", "dino", "direct", "divine", "django", "dock", "dodo", "dolphin", "domino", "donald", "doom", "dora", "dotnet", "dracula", "dragon", "drop", "drweb", "dude", "duke", "dummy", "dump", "dune", "dust", "duster", "easy", "echelon", "eclipse", "eddie", "eddy", "elaine", "eleanor", "elisa", "elite", "emilia", "emma", "empire", "encrypt", "energy", "epsilon", "equinox", "eris", "esmeralda", "esupport", "eternal", "eternity", "euclid", "evil", "excalibur", "exodus", "experiment", "explorer", "express", "face", "facebook", "factory", "faisal", "fastcash", "feedme", "fenrir", "feri", "fiesta", "final", "finger", "firebird", "firefly", "first", "flamingo", "flash", "flex", "floyd", "flux", "fortune", "foryou", "foxy", "freddy", "freedom", "freeweb", "frodo", "frog", "front", "frozen", "fruit", "funky", "fury", "gaga", "galaxy", "galileo", "gamma", "gate", "gauss", "general", "generator", "genome", "giga", "gigi", "ginger", "girls", "glacier", "globe", "gloria", "goblin", "gogo", "golf", "gollum", "gondor", "gotcha", "graphite", "groove", "guard", "habbo", "hair", "hale", "hamster", "happytime", "harmony", "harrier", "havoc", "hawk", "hehe", "hell", "hello", "helpme", "hermit", "hino", "hippo", "honeypot", "hook", "horror", "hoster", "hotmail", "hunter", "hydra", "ibank", "icarus", "ident", "igloo", "iloveyou", "immortal", "impact", "import", "incom", "incubator", "indra", "inex", "inferno", "infinity", "info", "infra", "insane", "inside", "inter", "iowa", "iron", "iservice", "istanbul", "ivan", "jackson", "jaka", "jason", "jedi", "jeff", "jigsaw", "jimmy", "jinx", "john", "johnny", "joker", "joshi", "jquery", "judy", "julia", "juliet", "julius", "june", "juno", "justin", "kaiser", "kala", "kali", "kami", "kamikaze", "kamil", "kappa", "karin", "karina", "karma", "kato", "katy", "keeper", "kevin", "kiev", "killer", "kilo", "kiwi", "koko", "krasnodar", "krypton", "kurgan", "lana", "landmark", "lapis", "larry", "lazarus", "lazy", "leda", "legacy", "leon", "levi", "leviathan", "light", "lilith", "lilo", "lime", "little", "liza", "lizard", "logger", "logic", "loke", "loki", "lola", "loli", "lolita", "lolol", "look", "loulou", "love", "lucia", "lucky", "lucy", "luna", "lust", "madmax", "mafia", "magazine", "magento", "maggie", "magic", "magnum", "mailto", "maker", "mamba", "mami", "mandrake", "mania", "manuel", "marina", "mario", "mark", "markus", "marlboro", "martin", "maru", "mask", "massmail", "matrix", "maverick", "maximus", "maya", "mayak", "maze", "media", "medusa", "mensa", "mercurial", "mercury", "merlin", "meta", "metal", "metallica", "meteor", "metro", "mexico", "michael", "mikey", "mine", "mini", "minotaur", "minsk", "mint", "mira", "miso", "mission", "model", "monster", "moran", "mordor", "mozart", "multi", "murphy", "mylove", "nazgul", "nebula", "neko", "netmail", "neuro", "neuron", "nevada", "nexus", "night", "nightmare", "nikita", "niko", "nina", "ninja", "nirvana", "nitro", "nomad", "nono", "noob", "northstar", "nova", "nuke", "oblivion", "octopus", "ogre", "olga", "olivia", "omni", "ontario", "open", "orinoco", "oscar", "otto", "outside", "ozzy", "pacman", "pamela", "panama", "panda", "pandora", "panic", "paradox", "paraguay", "paranoia", "paris", "pass", "passmark", "path", "payment", "pedro", "pepe", "pepper", "perseus", "phantom", "philadelphia", "phoenix", "phpbb", "picasso", "pigeon", "pikachu", "pinger", "pingpong", "pinky", "pioneer", "pirate", "piter", "pixel", "pizza", "plasma", "pluto", "police", "pony", "porno", "posta", "prague", "predator", "prestige", "primus", "prism", "privat", "probe", "problem", "proj", "project", "prometheus", "prophet", "protect", "proteus", "proton", "puma", "punk", "python", "quake", "quartz", "quasar", "r2d2", "race", "ragnarok", "raid", "rainbow", "rambo", "rana", "ranger", "rape", "rapid", "raptor", "ravi", "razor", "reboot", "recon", "rector", "reda", "redir", "redirector", "redline", "refresh", "reklam", "relax", "rescue", "retro", "rhino", "rigel", "riot", "robin", "robinhood", "robo", "rock", "rocket", "rogue", "roma", "rosebud", "roxy", "ruby", "runner", "rush", "sadmin", "saigon", "sailor", "sakura", "salsa", "samurai", "sanctuary", "sandbox", "sandra", "sandy", "sapphire", "sara", "sarah", "satan", "saturn", "sauron", "savenow", "school", "seeker", "sentinel", "seraph", "serena", "serg", "service", "servidor", "sexy", "shadow", "shaggy", "shaman", "shane", "sharepoint", "shark", "shell", "sherlock", "silent", "simba", "simplex", "sirius", "skinner", "skipper", "skynet", "slash", "slice", "slim", "smash", "smog", "snake", "sniper", "snow", "snowflake", "sochi", "solid", "sonic", "sora", "soul", "spark", "sparkle", "sparta", "spartacus", "spawn", "spectre", "sphinx", "spice", "spin", "spirit", "splash", "spooky", "sport", "squirrel", "star", "stark", "stealth", "steel", "stop", "story", "striker", "stub", "styx", "sugar", "sunny", "sunset", "super", "supernova", "supervisor", "supra", "suri", "survey", "sweet", "sword", "sysadmin", "target", "tarot", "taurus", "teamo", "techno", "telecom", "template", "terminal", "terra", "terre", "testapi", "tetris", "thebe", "theta", "thor", "tibia", "tick", "ticker", "tiger", "tigger", "tiny", "titan", "titanic", "tokyo", "toolbar", "torun", "trace", "trailer", "trash", "trident", "trigger", "trinity", "tripoli", "triton", "troll", "tron", "troy", "tsunami", "tula", "twister", "twitter", "ultimate", "uranus", "uruguay", "valencia", "valentine", "valeria", "vampire", "vanguard", "venus", "victor", "vidar", "vienna", "viper", "voice", "voodoo", "voronezh", "vortex", "voyager", "vulcano", "waffle", "wagner", "walker", "wallpaper", "walrus", "wanderer", "warrior", "webadmin", "webdav", "websearch", "webview", "wedge", "westnet", "whiterose", "wide", "widget", "willow", "win4", "window", "winnie", "winnt", "wolf", "wraith", "write", "wuhan", "xanadu", "xena", "xenon", "xmail", "xpress", "yang", "youth", "yoyo", "yume", "zeppelin", "zero", "zeus", "zhang", "zimbra", "zion", "zombie", "zona", "zorro", "zulu", "NativeAPI" ], "references": [ "duktape.h", "tribool_io.hpp", "dnsspider", "libgo.so.22.0.0", "https://hybrid-analysis.com/sample/a55c43184ee4ec03a636b357e8fef5ce2e8fde34f61a28610d4ca285db9b07e4/64e43114272b03328005b88b", "/opt/cuda", "https://hybrid-analysis.com/sample/db47ed2f22009cab171b7d16ec3462258ddf7bed0a6a9af198e5394e783198c0/64e3ff9747b24214820d5c1a", "https://hybrid-analysis.com/sample/32bc49b0d1d7aba6742b0e81dc0105c54bd5c9f32321f96b1594fbbe36692880", "https://hybrid-analysis.com/sample/bad3965a417d2fd936116414be04591aedc9275d3c545b3709334d3805d69bef/64e3ffbd15668ff65803bf54", "dockerd", "https://hybrid-analysis.com/sample/a55c43184ee4ec03a636b357e8fef5ce2e8fde34f61a28610d4ca285db9b07e4", "https://hybrid-analysis.com/sample/db47ed2f22009cab171b7d16ec3462258ddf7bed0a6a9af198e5394e783198c0", "https://hybrid-analysis.com/sample/0d4a7cda209c9701bc4cd19aac861d2be8aa1ce6258922d64e711de3d9bad2ae/64e679f61825d88cf802a74d", "https://hybrid-analysis.com/sample/b2efd5e0c2f695063a8bce40c8182aa70f33c4b1b77d232b7530d89fb9646f0c/64e52411dbff7da2f4065fe7", "https://hybrid-analysis.com/sample/bad3965a417d2fd936116414be04591aedc9275d3c545b3709334d3805d69bef", "https://hybrid-analysis.com/sample/1ba7314785f705d0a3db7a3a8ae1da4fe11a2f776287ce3aabc3f3931469447b/64e67888f8d1145b63007ad1", "https://hybrid-analysis.com/sample/27c46f4f186b2168b1d37057378b58667151088cea24c8944d539d251d0b7f6d/64e678fba4a2aff1640fc39a" ], "public": 1, "adversary": "TBD", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1573.001", "name": "Symmetric Cryptography", "display_name": "T1573.001 - Symmetric Cryptography" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1003.008", "name": "/etc/passwd and /etc/shadow", "display_name": "T1003.008 - /etc/passwd and /etc/shadow" }, { "id": "T1007", "name": "System Service Discovery", "display_name": "T1007 - System Service Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1547.009", "name": "Shortcut Modification", "display_name": "T1547.009 - Shortcut Modification" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1055.003", "name": "Thread Execution Hijacking", "display_name": "T1055.003 - Thread Execution Hijacking" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1560.002", "name": "Archive via Library", "display_name": "T1560.002 - Archive via Library" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1056.004", "name": "Credential API Hooking", "display_name": "T1056.004 - Credential API Hooking" }, { "id": "T1074.001", "name": "Local Data Staging", "display_name": "T1074.001 - Local Data Staging" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1546.015", "name": "Component Object Model Hijacking", "display_name": "T1546.015 - Component Object Model Hijacking" }, { "id": "T1059.005", "name": "Visual Basic", "display_name": "T1059.005 - Visual Basic" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [ "individuals" ], "TLP": "white", "cloned_from": null, "export_count": 152, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Merkd1904", "id": "196517", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 676, "URL": 1068, "domain": 11442, "email": 36, "hostname": 1862, "FileHash-MD5": 2000, "FileHash-SHA256": 1082 }, "indicator_count": 18166, "is_author": false, "is_subscribing": null, "subscriber_count": 79, "modified_text": "794 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64d7b50681961fa5e507b6b3", "name": "Phishing links piped to my personal devices", "description": "IOC's from an ongoing attack stemming from January 2022. This pulse will be malicious or phishing links piped to my personal devices by the threat actor.", "modified": "2024-02-10T03:14:05.379000", "created": "2023-08-12T16:36:22.687000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please" ], "references": [ "http://hybrid-analysis.com/sample/4d8c2597fa65831b53c1cf32f418852f59f574c8811e9005121a5f6340b419de", "http://hybrid-analysis.com/sample/aa9862795c36c1eb69e665ffb00eb26e357f78e834fde753c823ff093199ed5d/64512d1b26a4544a2e012b74" ], "public": 1, "adversary": "N/A", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "individials" ], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Merkd1904", "id": "196517", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 692, "FileHash-SHA1": 169, "FileHash-SHA256": 297, "URL": 895, "domain": 3465, "email": 5, "hostname": 521, "CVE": 4 }, "indicator_count": 6048, "is_author": false, "is_subscribing": null, "subscriber_count": 74, "modified_text": "799 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a05f90fecc8ca5ef695c", "name": "IOC's from my personal devices for the week starting 08/21/23 - Pure Linux", "description": "", "modified": "2023-12-06T16:25:02.930000", "created": "2023-12-06T16:25:02.930000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2821, "hostname": 464, "email": 26, "URL": 978, "FileHash-MD5": 1139, "FileHash-SHA1": 541, "FileHash-SHA256": 839 }, "indicator_count": 6808, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a384e3e8573cf5ecac4", "name": "v2 - kopat electronic door security with hybrid scan data", "description": "", "modified": "2023-12-06T15:58:48.938000", "created": "2023-12-06T15:58:48.938000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1569, "URL": 3824, "email": 8, "domain": 290, "hostname": 189, "FileHash-MD5": 576, "FileHash-SHA1": 52 }, "indicator_count": 6508, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "645c9552d2976bc754de54f3", "name": ";https://ssl.kaptcha.com/collect/sdk?m=700000", "description": "[", "modified": "2023-05-11T07:12:18.292000", "created": "2023-05-11T07:12:18.292000", "tags": [], "references": [ "https://ssl.kaptcha.com/collect/sdk?m=700000", "https://www.hybrid-analysis.com/sample/161727a812a1c449bd581cbe577ba30fff74533887ce55dccdc7eaad27753b2c/645bf4aed69ba630d909ae5f" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1177, "domain": 162, "hostname": 321, "FileHash-SHA256": 81, "IPv4": 6, "FileHash-MD5": 71, "FileHash-SHA1": 53, "email": 3 }, "indicator_count": 1874, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "1074 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "645bf6923cdc8183594af3d9", "name": "www.adslchecker.com", "description": "", "modified": "2023-05-10T19:54:58.315000", "created": "2023-05-10T19:54:58.315000", "tags": [ "chromeua", "optout", "varchar", "ansi", "runtime data", "drmedgeua", "integer default", "license", "formanspa1", "script", "null", "facebook", "meta", "body", "roboto", "blink", "mini", "4629", "false", "united kingdom", "server", "date", "flag" ], "references": [ "https://ssl.kaptcha.com/collect/sdk?m=700000" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 24, "URL": 96, "domain": 53, "hostname": 66, "email": 1, "IPv4": 1, "FileHash-MD5": 8 }, "indicator_count": 249, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1075 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "645932281e34157197d4cbe4", "name": "v2 - kopat electronic door security with hybrid scan data", "description": "", "modified": "2023-05-08T17:32:24.648000", "created": "2023-05-08T17:32:24.648000", "tags": [ "dropped file", "null", "varchar", "gecko", "pcap", "pcap processing", "win64", "khtml", "span", "cookie", "path", "mozi", "roboto", "class", "mozilla", "body", "form", "window", "accept", "meta", "iframe", "contact", "4629", "trim", "embed", "dwis", "test", "tear", "qakbot", "tecv", "1inb", "a3ob", "u9p10dkhttps", "windir", "openurl c", "l10dkhttps", "charset", "w6t2hm", "is6bi" ], "references": [ "https://www.hybrid-analysis.com/sample/5ea6b6bdf0a82359f7f73c6095b6c8891be485234e5544ef18a000136617a1b6/645767842cd19c9c560f0381" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3824, "hostname": 189, "domain": 290, "FileHash-SHA256": 1569, "email": 8, "IPv4": 27, "FileHash-MD5": 576, "FileHash-SHA1": 52 }, "indicator_count": 6535, "is_author": false, "is_subscribing": null, "subscriber_count": 95, "modified_text": "1077 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "642d4c321a389c0385920349", "name": ";https://webmail.shahroodut.ac.ir/ajax/redir.hsp?url=https%3A%2F%2Fees.elsevier.com%2Fnpb'", "description": "", "modified": "2023-05-04T23:04:14.165000", "created": "2023-04-05T10:23:46.725000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "chromeua", "runtime data", "optout", "ansi", "dropped file", "drmedgeua", "unicode", "optin", "edgeua", "hidemfhevccodec", "close", "error", "roboto", "hybrid", "suspicious", "click", "hosts", "april", "general", "malicious", "strings", "qakbot" ], "references": [ "https://hybrid-analysis.com/sample/1fdaa98a991df2ff882e942feabe1f29a9da09df85d2bf15c04eb53f6022dea3/642c37082823e5c2e001924b" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 144, "hostname": 75, "domain": 52, "FileHash-MD5": 57, "FileHash-SHA1": 47, "FileHash-SHA256": 49 }, "indicator_count": 424, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1080 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "dockerd", "https://hybrid-analysis.com/sample/db47ed2f22009cab171b7d16ec3462258ddf7bed0a6a9af198e5394e783198c0/64e3ff9747b24214820d5c1a", "https://hybrid-analysis.com/sample/a55c43184ee4ec03a636b357e8fef5ce2e8fde34f61a28610d4ca285db9b07e4", "https://hybrid-analysis.com/sample/b2efd5e0c2f695063a8bce40c8182aa70f33c4b1b77d232b7530d89fb9646f0c/64e52411dbff7da2f4065fe7", "dnsspider", "https://hybrid-analysis.com/sample/0d4a7cda209c9701bc4cd19aac861d2be8aa1ce6258922d64e711de3d9bad2ae/64e679f61825d88cf802a74d", "https://hybrid-analysis.com/sample/32bc49b0d1d7aba6742b0e81dc0105c54bd5c9f32321f96b1594fbbe36692880", "https://hybrid-analysis.com/sample/db47ed2f22009cab171b7d16ec3462258ddf7bed0a6a9af198e5394e783198c0", "duktape.h", "https://hybrid-analysis.com/sample/1ba7314785f705d0a3db7a3a8ae1da4fe11a2f776287ce3aabc3f3931469447b/64e67888f8d1145b63007ad1", "https://www.hybrid-analysis.com/sample/161727a812a1c449bd581cbe577ba30fff74533887ce55dccdc7eaad27753b2c/645bf4aed69ba630d909ae5f", "/opt/cuda", "https://hybrid-analysis.com/sample/a55c43184ee4ec03a636b357e8fef5ce2e8fde34f61a28610d4ca285db9b07e4/64e43114272b03328005b88b", "https://hybrid-analysis.com/sample/bad3965a417d2fd936116414be04591aedc9275d3c545b3709334d3805d69bef/64e3ffbd15668ff65803bf54", "https://www.filescan.io/uploads/69261defaf4aba3912d48f77/reports/ad684d0b-2509-498d-8ab4-3c67a075029f/ioc", "https://urlquery.net/report/4eec9c27-98f9-4826-96ee-3e02a77c3646", "libgo.so.22.0.0", "http://hybrid-analysis.com/sample/aa9862795c36c1eb69e665ffb00eb26e357f78e834fde753c823ff093199ed5d/64512d1b26a4544a2e012b74", "https://hybrid-analysis.com/sample/1fdaa98a991df2ff882e942feabe1f29a9da09df85d2bf15c04eb53f6022dea3/642c37082823e5c2e001924b", "https://www.hybrid-analysis.com/sample/5ea6b6bdf0a82359f7f73c6095b6c8891be485234e5544ef18a000136617a1b6/645767842cd19c9c560f0381", "https://hybrid-analysis.com/sample/fa4f8265e8be5eb4d59ced85c040c15fadf017ce9ae2ffe4869da356ec184582", "https://app.threat.zone/submission/5b29d473-2767-440f-8f03-12e48c58fd29/url-analysis-report", "https://www.virustotal.com/gui/url/72220e2a2e1b36610c2efcd3585aa08ba8021ad13891821e47bbfd1f26709128/details", "https://hybrid-analysis.com/sample/bad3965a417d2fd936116414be04591aedc9275d3c545b3709334d3805d69bef", "tribool_io.hpp", "https://ssl.kaptcha.com/collect/sdk?m=700000", "https://hybrid-analysis.com/sample/fa4f8265e8be5eb4d59ced85c040c15fadf017ce9ae2ffe4869da356ec184582/64ddb54ab6da189fe1047708", "https://hybrid-analysis.com/sample/27c46f4f186b2168b1d37057378b58667151088cea24c8944d539d251d0b7f6d/64e678fba4a2aff1640fc39a", "http://hybrid-analysis.com/sample/4d8c2597fa65831b53c1cf32f418852f59f574c8811e9005121a5f6340b419de" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "TBD", "N/A" ], "malware_families": [], "industries": [ "Individuals", "Individials" ], "unique_indicators": 25354 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/yengo.com", "whois": "http://whois.domaintools.com/yengo.com", "domain": "yengo.com", "hostname": "code.yengo.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 10, "pulses": [ { "id": "6926228c245602830fd82fe5", "name": "hxxps://www[.]cloudflare[.]com/5xx-error-landing - 11.25.25", "description": "Cloudflare Abuse", "modified": "2025-12-25T21:00:52.783000", "created": "2025-11-25T21:41:32.156000", "tags": [ "sandbox", "static analyzer", "emulation", "analyzer", "url", "scanner", "reputation", "phishing", "malware", "cloudflare", "warning icon", "share report", "domain", "systems", "host", "amazon web", "services", "varnish", "onetrust", "error", "bunny", "write", "virus", "trojan", "ransomware", "static", "analysis", "indicator of compromise", "ioc", "extraction", "online", "submit", "sample", "download", "platform", "vxstream", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "javascript", "ansi", "runtime data", "file string", "dumps", "varchar", "null", "integer default", "localappdata", "integer not", "license", "path", "date", "facebook", "close", "roboto", "meta", "title", "span", "body", "blink", "win64", "contact", "mexico", "protect", "enterprise", "project", "suspicious", "hybrid", "mendoza", "mini", "code", "galileo", "4629", "false", "media", "critical", "fast", "stream", "cloud", "click", "hosts", "dorv", "lion", "cascade", "august", "general", "strings", "malicious" ], "references": [ "https://app.threat.zone/submission/5b29d473-2767-440f-8f03-12e48c58fd29/url-analysis-report", "https://urlquery.net/report/4eec9c27-98f9-4826-96ee-3e02a77c3646", "https://www.filescan.io/uploads/69261defaf4aba3912d48f77/reports/ad684d0b-2509-498d-8ab4-3c67a075029f/ioc", "https://hybrid-analysis.com/sample/fa4f8265e8be5eb4d59ced85c040c15fadf017ce9ae2ffe4869da356ec184582", "https://www.virustotal.com/gui/url/72220e2a2e1b36610c2efcd3585aa08ba8021ad13891821e47bbfd1f26709128/details", "https://hybrid-analysis.com/sample/fa4f8265e8be5eb4d59ced85c040c15fadf017ce9ae2ffe4869da356ec184582/64ddb54ab6da189fe1047708" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1498", "name": "Network Denial of Service", "display_name": "T1498 - Network Denial of Service" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 520, "FileHash-MD5": 136, "FileHash-SHA1": 82, "domain": 120, "hostname": 275, "FileHash-SHA256": 136, "email": 12 }, "indicator_count": 1281, "is_author": false, "is_subscribing": null, "subscriber_count": 129, "modified_text": "114 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "688ef0516013ca78448bf4e5", "name": "Foundry \u2022 Reflected Networks Pornhub Malvertising Subsidiary", "description": "Foundry ? Pornhub\nsanfoundry.com\ncompliance.fifoundry.net- Pornhub subsidiary. Targets networks, devices, routers, used for promoting pornography and her music. Producer revealed her hooks were used for Justin Bieber & Tori Kelly songs that. A producer stated her songs had been grifted. Both Tsara Brashears & a studio were in Pegasus & attacked by \u2018Lazarus\u2019 Group. She was told in detail how her songs can be used by music insiders if they choose. Target trolled by mocking hackers re: the JB and Kelly song.. Trojan:Win32/DisableUAC.A!bit\n, MSIL:Suspicious:ScreenCapture.S01\nIDS Detections\nLokiBot Checkin\nLokiBot User-Agent (Charon/Inferno)\nLokiBot Application/Credential Data Exfiltration Detected M1\nLokiBot Request for C2 Commands Detected M1\nLokiBot Application/Credential Data Exfiltration Detected M2\nLokiBot Request for C2 Commands Detected M2\nTrojan Generic - POST To gate.php with no referer\nSSL excessive fatal alerts (possible POODLE attack against server)\nI will revisit this. Gloryhole Foundation?", "modified": "2025-09-02T04:01:31.218000", "created": "2025-08-03T05:14:57.402000", "tags": [ "united", "moved", "entries", "passive dns", "detected m1", "next associated", "mtb apr", "mtb aug", "server", "gmt content", "trojandropper", "trojan", "body", "lokibot request", "c2 commands", "detected m2", "otx telemetry", "historical otx", "twitter running", "open ports", "cves", "time", "dynamicloader", "port", "search", "show", "destination", "alerts", "copy", "dynamic", "medium", "write", "creation date", "hostmaster", "urls", "domain", "showing", "hostname add", "pulse pulses", "date", "flag", "falcon sandbox", "name server", "markmonitor", "analysis", "mitre att", "anonymous", "upgrade", "hybrid", "contact", "usa windows", "december", "input threat", "level analysis", "summary", "february", "hwp support", "january", "october", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "calls", "command", "javascript", "object model", "model", "windir", "json data", "localappdata", "ascii text", "temp", "getprocaddress", "script", "license", "runtime process", "copy md5", "facebook", "roboto", "error", "win64", "path", "blink", "meta", "factory", "general", "comspec", "click", "strings", "damage", "mini", "stop", "core", "expl", "win32", "gmt server", "ecacc saa83dd", "ipv4 add", "twitter", "cobalt strike", "mozilla" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 263, "FileHash-SHA1": 256, "FileHash-SHA256": 837, "hostname": 4415, "URL": 1918, "domain": 1884, "email": 2, "SSLCertFingerprint": 2 }, "indicator_count": 9577, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "229 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e298af236c03fdd49226dd", "name": "IOC's from my personal devices for the week starting 08/21/23 - Pure Linux", "description": "It's becoming quite the wrestling match trying to get these pulses's created especially trying to utilize OTX's native uploader for the actual pulse; but after taking another persistent OS instance as a casualty I'm finally getting a workflow down. \n\nThis is all Linux starting this week; with a metric f*ck ton and frankly overwhelming amount of Yara matches I could only get a few to play outside of local analysis. But those include an apprently rooted libgo that landed on an Arch ISO as well as a CAchyOS ISO; a Dockerd that was hiding in the source {~/docker/bundles/binary) directory after cloning from gtihub earlier today as well as an unsolicited dsniff executable. Whatever this is also decided to leech off of and make a home out of the Cuda lib (/opt/cuda/ --- and as soon as I can get it uploaded a malicious ISO, and kernel out of the docker-desktop (/opt/docker-desktop) directory. Never a dull moment.", "modified": "2024-02-14T21:44:03.410000", "created": "2023-08-20T22:50:23.225000", "tags": [ "dukexternaldecl", "dukfilemacro", "duklinemacro", "duktape", "dukapinoreturn", "dukcompileeval", "dukcompilesafe", "null", "vaargs", "ecmascript", "date", "error", "push", "local", "internal", "returns", "value", "boostnocwchar", "indeterminate", "boostusefacet", "brief returns", "boosthasfacet", "gregor", "boost software", "license", "banner", "ipaddr", "author", "usage", "version", "anhth", "atlassian2", "cdn2", "devadmin", "haproxy3", "false", "team", "abba", "abcd", "acid", "adonis", "aeon", "afrodita", "agent", "akira", "alabama", "aldebaran", "aleph", "alex", "alexa", "alfa", "alien", "alina", "alisa", "alma", "alpha", "amigo", "amos", "anarchy", "andromeda", "angela", "anime", "anis", "anna", "anubis", "apache", "apollo", "april", "arch", "archie", "argos", "argus", "aria", "aris", "armageddon", "artemis", "asahi", "ashley", "assassin", "astra", "atom", "atomic", "august", "auriga", "aurora", "austin", "autorun", "avalanche", "avalon", "avenger", "aviator", "avril", "azrael", "baba", "babe", "baby", "babylon", "bach", "baidu", "bandung", "bank", "baobab", "bara", "baran", "baron", "barry", "bart", "basket", "batman", "bazar", "beer", "belarus", "belka", "belle", "benchmark", "benjamin", "benny", "bill", "bingo", "blackbox", "blackcat", "blackhole", "blacksun", "blaze", "blizzard", "blondie", "blood", "bluesky", "bnet", "bobo", "bomb", "bomber", "boom", "borg", "bounce", "bouncer", "boxer", "bridge", "buddy", "bullet", "bumblebee", "bunny", "burn", "caca", "caesar", "calendar", "calgary", "camel", "candle", "canvas", "cardinal", "cargo", "carpediem", "carrier", "casino", "casper", "cassini", "celine", "cerberus", "cetus", "chacha", "chantal", "cheap", "chester", "chewbacca", "chin", "citadel", "clarity", "class", "click", "clock", "cluster", "cobalt", "cobra", "coco", "coconut", "code", "coke", "combo", "comet", "comment", "comp", "conan", "config", "connector", "contact", "cookie", "cool", "corona", "cracker", "crash", "crawl", "crazy", "crew", "crime", "crimson", "crypton", "crystal", "cuba", "cyber", "cyrus", "dada", "dani", "daniel", "dark", "darkman", "darkness", "darkside", "darkstar", "daum", "david", "davis", "dbase", "death", "deimos", "delphi", "delta", "demo", "democracy", "dennis", "depot", "derek", "designer", "desktop", "dexter", "dharma", "diablo", "dialer", "diego", "diesel", "digi", "dima", "dino", "direct", "divine", "django", "dock", "dodo", "dolphin", "domino", "donald", "doom", "dora", "dotnet", "dracula", "dragon", "drop", "drweb", "dude", "duke", "dummy", "dump", "dune", "dust", "duster", "easy", "echelon", "eclipse", "eddie", "eddy", "elaine", "eleanor", "elisa", "elite", "emilia", "emma", "empire", "encrypt", "energy", "epsilon", "equinox", "eris", "esmeralda", "esupport", "eternal", "eternity", "euclid", "evil", "excalibur", "exodus", "experiment", "explorer", "express", "face", "facebook", "factory", "faisal", "fastcash", "feedme", "fenrir", "feri", "fiesta", "final", "finger", "firebird", "firefly", "first", "flamingo", "flash", "flex", "floyd", "flux", "fortune", "foryou", "foxy", "freddy", "freedom", "freeweb", "frodo", "frog", "front", "frozen", "fruit", "funky", "fury", "gaga", "galaxy", "galileo", "gamma", "gate", "gauss", "general", "generator", "genome", "giga", "gigi", "ginger", "girls", "glacier", "globe", "gloria", "goblin", "gogo", "golf", "gollum", "gondor", "gotcha", "graphite", "groove", "guard", "habbo", "hair", "hale", "hamster", "happytime", "harmony", "harrier", "havoc", "hawk", "hehe", "hell", "hello", "helpme", "hermit", "hino", "hippo", "honeypot", "hook", "horror", "hoster", "hotmail", "hunter", "hydra", "ibank", "icarus", "ident", "igloo", "iloveyou", "immortal", "impact", "import", "incom", "incubator", "indra", "inex", "inferno", "infinity", "info", "infra", "insane", "inside", "inter", "iowa", "iron", "iservice", "istanbul", "ivan", "jackson", "jaka", "jason", "jedi", "jeff", "jigsaw", "jimmy", "jinx", "john", "johnny", "joker", "joshi", "jquery", "judy", "julia", "juliet", "julius", "june", "juno", "justin", "kaiser", "kala", "kali", "kami", "kamikaze", "kamil", "kappa", "karin", "karina", "karma", "kato", "katy", "keeper", "kevin", "kiev", "killer", "kilo", "kiwi", "koko", "krasnodar", "krypton", "kurgan", "lana", "landmark", "lapis", "larry", "lazarus", "lazy", "leda", "legacy", "leon", "levi", "leviathan", "light", "lilith", "lilo", "lime", "little", "liza", "lizard", "logger", "logic", "loke", "loki", "lola", "loli", "lolita", "lolol", "look", "loulou", "love", "lucia", "lucky", "lucy", "luna", "lust", "madmax", "mafia", "magazine", "magento", "maggie", "magic", "magnum", "mailto", "maker", "mamba", "mami", "mandrake", "mania", "manuel", "marina", "mario", "mark", "markus", "marlboro", "martin", "maru", "mask", "massmail", "matrix", "maverick", "maximus", "maya", "mayak", "maze", "media", "medusa", "mensa", "mercurial", "mercury", "merlin", "meta", "metal", "metallica", "meteor", "metro", "mexico", "michael", "mikey", "mine", "mini", "minotaur", "minsk", "mint", "mira", "miso", "mission", "model", "monster", "moran", "mordor", "mozart", "multi", "murphy", "mylove", "nazgul", "nebula", "neko", "netmail", "neuro", "neuron", "nevada", "nexus", "night", "nightmare", "nikita", "niko", "nina", "ninja", "nirvana", "nitro", "nomad", "nono", "noob", "northstar", "nova", "nuke", "oblivion", "octopus", "ogre", "olga", "olivia", "omni", "ontario", "open", "orinoco", "oscar", "otto", "outside", "ozzy", "pacman", "pamela", "panama", "panda", "pandora", "panic", "paradox", "paraguay", "paranoia", "paris", "pass", "passmark", "path", "payment", "pedro", "pepe", "pepper", "perseus", "phantom", "philadelphia", "phoenix", "phpbb", "picasso", "pigeon", "pikachu", "pinger", "pingpong", "pinky", "pioneer", "pirate", "piter", "pixel", "pizza", "plasma", "pluto", "police", "pony", "porno", "posta", "prague", "predator", "prestige", "primus", "prism", "privat", "probe", "problem", "proj", "project", "prometheus", "prophet", "protect", "proteus", "proton", "puma", "punk", "python", "quake", "quartz", "quasar", "r2d2", "race", "ragnarok", "raid", "rainbow", "rambo", "rana", "ranger", "rape", "rapid", "raptor", "ravi", "razor", "reboot", "recon", "rector", "reda", "redir", "redirector", "redline", "refresh", "reklam", "relax", "rescue", "retro", "rhino", "rigel", "riot", "robin", "robinhood", "robo", "rock", "rocket", "rogue", "roma", "rosebud", "roxy", "ruby", "runner", "rush", "sadmin", "saigon", "sailor", "sakura", "salsa", "samurai", "sanctuary", "sandbox", "sandra", "sandy", "sapphire", "sara", "sarah", "satan", "saturn", "sauron", "savenow", "school", "seeker", "sentinel", "seraph", "serena", "serg", "service", "servidor", "sexy", "shadow", "shaggy", "shaman", "shane", "sharepoint", "shark", "shell", "sherlock", "silent", "simba", "simplex", "sirius", "skinner", "skipper", "skynet", "slash", "slice", "slim", "smash", "smog", "snake", "sniper", "snow", "snowflake", "sochi", "solid", "sonic", "sora", "soul", "spark", "sparkle", "sparta", "spartacus", "spawn", "spectre", "sphinx", "spice", "spin", "spirit", "splash", "spooky", "sport", "squirrel", "star", "stark", "stealth", "steel", "stop", "story", "striker", "stub", "styx", "sugar", "sunny", "sunset", "super", "supernova", "supervisor", "supra", "suri", "survey", "sweet", "sword", "sysadmin", "target", "tarot", "taurus", "teamo", "techno", "telecom", "template", "terminal", "terra", "terre", "testapi", "tetris", "thebe", "theta", "thor", "tibia", "tick", "ticker", "tiger", "tigger", "tiny", "titan", "titanic", "tokyo", "toolbar", "torun", "trace", "trailer", "trash", "trident", "trigger", "trinity", "tripoli", "triton", "troll", "tron", "troy", "tsunami", "tula", "twister", "twitter", "ultimate", "uranus", "uruguay", "valencia", "valentine", "valeria", "vampire", "vanguard", "venus", "victor", "vidar", "vienna", "viper", "voice", "voodoo", "voronezh", "vortex", "voyager", "vulcano", "waffle", "wagner", "walker", "wallpaper", "walrus", "wanderer", "warrior", "webadmin", "webdav", "websearch", "webview", "wedge", "westnet", "whiterose", "wide", "widget", "willow", "win4", "window", "winnie", "winnt", "wolf", "wraith", "write", "wuhan", "xanadu", "xena", "xenon", "xmail", "xpress", "yang", "youth", "yoyo", "yume", "zeppelin", "zero", "zeus", "zhang", "zimbra", "zion", "zombie", "zona", "zorro", "zulu", "NativeAPI" ], "references": [ "duktape.h", "tribool_io.hpp", "dnsspider", "libgo.so.22.0.0", "https://hybrid-analysis.com/sample/a55c43184ee4ec03a636b357e8fef5ce2e8fde34f61a28610d4ca285db9b07e4/64e43114272b03328005b88b", "/opt/cuda", "https://hybrid-analysis.com/sample/db47ed2f22009cab171b7d16ec3462258ddf7bed0a6a9af198e5394e783198c0/64e3ff9747b24214820d5c1a", "https://hybrid-analysis.com/sample/32bc49b0d1d7aba6742b0e81dc0105c54bd5c9f32321f96b1594fbbe36692880", "https://hybrid-analysis.com/sample/bad3965a417d2fd936116414be04591aedc9275d3c545b3709334d3805d69bef/64e3ffbd15668ff65803bf54", "dockerd", "https://hybrid-analysis.com/sample/a55c43184ee4ec03a636b357e8fef5ce2e8fde34f61a28610d4ca285db9b07e4", "https://hybrid-analysis.com/sample/db47ed2f22009cab171b7d16ec3462258ddf7bed0a6a9af198e5394e783198c0", "https://hybrid-analysis.com/sample/0d4a7cda209c9701bc4cd19aac861d2be8aa1ce6258922d64e711de3d9bad2ae/64e679f61825d88cf802a74d", "https://hybrid-analysis.com/sample/b2efd5e0c2f695063a8bce40c8182aa70f33c4b1b77d232b7530d89fb9646f0c/64e52411dbff7da2f4065fe7", "https://hybrid-analysis.com/sample/bad3965a417d2fd936116414be04591aedc9275d3c545b3709334d3805d69bef", "https://hybrid-analysis.com/sample/1ba7314785f705d0a3db7a3a8ae1da4fe11a2f776287ce3aabc3f3931469447b/64e67888f8d1145b63007ad1", "https://hybrid-analysis.com/sample/27c46f4f186b2168b1d37057378b58667151088cea24c8944d539d251d0b7f6d/64e678fba4a2aff1640fc39a" ], "public": 1, "adversary": "TBD", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1573.001", "name": "Symmetric Cryptography", "display_name": "T1573.001 - Symmetric Cryptography" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1003.008", "name": "/etc/passwd and /etc/shadow", "display_name": "T1003.008 - /etc/passwd and /etc/shadow" }, { "id": "T1007", "name": "System Service Discovery", "display_name": "T1007 - System Service Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1547.009", "name": "Shortcut Modification", "display_name": "T1547.009 - Shortcut Modification" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1055.003", "name": "Thread Execution Hijacking", "display_name": "T1055.003 - Thread Execution Hijacking" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1560.002", "name": "Archive via Library", "display_name": "T1560.002 - Archive via Library" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1056.004", "name": "Credential API Hooking", "display_name": "T1056.004 - Credential API Hooking" }, { "id": "T1074.001", "name": "Local Data Staging", "display_name": "T1074.001 - Local Data Staging" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1546.015", "name": "Component Object Model Hijacking", "display_name": "T1546.015 - Component Object Model Hijacking" }, { "id": "T1059.005", "name": "Visual Basic", "display_name": "T1059.005 - Visual Basic" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [ "individuals" ], "TLP": "white", "cloned_from": null, "export_count": 152, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Merkd1904", "id": "196517", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 676, "URL": 1068, "domain": 11442, "email": 36, "hostname": 1862, "FileHash-MD5": 2000, "FileHash-SHA256": 1082 }, "indicator_count": 18166, "is_author": false, "is_subscribing": null, "subscriber_count": 79, "modified_text": "794 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64d7b50681961fa5e507b6b3", "name": "Phishing links piped to my personal devices", "description": "IOC's from an ongoing attack stemming from January 2022. This pulse will be malicious or phishing links piped to my personal devices by the threat actor.", "modified": "2024-02-10T03:14:05.379000", "created": "2023-08-12T16:36:22.687000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please" ], "references": [ "http://hybrid-analysis.com/sample/4d8c2597fa65831b53c1cf32f418852f59f574c8811e9005121a5f6340b419de", "http://hybrid-analysis.com/sample/aa9862795c36c1eb69e665ffb00eb26e357f78e834fde753c823ff093199ed5d/64512d1b26a4544a2e012b74" ], "public": 1, "adversary": "N/A", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "individials" ], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Merkd1904", "id": "196517", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 692, "FileHash-SHA1": 169, "FileHash-SHA256": 297, "URL": 895, "domain": 3465, "email": 5, "hostname": 521, "CVE": 4 }, "indicator_count": 6048, "is_author": false, "is_subscribing": null, "subscriber_count": 74, "modified_text": "799 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a05f90fecc8ca5ef695c", "name": "IOC's from my personal devices for the week starting 08/21/23 - Pure Linux", "description": "", "modified": "2023-12-06T16:25:02.930000", "created": "2023-12-06T16:25:02.930000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2821, "hostname": 464, "email": 26, "URL": 978, "FileHash-MD5": 1139, "FileHash-SHA1": 541, "FileHash-SHA256": 839 }, "indicator_count": 6808, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a384e3e8573cf5ecac4", "name": "v2 - kopat electronic door security with hybrid scan data", "description": "", "modified": "2023-12-06T15:58:48.938000", "created": "2023-12-06T15:58:48.938000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1569, "URL": 3824, "email": 8, "domain": 290, "hostname": 189, "FileHash-MD5": 576, "FileHash-SHA1": 52 }, "indicator_count": 6508, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "645c9552d2976bc754de54f3", "name": ";https://ssl.kaptcha.com/collect/sdk?m=700000", "description": "[", "modified": "2023-05-11T07:12:18.292000", "created": "2023-05-11T07:12:18.292000", "tags": [], "references": [ "https://ssl.kaptcha.com/collect/sdk?m=700000", "https://www.hybrid-analysis.com/sample/161727a812a1c449bd581cbe577ba30fff74533887ce55dccdc7eaad27753b2c/645bf4aed69ba630d909ae5f" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1177, "domain": 162, "hostname": 321, "FileHash-SHA256": 81, "IPv4": 6, "FileHash-MD5": 71, "FileHash-SHA1": 53, "email": 3 }, "indicator_count": 1874, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "1074 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "645bf6923cdc8183594af3d9", "name": "www.adslchecker.com", "description": "", "modified": "2023-05-10T19:54:58.315000", "created": "2023-05-10T19:54:58.315000", "tags": [ "chromeua", "optout", "varchar", "ansi", "runtime data", "drmedgeua", "integer default", "license", "formanspa1", "script", "null", "facebook", "meta", "body", "roboto", "blink", "mini", "4629", "false", "united kingdom", "server", "date", "flag" ], "references": [ "https://ssl.kaptcha.com/collect/sdk?m=700000" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 24, "URL": 96, "domain": 53, "hostname": 66, "email": 1, "IPv4": 1, "FileHash-MD5": 8 }, "indicator_count": 249, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1075 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "645932281e34157197d4cbe4", "name": "v2 - kopat electronic door security with hybrid scan data", "description": "", "modified": "2023-05-08T17:32:24.648000", "created": "2023-05-08T17:32:24.648000", "tags": [ "dropped file", "null", "varchar", "gecko", "pcap", "pcap processing", "win64", "khtml", "span", "cookie", "path", "mozi", "roboto", "class", "mozilla", "body", "form", "window", "accept", "meta", "iframe", "contact", "4629", "trim", "embed", "dwis", "test", "tear", "qakbot", "tecv", "1inb", "a3ob", "u9p10dkhttps", "windir", "openurl c", "l10dkhttps", "charset", "w6t2hm", "is6bi" ], "references": [ "https://www.hybrid-analysis.com/sample/5ea6b6bdf0a82359f7f73c6095b6c8891be485234e5544ef18a000136617a1b6/645767842cd19c9c560f0381" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3824, "hostname": 189, "domain": 290, "FileHash-SHA256": 1569, "email": 8, "IPv4": 27, "FileHash-MD5": 576, "FileHash-SHA1": 52 }, "indicator_count": 6535, "is_author": false, "is_subscribing": null, "subscriber_count": 95, "modified_text": "1077 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "642d4c321a389c0385920349", "name": ";https://webmail.shahroodut.ac.ir/ajax/redir.hsp?url=https%3A%2F%2Fees.elsevier.com%2Fnpb'", "description": "", "modified": "2023-05-04T23:04:14.165000", "created": "2023-04-05T10:23:46.725000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "chromeua", "runtime data", "optout", "ansi", "dropped file", "drmedgeua", "unicode", "optin", "edgeua", "hidemfhevccodec", "close", "error", "roboto", "hybrid", "suspicious", "click", "hosts", "april", "general", "malicious", "strings", "qakbot" ], "references": [ "https://hybrid-analysis.com/sample/1fdaa98a991df2ff882e942feabe1f29a9da09df85d2bf15c04eb53f6022dea3/642c37082823e5c2e001924b" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 144, "hostname": 75, "domain": 52, "FileHash-MD5": 57, "FileHash-SHA1": 47, "FileHash-SHA256": 49 }, "indicator_count": 424, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1080 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://code.yengo.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://code.yengo.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776629337.287912 }