{ "type": "URL", "indicator": "https://cp.onedyn.pl/link.php", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://cp.onedyn.pl/link.php", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3963988793, "indicator": "https://cp.onedyn.pl/link.php", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "6608aaf7ca0e965e593ed1d4", "name": "MUI programu Microsoft Office Access (w j\u0119zyku angielskim) zosta\u0142o u\u017cyte do wys\u0142ania z\u0142o\u015bliwego oprogramowania na serwer w Czechach jest to pierwszy tego typu atak na komputer. e", "description": "A look back at some of the key words and phrases used to describe the situation in Italy, as \"probacja\" (or \"democrata), as they were translated into English.", "modified": "2025-10-17T11:03:07.034000", "created": "2024-03-31T00:14:47.183000", "tags": [ "sha256", "ssdeep", "reputacja", "tworzy pliki", "informacje", "bardzo duga", "tworzy", "adresy url", "tworzy katalog", "win64", "ameryki", "typ pliku", "serwer nazw", "san jose", "adres", "digital", "data wyganicia", "csc corporate", "domains", "ca data", "data utworzenia", "dnssec" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6432, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2140, "hostname": 5874, "FileHash-SHA256": 12539, "FileHash-MD5": 3686, "FileHash-SHA1": 2751, "IPv4": 503, "URL": 10770, "email": 26, "CVE": 88, "YARA": 6, "JA3": 2, "IPv6": 28, "SSLCertFingerprint": 5, "BitcoinAddress": 3, "CIDR": 1 }, "indicator_count": 38422, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "184 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66246ff49ed29ea9bb2bf122", "name": "S\u0105d Rejonowy w Jeleniej Gorze POLAND", "description": "Przechowywania lub dost\u0119pu do plik\u00f3w cookies w Twojej przegl\u0105darce\nhttps://www.virustotal.com/gui/domain/jelenia-gora.sr.gov.pl/relations", "modified": "2025-05-14T21:18:36.989000", "created": "2024-04-21T01:46:28.554000", "tags": [ "jeleniej grze", "aktualnoci", "informacje", "jednostka", "rejonowy", "konkurs", "najczciej", "sd rejonowy", "przejd", "czytaj", "click", "sdzia jarosaw", "wydziau", "sdzia grzegorz", "katarzyna", "rudnicka dane", "kontaktowe sd", "jelenia gra", "mickiewicza", "zawarto", "html", "nazwa meta", "robotw", "telefon", "brak", "skala", "ua zgodna", "head body", "zasb", "cname", "kod odpowiedzi", "kodowanie treci", "wygasa", "gmt serwer", "pragma", "kontrola pamici", "podrcznej", "data", "gmt kontrola", "dostpuzezwl na", "czytaj wicej", "sd okrgowy", "jednostki", "okrgowy", "ogoszenia", "sha256", "vhash", "ssdeep", "https odcisk", "palca jarma", "https dane", "v3 numer", "odcisk palca", "tworzy katalog", "tworzy pliki", "typ pliku", "json", "ascii", "windows", "sqlite", "foxpro fpt", "links typ", "mapa", "152 x", "sqlite w", "sha1", "sha512", "file size", "b file", "testing", "komornik sdowy", "sdzie rejonowym", "tomasz rodacki", "obwieszczenie", "komornicze", "tumacza migam", "tumacz czynny", "zamknite", "wiadczenia", "schedule", "error", "javascript", "bakers hall", "ixaction", "script", "ixchatlauncher", "compatibility", "com dla", "t1055 pewno", "unikanie obrony", "t1036 maskarada", "t1082 pewno", "informacje o", "nazwa pliku", "dokument pdf", "rozmiar pliku", "zapowied", "type", "iii dbt", "utf8", "dziennik" ], "references": [ "S?d Rejonowy w Jeleniej G\u00f3rze.htm", "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm", "http://www.jelenia-gora.so.gov.pl/", "https://www.jelenia-gora.so.gov.pl/", "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze", "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora", "https://www.jelenia-gora.sr.gov.pl/spacer", "https://waf.intelix.pl/957476/Chat/Script/Compatibility" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "", "display_name": "", "target": null }, { "id": "serwer", "display_name": "serwer", "target": null } ], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "email": 71, "domain": 7651, "hostname": 7680, "IPv4": 331, "FileHash-SHA256": 16168, "URL": 10399, "FileHash-MD5": 3639, "FileHash-SHA1": 3468, "CIDR": 4, "CVE": 89, "YARA": 521, "SSLCertFingerprint": 25, "JA3": 1, "IPv6": 5813 }, "indicator_count": 55860, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "339 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66dc8df6138140378bc0bbc4", "name": "Wy\u017csza kultura. Bank nowo\u015bci - kredyt, po\u017cyczka, konto, lokata - Alior Bank", "description": "Mfa.aliorbank.com is the world's largest bank, with a combined turnover of more than $2bn (\u00c2\u00a31.3bn) in its current financial year.", "modified": "2024-12-17T14:35:32.104000", "created": "2024-09-07T17:31:34.610000", "tags": [ "vhash htm", "ssdeep", "script tags", "trackers google", "tag manager", "anchor hrefs", "bank", "konto osobiste", "kredyty", "po\u017cyczki", "rachunek", "firmy", "klienci indywidualni", "finanse", "lokaty", "oszcz\u0119dno\u015bci", "po\u017cyczka got\u00f3wkowa", "kredyt mieszkaniowy", "karta kredytowa", "inwestycje", "oferta dla os\u00f3b prowadz\u0105cych w\u0142asn\u0105 dzia\u0142alno\u015b\u0107 gospodarcz\u0105", "oferta dla przedsi\u0119biorstw", "kredyty dla ma\u0142ych i \u015brednich firm", "rachunek brokerski", "bankowo\u015b\u0107 elektroniczna", "bankowo\u015b\u0107 mobilna", "ubezpieczenia", "alior", "alior bank", "wy\u017csza kultura. bank nowo\u015bci", "sprawd", "alior mobile", "alior banku", "konto w", "konto jake", "alior online", "informacje", "bezpieczestwo", "jest", "ciebie" ], "references": [ "http://aliorbank.pl", "http://www.aliorbank.pl" ], "public": 1, "adversary": "", "targeted_countries": [ "Poland" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 63, "FileHash-SHA256": 200, "domain": 24, "hostname": 219, "URL": 100, "FileHash-MD5": 12, "FileHash-SHA1": 9, "CVE": 1 }, "indicator_count": 628, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "488 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d65ec934e804ff93de6737", "name": "adorno.eu is for sale!", "description": "GoDaddy.eu is the world's most popular domain provider for people who want to sign up for a domain\u00a0transfering service. \u00c2\u00a31.5m (1m euros)", "modified": "2024-12-17T14:35:30.480000", "created": "2024-09-03T00:56:41.819000", "tags": [ "key id", "sha256", "ssdeep", "godaddy brand", "sedo", "eur excl", "vat buy", "dan buy", "evolution media" ], "references": [ "http://adorno.eu" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 540, "domain": 207, "FileHash-SHA256": 637, "hostname": 425, "FileHash-MD5": 178, "FileHash-SHA1": 106, "IPv4": 12, "email": 1, "CVE": 1 }, "indicator_count": 2107, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "488 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66abb26614baf2276d4892cf", "name": "kir.pl KIR: Hub technologiczny. Dostawca cyfrowych rozwiaza\u0144 dla firm, bank\u00f3w oraz klient\u00f3w indywidualnych.Kluczowy podmiot infrastruktury polskiego systemu p\u0142atniczego.", "description": "934f391c263fe1fb3bca071898f45579c905280f 2022-09-14 *.kir.pl 00e172c1ce91876722ae2faa48df5b17a32c3be9 2021-10-01 *.kir.pl 9bebeaa50825eb88fc9e8899955d821620ac6fe6 2020-10-07 *.kir.pl 4b885389c599abdaa45e11481924600738a5ea37 2020-03-18 *.kir.pl 3b969974bc6f07b8a45dd0ee89f9ee64b862571b 2019-08-14 *.kir.pl 6a69a861061c5e768070c68576127237a43de9c2\nZobacz ca\u0142y artyku\u0142 Elixir malware 08.07.2024 Statystyki system\u00f3w rozliczeniowych KIR w czerwcu 2024 r. W czerwcu przetworzyli\u015bmy w systemie szkodliwe oprogramowanie Elixir 177,85 mln transakcji o warto\u015bci 722,96 mld z\u0142. Zamiast tego w Express Elixir rozliczyli\u015bmy 44,95 mln przelew\u00f3w natychmiastowych o warto\u015bci 21,65 mld z\u0142. Zobacz ca\u0142y artyku\u0142 Elixir malware 10.06.2024 Statystyki system\u00f3w rozliczeniowych KIR w maju 2024 r. W maju 2024 r. przetworzyli\u015bmy w systemie szkodliwe oprogramowanie Elixir 185,8 mln transakcji o warto\u015bci 744,83 mld z\u0142.", "modified": "2024-11-02T18:45:44.304000", "created": "2024-08-01T16:05:58.828000", "tags": [ "epodpis z", "express elixir", "dostp", "zobacz", "polityka", "czytaj wicej", "zobacz cay", "elixir", "kir w", "mobilny", "banki", "teraz" ], "references": [ "http://Kir.pl/", "https://kir.pl/", "https://www.kir.pl/", "http://www.kir.pl/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Elixir", "display_name": "Elixir", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 45, "URL": 415, "hostname": 187, "FileHash-MD5": 64, "FileHash-SHA1": 36, "FileHash-SHA256": 102, "IPv4": 53, "email": 4, "SSLCertFingerprint": 9, "CVE": 2, "CIDR": 1 }, "indicator_count": 918, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "532 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "664b74b2683dec84891aef96", "name": "PrivateLoader is a malware with a module structure that has the capability is to download and execute one or several payloads", "description": "http://185.172.128.69/batushka/inte.exe \nhttp://185.172.128.69/allnewumm.exe\nhttp://185.172.128.69/brandumma.exe\nhttp://185.172.128.69/files\nhttp://185.172.128.69/files/US.file\nhttp://185.172.128.69/latestumma.exe\nhttp://185.172.128.69/newumma.exe\nhttp://185.172.128.69/sekundumma.exe\nhttp://185.172.128.69/ummanew.exe", "modified": "2024-10-14T20:36:05.361000", "created": "2024-05-20T16:05:06.313000", "tags": [ "stdin via", "nextron", "powershell id", "powershell", "tim rauch", "elastic", "script block", "logging", "pe32", "ms windows", "intel", "nazwa typ", "md5 nazwa", "procesu" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 7268, "domain": 1310, "URL": 8101, "FileHash-SHA1": 1615, "hostname": 2590, "FileHash-MD5": 1852, "email": 267, "SSLCertFingerprint": 3, "CIDR": 38, "CVE": 7, "IPv4": 15, "YARA": 4 }, "indicator_count": 23070, "is_author": false, "is_subscribing": null, "subscriber_count": 135, "modified_text": "551 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "S?d Rejonowy w Jeleniej G\u00f3rze.htm", "http://www.jelenia-gora.so.gov.pl/", "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze", "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm", "http://adorno.eu", "http://www.kir.pl/", "https://www.jelenia-gora.sr.gov.pl/spacer", "http://aliorbank.pl", "https://www.jelenia-gora.so.gov.pl/", "https://waf.intelix.pl/957476/Chat/Script/Compatibility", "http://www.aliorbank.pl", "https://kir.pl/", "http://Kir.pl/", "https://www.kir.pl/", "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "", "Elixir", "Serwer" ], "industries": [], "unique_indicators": 106481 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/onedyn.pl", "whois": "http://whois.domaintools.com/onedyn.pl", "domain": "onedyn.pl", "hostname": "cp.onedyn.pl" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "6608aaf7ca0e965e593ed1d4", "name": "MUI programu Microsoft Office Access (w j\u0119zyku angielskim) zosta\u0142o u\u017cyte do wys\u0142ania z\u0142o\u015bliwego oprogramowania na serwer w Czechach jest to pierwszy tego typu atak na komputer. e", "description": "A look back at some of the key words and phrases used to describe the situation in Italy, as \"probacja\" (or \"democrata), as they were translated into English.", "modified": "2025-10-17T11:03:07.034000", "created": "2024-03-31T00:14:47.183000", "tags": [ "sha256", "ssdeep", "reputacja", "tworzy pliki", "informacje", "bardzo duga", "tworzy", "adresy url", "tworzy katalog", "win64", "ameryki", "typ pliku", "serwer nazw", "san jose", "adres", "digital", "data wyganicia", "csc corporate", "domains", "ca data", "data utworzenia", "dnssec" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6432, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2140, "hostname": 5874, "FileHash-SHA256": 12539, "FileHash-MD5": 3686, "FileHash-SHA1": 2751, "IPv4": 503, "URL": 10770, "email": 26, "CVE": 88, "YARA": 6, "JA3": 2, "IPv6": 28, "SSLCertFingerprint": 5, "BitcoinAddress": 3, "CIDR": 1 }, "indicator_count": 38422, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "184 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66246ff49ed29ea9bb2bf122", "name": "S\u0105d Rejonowy w Jeleniej Gorze POLAND", "description": "Przechowywania lub dost\u0119pu do plik\u00f3w cookies w Twojej przegl\u0105darce\nhttps://www.virustotal.com/gui/domain/jelenia-gora.sr.gov.pl/relations", "modified": "2025-05-14T21:18:36.989000", "created": "2024-04-21T01:46:28.554000", "tags": [ "jeleniej grze", "aktualnoci", "informacje", "jednostka", "rejonowy", "konkurs", "najczciej", "sd rejonowy", "przejd", "czytaj", "click", "sdzia jarosaw", "wydziau", "sdzia grzegorz", "katarzyna", "rudnicka dane", "kontaktowe sd", "jelenia gra", "mickiewicza", "zawarto", "html", "nazwa meta", "robotw", "telefon", "brak", "skala", "ua zgodna", "head body", "zasb", "cname", "kod odpowiedzi", "kodowanie treci", "wygasa", "gmt serwer", "pragma", "kontrola pamici", "podrcznej", "data", "gmt kontrola", "dostpuzezwl na", "czytaj wicej", "sd okrgowy", "jednostki", "okrgowy", "ogoszenia", "sha256", "vhash", "ssdeep", "https odcisk", "palca jarma", "https dane", "v3 numer", "odcisk palca", "tworzy katalog", "tworzy pliki", "typ pliku", "json", "ascii", "windows", "sqlite", "foxpro fpt", "links typ", "mapa", "152 x", "sqlite w", "sha1", "sha512", "file size", "b file", "testing", "komornik sdowy", "sdzie rejonowym", "tomasz rodacki", "obwieszczenie", "komornicze", "tumacza migam", "tumacz czynny", "zamknite", "wiadczenia", "schedule", "error", "javascript", "bakers hall", "ixaction", "script", "ixchatlauncher", "compatibility", "com dla", "t1055 pewno", "unikanie obrony", "t1036 maskarada", "t1082 pewno", "informacje o", "nazwa pliku", "dokument pdf", "rozmiar pliku", "zapowied", "type", "iii dbt", "utf8", "dziennik" ], "references": [ "S?d Rejonowy w Jeleniej G\u00f3rze.htm", "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm", "http://www.jelenia-gora.so.gov.pl/", "https://www.jelenia-gora.so.gov.pl/", "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze", "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora", "https://www.jelenia-gora.sr.gov.pl/spacer", "https://waf.intelix.pl/957476/Chat/Script/Compatibility" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "", "display_name": "", "target": null }, { "id": "serwer", "display_name": "serwer", "target": null } ], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "email": 71, "domain": 7651, "hostname": 7680, "IPv4": 331, "FileHash-SHA256": 16168, "URL": 10399, "FileHash-MD5": 3639, "FileHash-SHA1": 3468, "CIDR": 4, "CVE": 89, "YARA": 521, "SSLCertFingerprint": 25, "JA3": 1, "IPv6": 5813 }, "indicator_count": 55860, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "339 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66dc8df6138140378bc0bbc4", "name": "Wy\u017csza kultura. Bank nowo\u015bci - kredyt, po\u017cyczka, konto, lokata - Alior Bank", "description": "Mfa.aliorbank.com is the world's largest bank, with a combined turnover of more than $2bn (\u00c2\u00a31.3bn) in its current financial year.", "modified": "2024-12-17T14:35:32.104000", "created": "2024-09-07T17:31:34.610000", "tags": [ "vhash htm", "ssdeep", "script tags", "trackers google", "tag manager", "anchor hrefs", "bank", "konto osobiste", "kredyty", "po\u017cyczki", "rachunek", "firmy", "klienci indywidualni", "finanse", "lokaty", "oszcz\u0119dno\u015bci", "po\u017cyczka got\u00f3wkowa", "kredyt mieszkaniowy", "karta kredytowa", "inwestycje", "oferta dla os\u00f3b prowadz\u0105cych w\u0142asn\u0105 dzia\u0142alno\u015b\u0107 gospodarcz\u0105", "oferta dla przedsi\u0119biorstw", "kredyty dla ma\u0142ych i \u015brednich firm", "rachunek brokerski", "bankowo\u015b\u0107 elektroniczna", "bankowo\u015b\u0107 mobilna", "ubezpieczenia", "alior", "alior bank", "wy\u017csza kultura. bank nowo\u015bci", "sprawd", "alior mobile", "alior banku", "konto w", "konto jake", "alior online", "informacje", "bezpieczestwo", "jest", "ciebie" ], "references": [ "http://aliorbank.pl", "http://www.aliorbank.pl" ], "public": 1, "adversary": "", "targeted_countries": [ "Poland" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 63, "FileHash-SHA256": 200, "domain": 24, "hostname": 219, "URL": 100, "FileHash-MD5": 12, "FileHash-SHA1": 9, "CVE": 1 }, "indicator_count": 628, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "488 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d65ec934e804ff93de6737", "name": "adorno.eu is for sale!", "description": "GoDaddy.eu is the world's most popular domain provider for people who want to sign up for a domain\u00a0transfering service. \u00c2\u00a31.5m (1m euros)", "modified": "2024-12-17T14:35:30.480000", "created": "2024-09-03T00:56:41.819000", "tags": [ "key id", "sha256", "ssdeep", "godaddy brand", "sedo", "eur excl", "vat buy", "dan buy", "evolution media" ], "references": [ "http://adorno.eu" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 540, "domain": 207, "FileHash-SHA256": 637, "hostname": 425, "FileHash-MD5": 178, "FileHash-SHA1": 106, "IPv4": 12, "email": 1, "CVE": 1 }, "indicator_count": 2107, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "488 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66abb26614baf2276d4892cf", "name": "kir.pl KIR: Hub technologiczny. Dostawca cyfrowych rozwiaza\u0144 dla firm, bank\u00f3w oraz klient\u00f3w indywidualnych.Kluczowy podmiot infrastruktury polskiego systemu p\u0142atniczego.", "description": "934f391c263fe1fb3bca071898f45579c905280f 2022-09-14 *.kir.pl 00e172c1ce91876722ae2faa48df5b17a32c3be9 2021-10-01 *.kir.pl 9bebeaa50825eb88fc9e8899955d821620ac6fe6 2020-10-07 *.kir.pl 4b885389c599abdaa45e11481924600738a5ea37 2020-03-18 *.kir.pl 3b969974bc6f07b8a45dd0ee89f9ee64b862571b 2019-08-14 *.kir.pl 6a69a861061c5e768070c68576127237a43de9c2\nZobacz ca\u0142y artyku\u0142 Elixir malware 08.07.2024 Statystyki system\u00f3w rozliczeniowych KIR w czerwcu 2024 r. W czerwcu przetworzyli\u015bmy w systemie szkodliwe oprogramowanie Elixir 177,85 mln transakcji o warto\u015bci 722,96 mld z\u0142. Zamiast tego w Express Elixir rozliczyli\u015bmy 44,95 mln przelew\u00f3w natychmiastowych o warto\u015bci 21,65 mld z\u0142. Zobacz ca\u0142y artyku\u0142 Elixir malware 10.06.2024 Statystyki system\u00f3w rozliczeniowych KIR w maju 2024 r. W maju 2024 r. przetworzyli\u015bmy w systemie szkodliwe oprogramowanie Elixir 185,8 mln transakcji o warto\u015bci 744,83 mld z\u0142.", "modified": "2024-11-02T18:45:44.304000", "created": "2024-08-01T16:05:58.828000", "tags": [ "epodpis z", "express elixir", "dostp", "zobacz", "polityka", "czytaj wicej", "zobacz cay", "elixir", "kir w", "mobilny", "banki", "teraz" ], "references": [ "http://Kir.pl/", "https://kir.pl/", "https://www.kir.pl/", "http://www.kir.pl/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Elixir", "display_name": "Elixir", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 45, "URL": 415, "hostname": 187, "FileHash-MD5": 64, "FileHash-SHA1": 36, "FileHash-SHA256": 102, "IPv4": 53, "email": 4, "SSLCertFingerprint": 9, "CVE": 2, "CIDR": 1 }, "indicator_count": 918, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "532 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "664b74b2683dec84891aef96", "name": "PrivateLoader is a malware with a module structure that has the capability is to download and execute one or several payloads", "description": "http://185.172.128.69/batushka/inte.exe \nhttp://185.172.128.69/allnewumm.exe\nhttp://185.172.128.69/brandumma.exe\nhttp://185.172.128.69/files\nhttp://185.172.128.69/files/US.file\nhttp://185.172.128.69/latestumma.exe\nhttp://185.172.128.69/newumma.exe\nhttp://185.172.128.69/sekundumma.exe\nhttp://185.172.128.69/ummanew.exe", "modified": "2024-10-14T20:36:05.361000", "created": "2024-05-20T16:05:06.313000", "tags": [ "stdin via", "nextron", "powershell id", "powershell", "tim rauch", "elastic", "script block", "logging", "pe32", "ms windows", "intel", "nazwa typ", "md5 nazwa", "procesu" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 7268, "domain": 1310, "URL": 8101, "FileHash-SHA1": 1615, "hostname": 2590, "FileHash-MD5": 1852, "email": 267, "SSLCertFingerprint": 3, "CIDR": 38, "CVE": 7, "IPv4": 15, "YARA": 4 }, "indicator_count": 23070, "is_author": false, "is_subscribing": null, "subscriber_count": 135, "modified_text": "551 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://cp.onedyn.pl/link.php", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://cp.onedyn.pl/link.php", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776611677.219114 }