{ "type": "URL", "indicator": "https://community.goaloo18.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://community.goaloo18.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3786597813, "indicator": "https://community.goaloo18.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "656457d8dfbb95a0be58b263", "name": "PHI at risk? Infected Healthcare System? Masquerading", "description": "Masquerading. Obnoxious privilege escalation. Dangerous entanglements. Attorneys representing target, reinsurance, doctors, and alleged SA PT 'seemingly' involved with attacking & silencing Brashears. Tulach Malware present. Masquerading? Health care establishment and patient PHI at risk. Targets safety @ risk. Found in workers compensation (spoofed?) attorney link.\nhttp://kaplanmorrell.com/meet-kaplan-morrel/meet-ronda-cordova/ (OTX Auto populated: Researchers from the Institute for Strategic Research (MITRE) in the United States have produced a report on the threat posed to the US government by hackers using the \"fireeyei\" web address.)", "modified": "2023-12-27T06:00:26.403000", "created": "2023-11-27T08:48:22.997000", "tags": [ "windir", "json data", "getprocaddress", "localappdata", "ascii text", "temp", "unicode text", "indicator", "file", "pattern match", "path", "factory", "hybrid", "general", "detection list", "blacklist", "alexa top", "cisco umbrella", "site", "million", "safe site", "malware", "malicious site", "alexa", "phishing site", "malware site", "unsafe", "netsky", "malicious", "downldr", "raccoon", "redline stealer", "metastealer", "phishing", "cobalt strike", "icedid", "opencandy", "exploit", "riskware", "agent", "xrat", "download", "mimikatz", "quasar rat", "union", "team", "bank", "cve201711882", "vidar", "swrort", "win64", "suspicious", "deepscan", "trojanspy", "maltiverse", "united", "proxy", "firehol", "possiblecerber", "outlook", "covid19", "artemis", "generic malware", "tag count", "malware generic", "wed sep", "threat report", "summary", "sample", "samples", "first", "ssl certificate", "threat roundup", "whois record", "contacted", "historical ssl", "march", "referrer", "july", "historical", "whois whois", "june", "execution", "august", "copy", "april", "hacktool", "skynet", "threat analyzer", "threat", "paste", "iocs", "urls https", "productidis", "heur", "anonymizer", "adware", "ransomware", "fuery", "rostpay", "wacatac", "genkryptik", "qakbot", "asyncrat", "installcore", "downloader", "driverpack", "systweak", "encdoc", "kryptik", "bitrep", "killav", "t", "noname057", "keylogger", "spyware", "ip summary", "url summary", "generic", "blacklist http", "malicious url", "iframe", "seraph", "webcompanion", "facebook", "crack", "xtrat", "cleaner", "azorult", "service", "runescape", "emotet", "blacknet rat", "stealer", "coinminer", "dropper", "fakealert", "conduit", "softcnapp", "nircmd", "unruy", "filetour", "patcher", "adload", "junk data", "random domains", "random hosts", "tsara brashears", "target", "phi", "uchealth", "content generating", "Web generator", "installcore" ], "references": [ "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996/65642d5cfa9d60126100612e", "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://fireeyei.iowa.gov/", "http://michaela.young@uchealth.com/", "http://uchealth.com/physician/frank-avilucea/", "https://my.uchealth.com/myuchealth/Visits/VisitDetails?csn=WP-24%E2%80%A6FJ0JuA-3D-3D-24vasu1ISpMoMuqD8IMEos5jRZZFiBtfPMciW-2FFH52VaQ-3D", "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf", "https://my.uchealth.com/myuchealth/inside.asp?mode=visitsummary&submode=notes&csn=WP-24PtuJGFUkCkn9owS5DdIspw-3D-3D-24g6bhGYash%E2%80%A6", "https://www.energyvanguard.com/blog/59284/Guest-Post-The-Fatal-Flaw-in-Advanced-Framing-Part-1", "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=", "https://www.wlafx4trk.com/cmp/33K48/5ZK2T/?source_id=95_1236_91dabe93-2a51-4b93-bfd3-4a4bd7e00ff3_31&sub1=4df5b890c55d4bdead5ba03dde982afa", "https://yugemobile.com/tracking?plcmntid=ym5002&imps=2dda8436-396e-4b37-a917-0cce11ffb623", "Found in http://kaplanmorrell.com/meet-kaplan-morrel/meet-ronda-cordova/", "vortex-nlb-http2-fed-us-taut-purple.nr-data.net (b.link infringement)", "nr-data.net (Apple Private Data Collection)", "uapi-qa.stlouisfed.org (Hospital Metadata)", "abc7news.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "T", "display_name": "T", "target": null }, { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "O.Gen", "display_name": "O.Gen", "target": null }, { "id": "DriverReviver", "display_name": "DriverReviver", "target": null }, { "id": "RedLine", "display_name": "RedLine", "target": null }, { "id": "Quasar", "display_name": "Quasar", "target": null }, { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "XRAT", "display_name": "XRAT", "target": null }, { "id": "Keylogger", "display_name": "Keylogger", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1588.004", "name": "Digital Certificates", "display_name": "T1588.004 - Digital Certificates" }, { "id": "T1546.015", "name": "Component Object Model Hijacking", "display_name": "T1546.015 - Component Object Model Hijacking" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 76, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 789, "FileHash-SHA256": 5146, "SSLCertFingerprint": 2, "domain": 1794, "URL": 2130, "hostname": 1025, "FileHash-MD5": 1478, "CVE": 15 }, "indicator_count": 12379, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "845 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656a9a1c71847ed3f62bca19", "name": "PHI at risk? Infected Healthcare System? Masquerading", "description": "", "modified": "2023-12-27T06:00:26.403000", "created": "2023-12-02T02:44:44.329000", "tags": [ "windir", "json data", "getprocaddress", "localappdata", "ascii text", "temp", "unicode text", "indicator", "file", "pattern match", "path", "factory", "hybrid", "general", "detection list", "blacklist", "alexa top", "cisco umbrella", "site", "million", "safe site", "malware", "malicious site", "alexa", "phishing site", "malware site", "unsafe", "netsky", "malicious", "downldr", "raccoon", "redline stealer", "metastealer", "phishing", "cobalt strike", "icedid", "opencandy", "exploit", "riskware", "agent", "xrat", "download", "mimikatz", "quasar rat", "union", "team", "bank", "cve201711882", "vidar", "swrort", "win64", "suspicious", "deepscan", "trojanspy", "maltiverse", "united", "proxy", "firehol", "possiblecerber", "outlook", "covid19", "artemis", "generic malware", "tag count", "malware generic", "wed sep", "threat report", "summary", "sample", "samples", "first", "ssl certificate", "threat roundup", "whois record", "contacted", "historical ssl", "march", "referrer", "july", "historical", "whois whois", "june", "execution", "august", "copy", "april", "hacktool", "skynet", "threat analyzer", "threat", "paste", "iocs", "urls https", "productidis", "heur", "anonymizer", "adware", "ransomware", "fuery", "rostpay", "wacatac", "genkryptik", "qakbot", "asyncrat", "installcore", "downloader", "driverpack", "systweak", "encdoc", "kryptik", "bitrep", "killav", "t", "noname057", "keylogger", "spyware", "ip summary", "url summary", "generic", "blacklist http", "malicious url", "iframe", "seraph", "webcompanion", "facebook", "crack", "xtrat", "cleaner", "azorult", "service", "runescape", "emotet", "blacknet rat", "stealer", "coinminer", "dropper", "fakealert", "conduit", "softcnapp", "nircmd", "unruy", "filetour", "patcher", "adload", "junk data", "random domains", "random hosts", "tsara brashears", "target", "phi", "uchealth", "content generating", "Web generator", "installcore" ], "references": [ "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996/65642d5cfa9d60126100612e", "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://fireeyei.iowa.gov/", "http://michaela.young@uchealth.com/", "http://uchealth.com/physician/frank-avilucea/", "https://my.uchealth.com/myuchealth/Visits/VisitDetails?csn=WP-24%E2%80%A6FJ0JuA-3D-3D-24vasu1ISpMoMuqD8IMEos5jRZZFiBtfPMciW-2FFH52VaQ-3D", "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf", "https://my.uchealth.com/myuchealth/inside.asp?mode=visitsummary&submode=notes&csn=WP-24PtuJGFUkCkn9owS5DdIspw-3D-3D-24g6bhGYash%E2%80%A6", "https://www.energyvanguard.com/blog/59284/Guest-Post-The-Fatal-Flaw-in-Advanced-Framing-Part-1", "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=", "https://www.wlafx4trk.com/cmp/33K48/5ZK2T/?source_id=95_1236_91dabe93-2a51-4b93-bfd3-4a4bd7e00ff3_31&sub1=4df5b890c55d4bdead5ba03dde982afa", "https://yugemobile.com/tracking?plcmntid=ym5002&imps=2dda8436-396e-4b37-a917-0cce11ffb623", "Found in http://kaplanmorrell.com/meet-kaplan-morrel/meet-ronda-cordova/", "vortex-nlb-http2-fed-us-taut-purple.nr-data.net (b.link infringement)", "nr-data.net (Apple Private Data Collection)", "uapi-qa.stlouisfed.org (Hospital Metadata)", "abc7news.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "T", "display_name": "T", "target": null }, { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "O.Gen", "display_name": "O.Gen", "target": null }, { "id": "DriverReviver", "display_name": "DriverReviver", "target": null }, { "id": "RedLine", "display_name": "RedLine", "target": null }, { "id": "Quasar", "display_name": "Quasar", "target": null }, { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "XRAT", "display_name": "XRAT", "target": null }, { "id": "Keylogger", "display_name": "Keylogger", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1588.004", "name": "Digital Certificates", "display_name": "T1588.004 - Digital Certificates" }, { "id": "T1546.015", "name": "Component Object Model Hijacking", "display_name": "T1546.015 - Component Object Model Hijacking" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" } ], "industries": [], "TLP": "white", "cloned_from": "656457d8dfbb95a0be58b263", "export_count": 58, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 789, "FileHash-SHA256": 5146, "SSLCertFingerprint": 2, "domain": 1794, "URL": 2130, "hostname": 1025, "FileHash-MD5": 1478, "CVE": 15 }, "indicator_count": 12379, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "845 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656aa406d0b8009df583c87c", "name": "PHI at risk? Infected Healthcare System? Masquerading", "description": "", "modified": "2023-12-27T06:00:26.403000", "created": "2023-12-02T03:27:02.624000", "tags": [ "windir", "json data", "getprocaddress", "localappdata", "ascii text", "temp", "unicode text", "indicator", "file", "pattern match", "path", "factory", "hybrid", "general", "detection list", "blacklist", "alexa top", "cisco umbrella", "site", "million", "safe site", "malware", "malicious site", "alexa", "phishing site", "malware site", "unsafe", "netsky", "malicious", "downldr", "raccoon", "redline stealer", "metastealer", "phishing", "cobalt strike", "icedid", "opencandy", "exploit", "riskware", "agent", "xrat", "download", "mimikatz", "quasar rat", "union", "team", "bank", "cve201711882", "vidar", "swrort", "win64", "suspicious", "deepscan", "trojanspy", "maltiverse", "united", "proxy", "firehol", "possiblecerber", "outlook", "covid19", "artemis", "generic malware", "tag count", "malware generic", "wed sep", "threat report", "summary", "sample", "samples", "first", "ssl certificate", "threat roundup", "whois record", "contacted", "historical ssl", "march", "referrer", "july", "historical", "whois whois", "june", "execution", "august", "copy", "april", "hacktool", "skynet", "threat analyzer", "threat", "paste", "iocs", "urls https", "productidis", "heur", "anonymizer", "adware", "ransomware", "fuery", "rostpay", "wacatac", "genkryptik", "qakbot", "asyncrat", "installcore", "downloader", "driverpack", "systweak", "encdoc", "kryptik", "bitrep", "killav", "t", "noname057", "keylogger", "spyware", "ip summary", "url summary", "generic", "blacklist http", "malicious url", "iframe", "seraph", "webcompanion", "facebook", "crack", "xtrat", "cleaner", "azorult", "service", "runescape", "emotet", "blacknet rat", "stealer", "coinminer", "dropper", "fakealert", "conduit", "softcnapp", "nircmd", "unruy", "filetour", "patcher", "adload", "junk data", "random domains", "random hosts", "tsara brashears", "target", "phi", "uchealth", "content generating", "Web generator", "installcore" ], "references": [ "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996/65642d5cfa9d60126100612e", "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://fireeyei.iowa.gov/", "http://michaela.young@uchealth.com/", "http://uchealth.com/physician/frank-avilucea/", "https://my.uchealth.com/myuchealth/Visits/VisitDetails?csn=WP-24%E2%80%A6FJ0JuA-3D-3D-24vasu1ISpMoMuqD8IMEos5jRZZFiBtfPMciW-2FFH52VaQ-3D", "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf", "https://my.uchealth.com/myuchealth/inside.asp?mode=visitsummary&submode=notes&csn=WP-24PtuJGFUkCkn9owS5DdIspw-3D-3D-24g6bhGYash%E2%80%A6", "https://www.energyvanguard.com/blog/59284/Guest-Post-The-Fatal-Flaw-in-Advanced-Framing-Part-1", "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=", "https://www.wlafx4trk.com/cmp/33K48/5ZK2T/?source_id=95_1236_91dabe93-2a51-4b93-bfd3-4a4bd7e00ff3_31&sub1=4df5b890c55d4bdead5ba03dde982afa", "https://yugemobile.com/tracking?plcmntid=ym5002&imps=2dda8436-396e-4b37-a917-0cce11ffb623", "Found in http://kaplanmorrell.com/meet-kaplan-morrel/meet-ronda-cordova/", "vortex-nlb-http2-fed-us-taut-purple.nr-data.net (b.link infringement)", "nr-data.net (Apple Private Data Collection)", "uapi-qa.stlouisfed.org (Hospital Metadata)", "abc7news.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "T", "display_name": "T", "target": null }, { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "O.Gen", "display_name": "O.Gen", "target": null }, { "id": "DriverReviver", "display_name": "DriverReviver", "target": null }, { "id": "RedLine", "display_name": "RedLine", "target": null }, { "id": "Quasar", "display_name": "Quasar", "target": null }, { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "XRAT", "display_name": "XRAT", "target": null }, { "id": "Keylogger", "display_name": "Keylogger", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1588.004", "name": "Digital Certificates", "display_name": "T1588.004 - Digital Certificates" }, { "id": "T1546.015", "name": "Component Object Model Hijacking", "display_name": "T1546.015 - Component Object Model Hijacking" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" } ], "industries": [], "TLP": "white", "cloned_from": "656457d8dfbb95a0be58b263", "export_count": 60, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 789, "FileHash-SHA256": 5146, "SSLCertFingerprint": 2, "domain": 1794, "URL": 2130, "hostname": 1025, "FileHash-MD5": 1478, "CVE": 15 }, "indicator_count": 12379, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "845 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "http://michaela.young@uchealth.com/", "https://www.energyvanguard.com/blog/59284/Guest-Post-The-Fatal-Flaw-in-Advanced-Framing-Part-1", "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=", "https://yugemobile.com/tracking?plcmntid=ym5002&imps=2dda8436-396e-4b37-a917-0cce11ffb623", "Found in http://kaplanmorrell.com/meet-kaplan-morrel/meet-ronda-cordova/", "uapi-qa.stlouisfed.org (Hospital Metadata)", "https://www.wlafx4trk.com/cmp/33K48/5ZK2T/?source_id=95_1236_91dabe93-2a51-4b93-bfd3-4a4bd7e00ff3_31&sub1=4df5b890c55d4bdead5ba03dde982afa", "nr-data.net (Apple Private Data Collection)", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "abc7news.com", "http://fireeyei.iowa.gov/", "https://my.uchealth.com/myuchealth/Visits/VisitDetails?csn=WP-24%E2%80%A6FJ0JuA-3D-3D-24vasu1ISpMoMuqD8IMEos5jRZZFiBtfPMciW-2FFH52VaQ-3D", "http://uchealth.com/physician/frank-avilucea/", "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf", "https://my.uchealth.com/myuchealth/inside.asp?mode=visitsummary&submode=notes&csn=WP-24PtuJGFUkCkn9owS5DdIspw-3D-3D-24g6bhGYash%E2%80%A6", "vortex-nlb-http2-fed-us-taut-purple.nr-data.net (b.link infringement)", "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996/65642d5cfa9d60126100612e", "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Redline", "Qakbot - s0650", "Keylogger", "Xrat", "Quasar", "T", "Generic", "Maltiverse", "O.gen", "Trojanspy", "Driverreviver" ], "industries": [], "unique_indicators": 12790 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/goaloo18.com", "whois": "http://whois.domaintools.com/goaloo18.com", "domain": "goaloo18.com", "hostname": "community.goaloo18.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "656457d8dfbb95a0be58b263", "name": "PHI at risk? Infected Healthcare System? Masquerading", "description": "Masquerading. Obnoxious privilege escalation. Dangerous entanglements. Attorneys representing target, reinsurance, doctors, and alleged SA PT 'seemingly' involved with attacking & silencing Brashears. Tulach Malware present. Masquerading? Health care establishment and patient PHI at risk. Targets safety @ risk. Found in workers compensation (spoofed?) attorney link.\nhttp://kaplanmorrell.com/meet-kaplan-morrel/meet-ronda-cordova/ (OTX Auto populated: Researchers from the Institute for Strategic Research (MITRE) in the United States have produced a report on the threat posed to the US government by hackers using the \"fireeyei\" web address.)", "modified": "2023-12-27T06:00:26.403000", "created": "2023-11-27T08:48:22.997000", "tags": [ "windir", "json data", "getprocaddress", "localappdata", "ascii text", "temp", "unicode text", "indicator", "file", "pattern match", "path", "factory", "hybrid", "general", "detection list", "blacklist", "alexa top", "cisco umbrella", "site", "million", "safe site", "malware", "malicious site", "alexa", "phishing site", "malware site", "unsafe", "netsky", "malicious", "downldr", "raccoon", "redline stealer", "metastealer", "phishing", "cobalt strike", "icedid", "opencandy", "exploit", "riskware", "agent", "xrat", "download", "mimikatz", "quasar rat", "union", "team", "bank", "cve201711882", "vidar", "swrort", "win64", "suspicious", "deepscan", "trojanspy", "maltiverse", "united", "proxy", "firehol", "possiblecerber", "outlook", "covid19", "artemis", "generic malware", "tag count", "malware generic", "wed sep", "threat report", "summary", "sample", "samples", "first", "ssl certificate", "threat roundup", "whois record", "contacted", "historical ssl", "march", "referrer", "july", "historical", "whois whois", "june", "execution", "august", "copy", "april", "hacktool", "skynet", "threat analyzer", "threat", "paste", "iocs", "urls https", "productidis", "heur", "anonymizer", "adware", "ransomware", "fuery", "rostpay", "wacatac", "genkryptik", "qakbot", "asyncrat", "installcore", "downloader", "driverpack", "systweak", "encdoc", "kryptik", "bitrep", "killav", "t", "noname057", "keylogger", "spyware", "ip summary", "url summary", "generic", "blacklist http", "malicious url", "iframe", "seraph", "webcompanion", "facebook", "crack", "xtrat", "cleaner", "azorult", "service", "runescape", "emotet", "blacknet rat", "stealer", "coinminer", "dropper", "fakealert", "conduit", "softcnapp", "nircmd", "unruy", "filetour", "patcher", "adload", "junk data", "random domains", "random hosts", "tsara brashears", "target", "phi", "uchealth", "content generating", "Web generator", "installcore" ], "references": [ "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996/65642d5cfa9d60126100612e", "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://fireeyei.iowa.gov/", "http://michaela.young@uchealth.com/", "http://uchealth.com/physician/frank-avilucea/", "https://my.uchealth.com/myuchealth/Visits/VisitDetails?csn=WP-24%E2%80%A6FJ0JuA-3D-3D-24vasu1ISpMoMuqD8IMEos5jRZZFiBtfPMciW-2FFH52VaQ-3D", "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf", "https://my.uchealth.com/myuchealth/inside.asp?mode=visitsummary&submode=notes&csn=WP-24PtuJGFUkCkn9owS5DdIspw-3D-3D-24g6bhGYash%E2%80%A6", "https://www.energyvanguard.com/blog/59284/Guest-Post-The-Fatal-Flaw-in-Advanced-Framing-Part-1", "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=", "https://www.wlafx4trk.com/cmp/33K48/5ZK2T/?source_id=95_1236_91dabe93-2a51-4b93-bfd3-4a4bd7e00ff3_31&sub1=4df5b890c55d4bdead5ba03dde982afa", "https://yugemobile.com/tracking?plcmntid=ym5002&imps=2dda8436-396e-4b37-a917-0cce11ffb623", "Found in http://kaplanmorrell.com/meet-kaplan-morrel/meet-ronda-cordova/", "vortex-nlb-http2-fed-us-taut-purple.nr-data.net (b.link infringement)", "nr-data.net (Apple Private Data Collection)", "uapi-qa.stlouisfed.org (Hospital Metadata)", "abc7news.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "T", "display_name": "T", "target": null }, { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "O.Gen", "display_name": "O.Gen", "target": null }, { "id": "DriverReviver", "display_name": "DriverReviver", "target": null }, { "id": "RedLine", "display_name": "RedLine", "target": null }, { "id": "Quasar", "display_name": "Quasar", "target": null }, { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "XRAT", "display_name": "XRAT", "target": null }, { "id": "Keylogger", "display_name": "Keylogger", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1588.004", "name": "Digital Certificates", "display_name": "T1588.004 - Digital Certificates" }, { "id": "T1546.015", "name": "Component Object Model Hijacking", "display_name": "T1546.015 - Component Object Model Hijacking" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 76, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 789, "FileHash-SHA256": 5146, "SSLCertFingerprint": 2, "domain": 1794, "URL": 2130, "hostname": 1025, "FileHash-MD5": 1478, "CVE": 15 }, "indicator_count": 12379, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "845 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656a9a1c71847ed3f62bca19", "name": "PHI at risk? Infected Healthcare System? Masquerading", "description": "", "modified": "2023-12-27T06:00:26.403000", "created": "2023-12-02T02:44:44.329000", "tags": [ "windir", "json data", "getprocaddress", "localappdata", "ascii text", "temp", "unicode text", "indicator", "file", "pattern match", "path", "factory", "hybrid", "general", "detection list", "blacklist", "alexa top", "cisco umbrella", "site", "million", "safe site", "malware", "malicious site", "alexa", "phishing site", "malware site", "unsafe", "netsky", "malicious", "downldr", "raccoon", "redline stealer", "metastealer", "phishing", "cobalt strike", "icedid", "opencandy", "exploit", "riskware", "agent", "xrat", "download", "mimikatz", "quasar rat", "union", "team", "bank", "cve201711882", "vidar", "swrort", "win64", "suspicious", "deepscan", "trojanspy", "maltiverse", "united", "proxy", "firehol", "possiblecerber", "outlook", "covid19", "artemis", "generic malware", "tag count", "malware generic", "wed sep", "threat report", "summary", "sample", "samples", "first", "ssl certificate", "threat roundup", "whois record", "contacted", "historical ssl", "march", "referrer", "july", "historical", "whois whois", "june", "execution", "august", "copy", "april", "hacktool", "skynet", "threat analyzer", "threat", "paste", "iocs", "urls https", "productidis", "heur", "anonymizer", "adware", "ransomware", "fuery", "rostpay", "wacatac", "genkryptik", "qakbot", "asyncrat", "installcore", "downloader", "driverpack", "systweak", "encdoc", "kryptik", "bitrep", "killav", "t", "noname057", "keylogger", "spyware", "ip summary", "url summary", "generic", "blacklist http", "malicious url", "iframe", "seraph", "webcompanion", "facebook", "crack", "xtrat", "cleaner", "azorult", "service", "runescape", "emotet", "blacknet rat", "stealer", "coinminer", "dropper", "fakealert", "conduit", "softcnapp", "nircmd", "unruy", "filetour", "patcher", "adload", "junk data", "random domains", "random hosts", "tsara brashears", "target", "phi", "uchealth", "content generating", "Web generator", "installcore" ], "references": [ "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996/65642d5cfa9d60126100612e", "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://fireeyei.iowa.gov/", "http://michaela.young@uchealth.com/", "http://uchealth.com/physician/frank-avilucea/", "https://my.uchealth.com/myuchealth/Visits/VisitDetails?csn=WP-24%E2%80%A6FJ0JuA-3D-3D-24vasu1ISpMoMuqD8IMEos5jRZZFiBtfPMciW-2FFH52VaQ-3D", "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf", "https://my.uchealth.com/myuchealth/inside.asp?mode=visitsummary&submode=notes&csn=WP-24PtuJGFUkCkn9owS5DdIspw-3D-3D-24g6bhGYash%E2%80%A6", "https://www.energyvanguard.com/blog/59284/Guest-Post-The-Fatal-Flaw-in-Advanced-Framing-Part-1", "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=", "https://www.wlafx4trk.com/cmp/33K48/5ZK2T/?source_id=95_1236_91dabe93-2a51-4b93-bfd3-4a4bd7e00ff3_31&sub1=4df5b890c55d4bdead5ba03dde982afa", "https://yugemobile.com/tracking?plcmntid=ym5002&imps=2dda8436-396e-4b37-a917-0cce11ffb623", "Found in http://kaplanmorrell.com/meet-kaplan-morrel/meet-ronda-cordova/", "vortex-nlb-http2-fed-us-taut-purple.nr-data.net (b.link infringement)", "nr-data.net (Apple Private Data Collection)", "uapi-qa.stlouisfed.org (Hospital Metadata)", "abc7news.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "T", "display_name": "T", "target": null }, { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "O.Gen", "display_name": "O.Gen", "target": null }, { "id": "DriverReviver", "display_name": "DriverReviver", "target": null }, { "id": "RedLine", "display_name": "RedLine", "target": null }, { "id": "Quasar", "display_name": "Quasar", "target": null }, { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "XRAT", "display_name": "XRAT", "target": null }, { "id": "Keylogger", "display_name": "Keylogger", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1588.004", "name": "Digital Certificates", "display_name": "T1588.004 - Digital Certificates" }, { "id": "T1546.015", "name": "Component Object Model Hijacking", "display_name": "T1546.015 - Component Object Model Hijacking" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" } ], "industries": [], "TLP": "white", "cloned_from": "656457d8dfbb95a0be58b263", "export_count": 58, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 789, "FileHash-SHA256": 5146, "SSLCertFingerprint": 2, "domain": 1794, "URL": 2130, "hostname": 1025, "FileHash-MD5": 1478, "CVE": 15 }, "indicator_count": 12379, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "845 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656aa406d0b8009df583c87c", "name": "PHI at risk? Infected Healthcare System? Masquerading", "description": "", "modified": "2023-12-27T06:00:26.403000", "created": "2023-12-02T03:27:02.624000", "tags": [ "windir", "json data", "getprocaddress", "localappdata", "ascii text", "temp", "unicode text", "indicator", "file", "pattern match", "path", "factory", "hybrid", "general", "detection list", "blacklist", "alexa top", "cisco umbrella", "site", "million", "safe site", "malware", "malicious site", "alexa", "phishing site", "malware site", "unsafe", "netsky", "malicious", "downldr", "raccoon", "redline stealer", "metastealer", "phishing", "cobalt strike", "icedid", "opencandy", "exploit", "riskware", "agent", "xrat", "download", "mimikatz", "quasar rat", "union", "team", "bank", "cve201711882", "vidar", "swrort", "win64", "suspicious", "deepscan", "trojanspy", "maltiverse", "united", "proxy", "firehol", "possiblecerber", "outlook", "covid19", "artemis", "generic malware", "tag count", "malware generic", "wed sep", "threat report", "summary", "sample", "samples", "first", "ssl certificate", "threat roundup", "whois record", "contacted", "historical ssl", "march", "referrer", "july", "historical", "whois whois", "june", "execution", "august", "copy", "april", "hacktool", "skynet", "threat analyzer", "threat", "paste", "iocs", "urls https", "productidis", "heur", "anonymizer", "adware", "ransomware", "fuery", "rostpay", "wacatac", "genkryptik", "qakbot", "asyncrat", "installcore", "downloader", "driverpack", "systweak", "encdoc", "kryptik", "bitrep", "killav", "t", "noname057", "keylogger", "spyware", "ip summary", "url summary", "generic", "blacklist http", "malicious url", "iframe", "seraph", "webcompanion", "facebook", "crack", "xtrat", "cleaner", "azorult", "service", "runescape", "emotet", "blacknet rat", "stealer", "coinminer", "dropper", "fakealert", "conduit", "softcnapp", "nircmd", "unruy", "filetour", "patcher", "adload", "junk data", "random domains", "random hosts", "tsara brashears", "target", "phi", "uchealth", "content generating", "Web generator", "installcore" ], "references": [ "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996/65642d5cfa9d60126100612e", "https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://fireeyei.iowa.gov/", "http://michaela.young@uchealth.com/", "http://uchealth.com/physician/frank-avilucea/", "https://my.uchealth.com/myuchealth/Visits/VisitDetails?csn=WP-24%E2%80%A6FJ0JuA-3D-3D-24vasu1ISpMoMuqD8IMEos5jRZZFiBtfPMciW-2FFH52VaQ-3D", "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf", "https://my.uchealth.com/myuchealth/inside.asp?mode=visitsummary&submode=notes&csn=WP-24PtuJGFUkCkn9owS5DdIspw-3D-3D-24g6bhGYash%E2%80%A6", "https://www.energyvanguard.com/blog/59284/Guest-Post-The-Fatal-Flaw-in-Advanced-Framing-Part-1", "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=", "https://www.wlafx4trk.com/cmp/33K48/5ZK2T/?source_id=95_1236_91dabe93-2a51-4b93-bfd3-4a4bd7e00ff3_31&sub1=4df5b890c55d4bdead5ba03dde982afa", "https://yugemobile.com/tracking?plcmntid=ym5002&imps=2dda8436-396e-4b37-a917-0cce11ffb623", "Found in http://kaplanmorrell.com/meet-kaplan-morrel/meet-ronda-cordova/", "vortex-nlb-http2-fed-us-taut-purple.nr-data.net (b.link infringement)", "nr-data.net (Apple Private Data Collection)", "uapi-qa.stlouisfed.org (Hospital Metadata)", "abc7news.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "T", "display_name": "T", "target": null }, { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "O.Gen", "display_name": "O.Gen", "target": null }, { "id": "DriverReviver", "display_name": "DriverReviver", "target": null }, { "id": "RedLine", "display_name": "RedLine", "target": null }, { "id": "Quasar", "display_name": "Quasar", "target": null }, { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "XRAT", "display_name": "XRAT", "target": null }, { "id": "Keylogger", "display_name": "Keylogger", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1588.004", "name": "Digital Certificates", "display_name": "T1588.004 - Digital Certificates" }, { "id": "T1546.015", "name": "Component Object Model Hijacking", "display_name": "T1546.015 - Component Object Model Hijacking" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" } ], "industries": [], "TLP": "white", "cloned_from": "656457d8dfbb95a0be58b263", "export_count": 60, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 789, "FileHash-SHA256": 5146, "SSLCertFingerprint": 2, "domain": 1794, "URL": 2130, "hostname": 1025, "FileHash-MD5": 1478, "CVE": 15 }, "indicator_count": 12379, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "845 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://community.goaloo18.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://community.goaloo18.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776745282.5851135 }