{ "type": "URL", "indicator": "https://dataproc-test.cloud.google/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://dataproc-test.cloud.google/", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4120821187, "indicator": "https://dataproc-test.cloud.google/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "68e32dd0c55bf224eb99dd58", "name": "Appspot.com - Google account fraud & infostealing", "description": "Fake Google email accounts. I\u2019ve reviewed a handful of targets with this issue. If starting with a new device, signed up for a new google account,\nthe users are automatically logged out, forced to sign in again, checked security features where you can see an unauthorized autonomous general\nphone, or iPhone or MacBook was also signed in in a different location. Even if you delete the device or email account, I\u2019ve seen the intruder handle CnC of all backups of photos and clouds. \n\n\n\n[OTX auto populated - The full list of domain names: APPSPot.COM.com, which was created on the same day as the Google search engine, has been published by the internet regulator, the IANA.]", "modified": "2025-11-05T01:01:26.928000", "created": "2025-10-06T02:47:44.098000", "tags": [ "aaaa", "susp", "trojan", "google", "server", "domain status", "registrar abuse", "domain name", "us registrant", "email", "contact email", "rdap database", "google app", "google hosted", "please", "vulnerabilities", "join", "bring", "api explorer", "engine", "admin sdk", "info", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "command", "defense evasion", "ssl certificate", "ascii text", "united", "pattern match", "mitre att", "general", "local", "path", "click", "strings", "porn", "phishing", "fraud", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "download", "apt", "ansi", "dumps", "file string", "seen", "disabled hash", "close", "hosts", "contact", "tellwise", "passive dns", "urls", "pulse pulses", "files", "verdict", "domain", "files ip", "address", "location united", "asn as15169", "extraction", "data upload", "extra", "referen http", "changed data", "failed", "include review", "t07 exclude", "extri data", "changed", "exclude", "find s", "tvnes data", "status", "present nov", "name servers", "entries", "geoid no", "present dec", "date", "error", "title", "sugges", "typ no", "no entrieotound", "scam", "foundry", "sabey type", "denver", "quasi", "phoenix", "australia" ], "references": [ "appspot.com \u2022 hyper7install.appspot.com", "https://hybrid-analysis.com/sample/c61237fcb798f05e6af32a6aa13f8e795aac47559d601eb7f93ad65bcf58b418/68e30c476b91a8000b0dd786", "http://acounts.google.com/v/signin/identifier?continue=hts%253%252F2Fconsole.cloud.google.com2Fapengine&dsh=5-1106814258%2539876543210", "Changed last several digits of gmail account # In example", "http://console.cloud.google.com/appengine", "https://310940000.android.com.twitter.android.adsenseformobileapps.com/", "https://www.netify.ai/resources/domains \u2022 192-168-0-21.3pt3m9ng2hf.ddns.manage.alta.inc", "device-local-de06e551-6b23-4aa3-bb67-6972ae6d30b5.remotewd.com 192.168.0.21", "116e33e0-8832-11ec-aef5-99a1d044639a-local.solinkcloud.com", "jaycobundaberg.eclipseaurahub.com.au 192.168.0.21", "grafana.ledocloud.com\u2022 192.168.0.21", "192-168-0-21.siliconevalley1.direct.quickconnect.to" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win32/Madang", "display_name": "Win32/Madang", "target": null }, { "id": "Win.Downloader.Small-1966", "display_name": "Win.Downloader.Small-1966", "target": null }, { "id": "Win32:SaliCode", "display_name": "Win32:SaliCode", "target": null }, { "id": "Virtool:Win32/Vbinder.CO", "display_name": "Virtool:Win32/Vbinder.CO", "target": "/malware/Virtool:Win32/Vbinder.CO" }, { "id": "!Themida", "display_name": "!Themida", "target": null }, { "id": "Virus:Win32/Sality.AT", "display_name": "Virus:Win32/Sality.AT", "target": "/malware/Virus:Win32/Sality.AT" }, { "id": "Win32/Scrarev.C", "display_name": "Win32/Scrarev.C", "target": null }, { "id": "Trojan:MSIL/RapidStealer.A", "display_name": "Trojan:MSIL/RapidStealer.A", "target": "/malware/Trojan:MSIL/RapidStealer.A" } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1598", "name": "Phishing for Information", "display_name": "T1598 - Phishing for Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 222, "FileHash-MD5": 146, "FileHash-SHA1": 317, "FileHash-SHA256": 1120, "email": 3, "hostname": 881, "URL": 1338, "SSLCertFingerprint": 7 }, "indicator_count": 4034, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "166 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68eff833ed84ceaf611521d2", "name": "Tucker Carlson | AutInject \u2022 Zbot \u2022 CoinMiner \u2022 Zombie \u2022 Qbot affects his YouTube Channel (9.14.2025) ", "description": "", "modified": "2025-10-15T19:38:27.739000", "created": "2025-10-15T19:38:27.739000", "tags": [ "resolved ips", "parent pid", "full path", "command line", "cname", "ip address", "port", "involved direct", "country name", "nxdomain", "tcp connections", "udp connections", "data", "datacrashpad", "edge", "passive dns", "origin trial", "gmt cache", "sameorigin", "443 ma2592000", "ipv4 add", "files", "title", "date", "found", "gmt content", "hostname", "verdict", "error", "code", "present aug", "present sep", "aaaa", "search", "domain", "present apr", "present jun", "address google", "safe browsing", "present oct", "match info", "mitre att", "control ta0011", "protocol t1071", "protocol t1095", "match medium", "icmp traffic", "port t1571", "info", "c0002 wininet", "flag", "markmonitor", "domain address", "contacted hosts", "process details", "size", "iend ihdridatx", "qrmf", "qkdi", "qiyay", "kjtn8", "r0x3", "ihdridatx", "yg6qp", "kkrz", "t6 ex", "click", "windir", "openurl c", "prefetch2", "data upload", "extraction", "failed", "please", "your browser", "learn", "opera mozilla", "firefox google", "chrome remind", "privacy policy", "safety", "google llc", "youtube", "mozilla firefox", "safari google", "edge opera", "browse youtube", "file", "indicator", "pattern match", "ascii text", "ck id", "ck matrix", "href", "general", "local", "path", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "t1590 gather", "victim network", "files domain", "files related", "related tags", "registrar", "files ip", "asn as15169", "address domain", "ip whois", "service address", "po box", "city hayes", "country gb", "dnssec", "domain name", "emails", "script urls", "a domains", "texas flyover", "script domains", "script script", "trojan", "meta", "window", "msie", "chrome", "twitter", "unknown aaaa", "record value", "content type", "united states", "dynamicloader", "medium", "write c", "high", "show", "digicert", "olet", "encrypt", "win64", "responder", "write", "next", "unknown", "install", "dummy", "entries", "displayname", "windows", "united", "tofsee", "copy", "stream", "malware", "hostile", "body", "hostile client", "apollo", "jaik", "code overlap", "sri lanka", "pintuck sri", "lanka", "unknown ns", "moved", "buy apparal", "win32", "trojandropper", "virtool", "susp", "ipv4", "pulse pulses", "urls", "reverse dns", "location united", "installer" ], "references": [ "https://www.youtube.com/watch?v=5KmpT-BoVf4", "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D5KmpT-BoVf4", "critical-failure-alert8768.70jf59844149.com-1kafl-hs0pt4m8f.trade", "http://www.whatbrowser.com/intl/en/ \u2022 ghb.console.adtarget.com.tr.88.1.8b13f8ac.roksit.net", "canary5.nycl.do.ubersmith.com \u2022 debian-test.nyc3.do.ubersmith.com", "docs-old.ubersmith.com \u2022 edgevana.trial.ubersmith.com", "ghb.unoadsrv.com.88.1.8b13f8ac.roksit.net", "malware.sale \u2022 http://virii.es/U/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf", "IDS: Win32/Tofsee.AX google.com connectivity check Query to a *.top domain -", "Likely Hostile Http Client Body contains pwd= in cleartext Cleartext WordPress Login", "Yara Detections: RansomWin32Apollo \u2022 216.239.32.27" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Jaik-9968280-0", "display_name": "Win.Malware.Jaik-9968280-0", "target": null }, { "id": "Malware + Code Overlap", "display_name": "Malware + Code Overlap", "target": null }, { "id": "Trojan:Win32/Qbot.R!MTB", "display_name": "Trojan:Win32/Qbot.R!MTB", "target": "/malware/Trojan:Win32/Qbot.R!MTB" }, { "id": "Trojandownloader:Win32/Upatre", "display_name": "Trojandownloader:Win32/Upatre", "target": "/malware/Trojandownloader:Win32/Upatre" }, { "id": "Trojan:BAT/Musecador", "display_name": "Trojan:BAT/Musecador", "target": "/malware/Trojan:BAT/Musecador" }, { "id": "Win32:Trojan", "display_name": "Win32:Trojan", "target": null }, { "id": "Bancos", "display_name": "Bancos", "target": null }, { "id": "Hematite", "display_name": "Hematite", "target": null }, { "id": "Trojanspy:Win32/Banker.LY", "display_name": "Trojanspy:Win32/Banker.LY", "target": "/malware/Trojanspy:Win32/Banker.LY" }, { "id": "Trojan:Win32/Vflooder!rfn", "display_name": "Trojan:Win32/Vflooder!rfn", "target": "/malware/Trojan:Win32/Vflooder!rfn" }, { "id": "Win32:MalwareX", "display_name": "Win32:MalwareX", "target": null }, { "id": "Malwarex", "display_name": "Malwarex", "target": null }, { "id": "Virtool:Win32/CeeInject.AKZ!bit", "display_name": "Virtool:Win32/CeeInject.AKZ!bit", "target": "/malware/Virtool:Win32/CeeInject.AKZ!bit" }, { "id": "Win32:Dropper", "display_name": "Win32:Dropper", "target": null }, { "id": "Ymacco", "display_name": "Ymacco", "target": null }, { "id": "Upatre", "display_name": "Upatre", "target": null }, { "id": "Trojandownloader:Win32/Upatre.A", "display_name": "Trojandownloader:Win32/Upatre.A", "target": "/malware/Trojandownloader:Win32/Upatre.A" }, { "id": "Win32:Evo", "display_name": "Win32:Evo", "target": null }, { "id": "Trojandropper:Win32/BcryptInject.B!MSR", "display_name": "Trojandropper:Win32/BcryptInject.B!MSR", "target": "/malware/Trojandropper:Win32/BcryptInject.B!MSR" }, { "id": "Win32:TrojanX-gen\\ [Trj]", "display_name": "Win32:TrojanX-gen\\ [Trj]", "target": null }, { "id": "Win32:Cleaman-K\\ [Trj]", "display_name": "Win32:Cleaman-K\\ [Trj]", "target": null }, { "id": "Asacky", "display_name": "Asacky", "target": null }, { "id": "Backdoor:Win32/Plugx.N!dha", "display_name": "Backdoor:Win32/Plugx.N!dha", "target": "/malware/Backdoor:Win32/Plugx.N!dha" } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [ "Media" ], "TLP": "white", "cloned_from": "68c73fbd85dfbb4d41006ad1", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4746, "hostname": 1829, "domain": 913, "FileHash-MD5": 249, "FileHash-SHA1": 213, "FileHash-SHA256": 1765, "email": 3, "SSLCertFingerprint": 17 }, "indicator_count": 9735, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "186 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68c73fbd85dfbb4d41006ad1", "name": "Tucker Carlson Sam Altman YouTube Interview \u2022 Qbot | Malware with. Code Overlap", "description": "Maybe it\u2019s a network issue. The TV I viewed interview from is in Arabic the every time. It\u2019s not\nmy\ntelevision or network, didn\u2019t get link from a logged in YouTube. Not a subscriber.. I viewed using (cc) close captioning. It\u2019s the only program n YouTube using another language for this interview. The only reason I\u2019ve visited this interview several time\u2019s since it\u2019s aired is to check for the same results. Every time only this interview uses another language for (cc).\n\nThere are related pulses by a few different users, experiencing similar personal issues. I\u2019d assume I\u2019d always get these results. Unclear\n\n* At the end of interview Tucker Carlson states YouTube is trying to suppress or delete this one interview.", "modified": "2025-10-14T22:26:18.109000", "created": "2025-09-14T22:20:45.617000", "tags": [ "resolved ips", "parent pid", "full path", "command line", "cname", "ip address", "port", "involved direct", "country name", "nxdomain", "tcp connections", "udp connections", "data", "datacrashpad", "edge", "passive dns", "origin trial", "gmt cache", "sameorigin", "443 ma2592000", "ipv4 add", "files", "title", "date", "found", "gmt content", "hostname", "verdict", "error", "code", "present aug", "present sep", "aaaa", "search", "domain", "present apr", "present jun", "address google", "safe browsing", "present oct", "match info", "mitre att", "control ta0011", "protocol t1071", "protocol t1095", "match medium", "icmp traffic", "port t1571", "info", "c0002 wininet", "flag", "markmonitor", "domain address", "contacted hosts", "process details", "size", "iend ihdridatx", "qrmf", "qkdi", "qiyay", "kjtn8", "r0x3", "ihdridatx", "yg6qp", "kkrz", "t6 ex", "click", "windir", "openurl c", "prefetch2", "data upload", "extraction", "failed", "please", "your browser", "learn", "opera mozilla", "firefox google", "chrome remind", "privacy policy", "safety", "google llc", "youtube", "mozilla firefox", "safari google", "edge opera", "browse youtube", "file", "indicator", "pattern match", "ascii text", "ck id", "ck matrix", "href", "general", "local", "path", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "t1590 gather", "victim network", "files domain", "files related", "related tags", "registrar", "files ip", "asn as15169", "address domain", "ip whois", "service address", "po box", "city hayes", "country gb", "dnssec", "domain name", "emails", "script urls", "a domains", "texas flyover", "script domains", "script script", "trojan", "meta", "window", "msie", "chrome", "twitter", "unknown aaaa", "record value", "content type", "united states", "dynamicloader", "medium", "write c", "high", "show", "digicert", "olet", "encrypt", "win64", "responder", "write", "next", "unknown", "install", "dummy", "entries", "displayname", "windows", "united", "tofsee", "copy", "stream", "malware", "hostile", "body", "hostile client", "apollo", "jaik", "code overlap", "sri lanka", "pintuck sri", "lanka", "unknown ns", "moved", "buy apparal", "win32", "trojandropper", "virtool", "susp", "ipv4", "pulse pulses", "urls", "reverse dns", "location united", "installer" ], "references": [ "https://www.youtube.com/watch?v=5KmpT-BoVf4", "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D5KmpT-BoVf4", "critical-failure-alert8768.70jf59844149.com-1kafl-hs0pt4m8f.trade", "http://www.whatbrowser.com/intl/en/ \u2022 ghb.console.adtarget.com.tr.88.1.8b13f8ac.roksit.net", "canary5.nycl.do.ubersmith.com \u2022 debian-test.nyc3.do.ubersmith.com", "docs-old.ubersmith.com \u2022 edgevana.trial.ubersmith.com", "ghb.unoadsrv.com.88.1.8b13f8ac.roksit.net", "malware.sale \u2022 http://virii.es/U/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf", "IDS: Win32/Tofsee.AX google.com connectivity check Query to a *.top domain -", "Likely Hostile Http Client Body contains pwd= in cleartext Cleartext WordPress Login", "Yara Detections: RansomWin32Apollo \u2022 216.239.32.27" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Jaik-9968280-0", "display_name": "Win.Malware.Jaik-9968280-0", "target": null }, { "id": "Malware + Code Overlap", "display_name": "Malware + Code Overlap", "target": null }, { "id": "Trojan:Win32/Qbot.R!MTB", "display_name": "Trojan:Win32/Qbot.R!MTB", "target": "/malware/Trojan:Win32/Qbot.R!MTB" }, { "id": "Trojandownloader:Win32/Upatre", "display_name": "Trojandownloader:Win32/Upatre", "target": "/malware/Trojandownloader:Win32/Upatre" }, { "id": "Trojan:BAT/Musecador", "display_name": "Trojan:BAT/Musecador", "target": "/malware/Trojan:BAT/Musecador" }, { "id": "Win32:Trojan", "display_name": "Win32:Trojan", "target": null }, { "id": "Bancos", "display_name": "Bancos", "target": null }, { "id": "Hematite", "display_name": "Hematite", "target": null }, { "id": "Trojanspy:Win32/Banker.LY", "display_name": "Trojanspy:Win32/Banker.LY", "target": "/malware/Trojanspy:Win32/Banker.LY" }, { "id": "Trojan:Win32/Vflooder!rfn", "display_name": "Trojan:Win32/Vflooder!rfn", "target": "/malware/Trojan:Win32/Vflooder!rfn" }, { "id": "Win32:MalwareX", "display_name": "Win32:MalwareX", "target": null }, { "id": "Malwarex", "display_name": "Malwarex", "target": null }, { "id": "Virtool:Win32/CeeInject.AKZ!bit", "display_name": "Virtool:Win32/CeeInject.AKZ!bit", "target": "/malware/Virtool:Win32/CeeInject.AKZ!bit" }, { "id": "Win32:Dropper", "display_name": "Win32:Dropper", "target": null }, { "id": "Ymacco", "display_name": "Ymacco", "target": null }, { "id": "Upatre", "display_name": "Upatre", "target": null }, { "id": "Trojandownloader:Win32/Upatre.A", "display_name": "Trojandownloader:Win32/Upatre.A", "target": "/malware/Trojandownloader:Win32/Upatre.A" }, { "id": "Win32:Evo", "display_name": "Win32:Evo", "target": null }, { "id": "Trojandropper:Win32/BcryptInject.B!MSR", "display_name": "Trojandropper:Win32/BcryptInject.B!MSR", "target": "/malware/Trojandropper:Win32/BcryptInject.B!MSR" }, { "id": "Win32:TrojanX-gen\\ [Trj]", "display_name": "Win32:TrojanX-gen\\ [Trj]", "target": null }, { "id": "Win32:Cleaman-K\\ [Trj]", "display_name": "Win32:Cleaman-K\\ [Trj]", "target": null }, { "id": "Asacky", "display_name": "Asacky", "target": null }, { "id": "Backdoor:Win32/Plugx.N!dha", "display_name": "Backdoor:Win32/Plugx.N!dha", "target": "/malware/Backdoor:Win32/Plugx.N!dha" } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [ "Media" ], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4746, "hostname": 1829, "domain": 913, "FileHash-MD5": 249, "FileHash-SHA1": 213, "FileHash-SHA256": 1765, "email": 3, "SSLCertFingerprint": 17 }, "indicator_count": 9735, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "187 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68a0cb6a89a10d13623a0018", "name": "Medicaid Mirai Botnet | United Healthcare Mirai Botnet", "description": "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll. Medicaid Botnet work managed by Lumen Technologies as part of a massive silencing campaign. |\n\nPhone calls routed since forces and investigated disclosures of several attack resulting in great bodily harm and life threatening, ending injuries.\nThis campaign date has one start date 11/13/2013.\n#missed assaults internal investigated 10/08/2013 -11/31/ 2013.\nI\u2019m sure other targets are impacted . This stems from targets personal , documented experiences. \nFormerly k/a Century Link was confronted by associate of targets when a plain clothed male entered targets yard in 11/ 2013, told their box controlled entire neighborhood. Continuously accessed properties. \n\n\n\n#rip #lumen #botnet #fencing #malware #silencing #civil_liberties # monitored_target #remote #corruption #privacy_abuse #centurylink", "modified": "2025-09-15T16:04:47.043000", "created": "2025-08-16T18:18:18.657000", "tags": [ "url https", "search", "type indicator", "role title", "added active", "related pulses", "entries", "httponly", "samesitelax", "read c", "medium", "rgba", "unicode", "port", "memcommit", "delete", "next", "dock", "write", "execution", "present aug", "united", "ip address", "name servers", "unknown ns", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "spawns", "mitre att", "ck techniques", "evasion att", "pattern match", "show technique", "ck matrix", "refresh", "body", "span", "august", "hybrid", "general", "local", "path", "click", "strings", "error", "tools", "look", "verify", "restart", "href", "size", "t1480 execution", "file defense", "ascii text", "trojan", "passive dns", "trojandropper", "next associated", "fastly error", "please", "sea p", "mozilla", "accept", "ipv4 add", "urls", "files", "location united", "ipv4", "url analysis", "america flag", "america asn", "backdoor", "win32", "malware", "date", "domain", "segoe ui", "a domains", "security tls", "san jose", "asn8075", "reverse dns", "software", "resource hash", "general full", "status", "emails", "expiration date", "asp", "microsoft oem", "found", "running webserver", "netherlands", "creation date", "aaaa", "certificate", "protocol h2", "name value", "hash", "present jun", "present apr", "moved", "control att", "t1573 encrypted", "channel command", "decrypted ssl", "runtime process", "appdata", "windows nt", "svg scalable", "patch", "internal", "core", "high", "tcp syn", "icmp traffic", "dns query", "av detections", "ashburn", "ai device id", "telnet", "windows script", "microsoft", "host", "yara detections", "pdb path", "pe resource", "script host", "test", "hostname add", "files ip", "domains", "hashes", "ireland", "mtb jun", "mtb may", "device local", "remotewd", "nemtih", "url add", "http", "hostname", "files domain", "files related", "pulses otx", "present jul", "domain add", "colorado", "quasi", "contracts", "botnet", "remote access", "virginia", "c++", "hacking", "monitored target", "silencing campaign", "audio recording", "cameras", "full service", "tactics" ], "references": [ "Handled by Lumen Technologies | What kind of darkness is this?", "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll https://myhpnmedicaid.com/Provider", "dev.myhpnmedicaid.com", "ELF:Mirai-ATI | United Healthcare Dark? | https://otx.alienvault.com/indicator/ip/205.132.162.113", "https://hybrid-analysis.com/sample/e439d3dd3d943ecc702d12998a32e15c00008a8f276e6c89cb54f6de43f36de8/689fccb81c4f237eb6009b0f", "https://hybrid-analysis.com/sample/f095ee58f390749315e72cfa46d979cb25a15884b66c7951719c844ebc82b3a3/689fcc753aca4827cd036851", "https://hybrid-analysis.com/sample/dd09e575e6dfa77f081bf0014b2494e02f90cb23723fbb35d6b2a92e7c629920/689fcc40b786f8eaa20534b5", "Primary Request aspnet dotnet.microsoft.com/en-us/apps/ Redirect Chain http://asp.net/ https://asp.net/ https://www.asp.net/ https://dotnet.microsoft.com/en-us/apps/aspnet", "Redirect Chain http://asp.net/ https://asp.net/ https://www.asp.net/", "https://dotnet.microsoft.com/en-us/apps/aspnet", "ASP.net - Hack Together: Mar 1-15 Join the hack. Build an app with NET & Microsoft Graph for a\u2026 .", "ASP.net - chance to win prizes! \u53e3\u3001\u4ecb\u5973\u8fa3 All Microsoft Learn more ASP.NET Free. Cross-platform\u2026.", "ASP.net Open source. A framework for building web apps and services with .NET and C#", "Registrant Org: Japan Computer Emergency Response Team Coordination Center", "Interesting: unitedhealthcare cdn.member.unitedhealthcare.com \u2022 data.aca.unitedhealthcare.com \u2022 data.member.unitedhealthcare.com", "Interesting Domain Tactics: https://click.benefits.unitedhealthcare.com/", "Interesting: dev-optum-dataintelligence.com \u2022 optumcoding.xxx \u2022 optuminsightcoding.xxx \u2022 optumrx.xxx", "Interesting: memberforms.optumrx.com \u2022 myoptum.info \u2022 optumrx.com \u2022 cte-scl.new.optumrx.com \u2022 dev-scl.optumrx.com", "http://www.nexcentra.com/fox-news-faces-another-sexual-harassment-lawsuit" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Trojan:Win32/Zombie.A", "display_name": "Trojan:Win32/Zombie.A", "target": "/malware/Trojan:Win32/Zombie.A" }, { "id": "Win.Packed.Generic-9967832-0", "display_name": "Win.Packed.Generic-9967832-0", "target": null }, { "id": "Custom Malware", "display_name": "Custom Malware", "target": null }, { "id": "Trojan:Win32/Daws", "display_name": "Trojan:Win32/Daws", "target": "/malware/Trojan:Win32/Daws" }, { "id": "ELF:Mirai-ATI", "display_name": "ELF:Mirai-ATI", "target": null }, { "id": "Trojan:Win32/IRCbot", "display_name": "Trojan:Win32/IRCbot", "target": "/malware/Trojan:Win32/IRCbot" }, { "id": "alf:JASYP:Trojan:Win32/IRCbot!atmn", "display_name": "alf:JASYP:Trojan:Win32/IRCbot!atmn", "target": null }, { "id": "Trojandropper:Win32/Muldrop.V!MTB", "display_name": "Trojandropper:Win32/Muldrop.V!MTB", "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1092", "name": "Communication Through Removable Media", "display_name": "T1092 - Communication Through Removable Media" }, { "id": "T1433", "name": "Access Call Log", "display_name": "T1433 - Access Call Log" } ], "industries": [ "Technology", "Telecommunications", "Contracts", "Government", "Finance", "Insurance", "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 37, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4880, "domain": 575, "hostname": 1419, "FileHash-SHA256": 1745, "FileHash-MD5": 284, "FileHash-SHA1": 263, "email": 5, "CVE": 1 }, "indicator_count": 9172, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "216 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "Redirect Chain http://asp.net/ https://asp.net/ https://www.asp.net/", "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll https://myhpnmedicaid.com/Provider", "ASP.net Open source. A framework for building web apps and services with .NET and C#", "https://hybrid-analysis.com/sample/e439d3dd3d943ecc702d12998a32e15c00008a8f276e6c89cb54f6de43f36de8/689fccb81c4f237eb6009b0f", "dev.myhpnmedicaid.com", "Interesting Domain Tactics: https://click.benefits.unitedhealthcare.com/", "116e33e0-8832-11ec-aef5-99a1d044639a-local.solinkcloud.com", "Interesting: unitedhealthcare cdn.member.unitedhealthcare.com \u2022 data.aca.unitedhealthcare.com \u2022 data.member.unitedhealthcare.com", "https://www.netify.ai/resources/domains \u2022 192-168-0-21.3pt3m9ng2hf.ddns.manage.alta.inc", "Interesting: dev-optum-dataintelligence.com \u2022 optumcoding.xxx \u2022 optuminsightcoding.xxx \u2022 optumrx.xxx", "ghb.unoadsrv.com.88.1.8b13f8ac.roksit.net", "critical-failure-alert8768.70jf59844149.com-1kafl-hs0pt4m8f.trade", "http://www.nexcentra.com/fox-news-faces-another-sexual-harassment-lawsuit", "jaycobundaberg.eclipseaurahub.com.au 192.168.0.21", "canary5.nycl.do.ubersmith.com \u2022 debian-test.nyc3.do.ubersmith.com", "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D5KmpT-BoVf4", "IDS: Win32/Tofsee.AX google.com connectivity check Query to a *.top domain -", "http://www.whatbrowser.com/intl/en/ \u2022 ghb.console.adtarget.com.tr.88.1.8b13f8ac.roksit.net", "https://www.youtube.com/watch?v=5KmpT-BoVf4", "grafana.ledocloud.com\u2022 192.168.0.21", "ELF:Mirai-ATI | United Healthcare Dark? | https://otx.alienvault.com/indicator/ip/205.132.162.113", "Changed last several digits of gmail account # In example", "Likely Hostile Http Client Body contains pwd= in cleartext Cleartext WordPress Login", "https://310940000.android.com.twitter.android.adsenseformobileapps.com/", "malware.sale \u2022 http://virii.es/U/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf", "https://hybrid-analysis.com/sample/f095ee58f390749315e72cfa46d979cb25a15884b66c7951719c844ebc82b3a3/689fcc753aca4827cd036851", "ASP.net - chance to win prizes! \u53e3\u3001\u4ecb\u5973\u8fa3 All Microsoft Learn more ASP.NET Free. Cross-platform\u2026.", "device-local-de06e551-6b23-4aa3-bb67-6972ae6d30b5.remotewd.com 192.168.0.21", "https://hybrid-analysis.com/sample/c61237fcb798f05e6af32a6aa13f8e795aac47559d601eb7f93ad65bcf58b418/68e30c476b91a8000b0dd786", "Yara Detections: RansomWin32Apollo \u2022 216.239.32.27", "https://hybrid-analysis.com/sample/dd09e575e6dfa77f081bf0014b2494e02f90cb23723fbb35d6b2a92e7c629920/689fcc40b786f8eaa20534b5", "docs-old.ubersmith.com \u2022 edgevana.trial.ubersmith.com", "Primary Request aspnet dotnet.microsoft.com/en-us/apps/ Redirect Chain http://asp.net/ https://asp.net/ https://www.asp.net/ https://dotnet.microsoft.com/en-us/apps/aspnet", "Registrant Org: Japan Computer Emergency Response Team Coordination Center", "http://acounts.google.com/v/signin/identifier?continue=hts%253%252F2Fconsole.cloud.google.com2Fapengine&dsh=5-1106814258%2539876543210", "192-168-0-21.siliconevalley1.direct.quickconnect.to", "ASP.net - Hack Together: Mar 1-15 Join the hack. Build an app with NET & Microsoft Graph for a\u2026 .", "https://dotnet.microsoft.com/en-us/apps/aspnet", "appspot.com \u2022 hyper7install.appspot.com", "Interesting: memberforms.optumrx.com \u2022 myoptum.info \u2022 optumrx.com \u2022 cte-scl.new.optumrx.com \u2022 dev-scl.optumrx.com", "Handled by Lumen Technologies | What kind of darkness is this?", "http://console.cloud.google.com/appengine" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Win.packed.generic-9967832-0", "Win.downloader.small-1966", "Virtool:win32/vbinder.co", "Custom malware", "Malware", "Win32:dropper", "Win32:salicode", "Trojan:win32/vflooder!rfn", "Virtool:win32/ceeinject.akz!bit", "Win.malware.jaik-9968280-0", "Malwarex", "Trojan:win32/daws", "Bancos", "Backdoor:win32/plugx.n!dha", "!themida", "Trojan:bat/musecador", "Ymacco", "Upatre", "Win32:evo", "Win32:malwarex", "Trojanspy:win32/banker.ly", "Trojandropper:win32/bcryptinject.b!msr", "Elf:mirai-ati", "Win32:trojan", "Alf:jasyp:trojan:win32/ircbot!atmn", "Tofsee", "Trojandownloader:win32/upatre", "Asacky", "Win32/scrarev.c", "Win32:trojanx-gen\\ [trj]", "Trojandropper:win32/muldrop.v!mtb", "Trojan:win32/qbot.r!mtb", "Trojandownloader:win32/upatre.a", "Trojan:msil/rapidstealer.a", "Win32:cleaman-k\\ [trj]", "Virus:win32/sality.at", "Win32/madang", "Malware + code overlap", "Trojan:win32/ircbot", "Trojan:win32/zombie.a", "Hematite" ], "industries": [ "Finance", "Media", "Contracts", "Insurance", "Technology", "Civil society", "Telecommunications", "Government" ], "unique_indicators": 22717 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/cloud.google", "whois": "http://whois.domaintools.com/cloud.google", "domain": "cloud.google", "hostname": "dataproc-test.cloud.google" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "68e32dd0c55bf224eb99dd58", "name": "Appspot.com - Google account fraud & infostealing", "description": "Fake Google email accounts. I\u2019ve reviewed a handful of targets with this issue. If starting with a new device, signed up for a new google account,\nthe users are automatically logged out, forced to sign in again, checked security features where you can see an unauthorized autonomous general\nphone, or iPhone or MacBook was also signed in in a different location. Even if you delete the device or email account, I\u2019ve seen the intruder handle CnC of all backups of photos and clouds. \n\n\n\n[OTX auto populated - The full list of domain names: APPSPot.COM.com, which was created on the same day as the Google search engine, has been published by the internet regulator, the IANA.]", "modified": "2025-11-05T01:01:26.928000", "created": "2025-10-06T02:47:44.098000", "tags": [ "aaaa", "susp", "trojan", "google", "server", "domain status", "registrar abuse", "domain name", "us registrant", "email", "contact email", "rdap database", "google app", "google hosted", "please", "vulnerabilities", "join", "bring", "api explorer", "engine", "admin sdk", "info", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "command", "defense evasion", "ssl certificate", "ascii text", "united", "pattern match", "mitre att", "general", "local", "path", "click", "strings", "porn", "phishing", "fraud", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "download", "apt", "ansi", "dumps", "file string", "seen", "disabled hash", "close", "hosts", "contact", "tellwise", "passive dns", "urls", "pulse pulses", "files", "verdict", "domain", "files ip", "address", "location united", "asn as15169", "extraction", "data upload", "extra", "referen http", "changed data", "failed", "include review", "t07 exclude", "extri data", "changed", "exclude", "find s", "tvnes data", "status", "present nov", "name servers", "entries", "geoid no", "present dec", "date", "error", "title", "sugges", "typ no", "no entrieotound", "scam", "foundry", "sabey type", "denver", "quasi", "phoenix", "australia" ], "references": [ "appspot.com \u2022 hyper7install.appspot.com", "https://hybrid-analysis.com/sample/c61237fcb798f05e6af32a6aa13f8e795aac47559d601eb7f93ad65bcf58b418/68e30c476b91a8000b0dd786", "http://acounts.google.com/v/signin/identifier?continue=hts%253%252F2Fconsole.cloud.google.com2Fapengine&dsh=5-1106814258%2539876543210", "Changed last several digits of gmail account # In example", "http://console.cloud.google.com/appengine", "https://310940000.android.com.twitter.android.adsenseformobileapps.com/", "https://www.netify.ai/resources/domains \u2022 192-168-0-21.3pt3m9ng2hf.ddns.manage.alta.inc", "device-local-de06e551-6b23-4aa3-bb67-6972ae6d30b5.remotewd.com 192.168.0.21", "116e33e0-8832-11ec-aef5-99a1d044639a-local.solinkcloud.com", "jaycobundaberg.eclipseaurahub.com.au 192.168.0.21", "grafana.ledocloud.com\u2022 192.168.0.21", "192-168-0-21.siliconevalley1.direct.quickconnect.to" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win32/Madang", "display_name": "Win32/Madang", "target": null }, { "id": "Win.Downloader.Small-1966", "display_name": "Win.Downloader.Small-1966", "target": null }, { "id": "Win32:SaliCode", "display_name": "Win32:SaliCode", "target": null }, { "id": "Virtool:Win32/Vbinder.CO", "display_name": "Virtool:Win32/Vbinder.CO", "target": "/malware/Virtool:Win32/Vbinder.CO" }, { "id": "!Themida", "display_name": "!Themida", "target": null }, { "id": "Virus:Win32/Sality.AT", "display_name": "Virus:Win32/Sality.AT", "target": "/malware/Virus:Win32/Sality.AT" }, { "id": "Win32/Scrarev.C", "display_name": "Win32/Scrarev.C", "target": null }, { "id": "Trojan:MSIL/RapidStealer.A", "display_name": "Trojan:MSIL/RapidStealer.A", "target": "/malware/Trojan:MSIL/RapidStealer.A" } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1598", "name": "Phishing for Information", "display_name": "T1598 - Phishing for Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 222, "FileHash-MD5": 146, "FileHash-SHA1": 317, "FileHash-SHA256": 1120, "email": 3, "hostname": 881, "URL": 1338, "SSLCertFingerprint": 7 }, "indicator_count": 4034, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "166 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68eff833ed84ceaf611521d2", "name": "Tucker Carlson | AutInject \u2022 Zbot \u2022 CoinMiner \u2022 Zombie \u2022 Qbot affects his YouTube Channel (9.14.2025) ", "description": "", "modified": "2025-10-15T19:38:27.739000", "created": "2025-10-15T19:38:27.739000", "tags": [ "resolved ips", "parent pid", "full path", "command line", "cname", "ip address", "port", "involved direct", "country name", "nxdomain", "tcp connections", "udp connections", "data", "datacrashpad", "edge", "passive dns", "origin trial", "gmt cache", "sameorigin", "443 ma2592000", "ipv4 add", "files", "title", "date", "found", "gmt content", "hostname", "verdict", "error", "code", "present aug", "present sep", "aaaa", "search", "domain", "present apr", "present jun", "address google", "safe browsing", "present oct", "match info", "mitre att", "control ta0011", "protocol t1071", "protocol t1095", "match medium", "icmp traffic", "port t1571", "info", "c0002 wininet", "flag", "markmonitor", "domain address", "contacted hosts", "process details", "size", "iend ihdridatx", "qrmf", "qkdi", "qiyay", "kjtn8", "r0x3", "ihdridatx", "yg6qp", "kkrz", "t6 ex", "click", "windir", "openurl c", "prefetch2", "data upload", "extraction", "failed", "please", "your browser", "learn", "opera mozilla", "firefox google", "chrome remind", "privacy policy", "safety", "google llc", "youtube", "mozilla firefox", "safari google", "edge opera", "browse youtube", "file", "indicator", "pattern match", "ascii text", "ck id", "ck matrix", "href", "general", "local", "path", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "t1590 gather", "victim network", "files domain", "files related", "related tags", "registrar", "files ip", "asn as15169", "address domain", "ip whois", "service address", "po box", "city hayes", "country gb", "dnssec", "domain name", "emails", "script urls", "a domains", "texas flyover", "script domains", "script script", "trojan", "meta", "window", "msie", "chrome", "twitter", "unknown aaaa", "record value", "content type", "united states", "dynamicloader", "medium", "write c", "high", "show", "digicert", "olet", "encrypt", "win64", "responder", "write", "next", "unknown", "install", "dummy", "entries", "displayname", "windows", "united", "tofsee", "copy", "stream", "malware", "hostile", "body", "hostile client", "apollo", "jaik", "code overlap", "sri lanka", "pintuck sri", "lanka", "unknown ns", "moved", "buy apparal", "win32", "trojandropper", "virtool", "susp", "ipv4", "pulse pulses", "urls", "reverse dns", "location united", "installer" ], "references": [ "https://www.youtube.com/watch?v=5KmpT-BoVf4", "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D5KmpT-BoVf4", "critical-failure-alert8768.70jf59844149.com-1kafl-hs0pt4m8f.trade", "http://www.whatbrowser.com/intl/en/ \u2022 ghb.console.adtarget.com.tr.88.1.8b13f8ac.roksit.net", "canary5.nycl.do.ubersmith.com \u2022 debian-test.nyc3.do.ubersmith.com", "docs-old.ubersmith.com \u2022 edgevana.trial.ubersmith.com", "ghb.unoadsrv.com.88.1.8b13f8ac.roksit.net", "malware.sale \u2022 http://virii.es/U/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf", "IDS: Win32/Tofsee.AX google.com connectivity check Query to a *.top domain -", "Likely Hostile Http Client Body contains pwd= in cleartext Cleartext WordPress Login", "Yara Detections: RansomWin32Apollo \u2022 216.239.32.27" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Jaik-9968280-0", "display_name": "Win.Malware.Jaik-9968280-0", "target": null }, { "id": "Malware + Code Overlap", "display_name": "Malware + Code Overlap", "target": null }, { "id": "Trojan:Win32/Qbot.R!MTB", "display_name": "Trojan:Win32/Qbot.R!MTB", "target": "/malware/Trojan:Win32/Qbot.R!MTB" }, { "id": "Trojandownloader:Win32/Upatre", "display_name": "Trojandownloader:Win32/Upatre", "target": "/malware/Trojandownloader:Win32/Upatre" }, { "id": "Trojan:BAT/Musecador", "display_name": "Trojan:BAT/Musecador", "target": "/malware/Trojan:BAT/Musecador" }, { "id": "Win32:Trojan", "display_name": "Win32:Trojan", "target": null }, { "id": "Bancos", "display_name": "Bancos", "target": null }, { "id": "Hematite", "display_name": "Hematite", "target": null }, { "id": "Trojanspy:Win32/Banker.LY", "display_name": "Trojanspy:Win32/Banker.LY", "target": "/malware/Trojanspy:Win32/Banker.LY" }, { "id": "Trojan:Win32/Vflooder!rfn", "display_name": "Trojan:Win32/Vflooder!rfn", "target": "/malware/Trojan:Win32/Vflooder!rfn" }, { "id": "Win32:MalwareX", "display_name": "Win32:MalwareX", "target": null }, { "id": "Malwarex", "display_name": "Malwarex", "target": null }, { "id": "Virtool:Win32/CeeInject.AKZ!bit", "display_name": "Virtool:Win32/CeeInject.AKZ!bit", "target": "/malware/Virtool:Win32/CeeInject.AKZ!bit" }, { "id": "Win32:Dropper", "display_name": "Win32:Dropper", "target": null }, { "id": "Ymacco", "display_name": "Ymacco", "target": null }, { "id": "Upatre", "display_name": "Upatre", "target": null }, { "id": "Trojandownloader:Win32/Upatre.A", "display_name": "Trojandownloader:Win32/Upatre.A", "target": "/malware/Trojandownloader:Win32/Upatre.A" }, { "id": "Win32:Evo", "display_name": "Win32:Evo", "target": null }, { "id": "Trojandropper:Win32/BcryptInject.B!MSR", "display_name": "Trojandropper:Win32/BcryptInject.B!MSR", "target": "/malware/Trojandropper:Win32/BcryptInject.B!MSR" }, { "id": "Win32:TrojanX-gen\\ [Trj]", "display_name": "Win32:TrojanX-gen\\ [Trj]", "target": null }, { "id": "Win32:Cleaman-K\\ [Trj]", "display_name": "Win32:Cleaman-K\\ [Trj]", "target": null }, { "id": "Asacky", "display_name": "Asacky", "target": null }, { "id": "Backdoor:Win32/Plugx.N!dha", "display_name": "Backdoor:Win32/Plugx.N!dha", "target": "/malware/Backdoor:Win32/Plugx.N!dha" } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [ "Media" ], "TLP": "white", "cloned_from": "68c73fbd85dfbb4d41006ad1", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4746, "hostname": 1829, "domain": 913, "FileHash-MD5": 249, "FileHash-SHA1": 213, "FileHash-SHA256": 1765, "email": 3, "SSLCertFingerprint": 17 }, "indicator_count": 9735, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "186 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68c73fbd85dfbb4d41006ad1", "name": "Tucker Carlson Sam Altman YouTube Interview \u2022 Qbot | Malware with. Code Overlap", "description": "Maybe it\u2019s a network issue. The TV I viewed interview from is in Arabic the every time. It\u2019s not\nmy\ntelevision or network, didn\u2019t get link from a logged in YouTube. Not a subscriber.. I viewed using (cc) close captioning. It\u2019s the only program n YouTube using another language for this interview. The only reason I\u2019ve visited this interview several time\u2019s since it\u2019s aired is to check for the same results. Every time only this interview uses another language for (cc).\n\nThere are related pulses by a few different users, experiencing similar personal issues. I\u2019d assume I\u2019d always get these results. Unclear\n\n* At the end of interview Tucker Carlson states YouTube is trying to suppress or delete this one interview.", "modified": "2025-10-14T22:26:18.109000", "created": "2025-09-14T22:20:45.617000", "tags": [ "resolved ips", "parent pid", "full path", "command line", "cname", "ip address", "port", "involved direct", "country name", "nxdomain", "tcp connections", "udp connections", "data", "datacrashpad", "edge", "passive dns", "origin trial", "gmt cache", "sameorigin", "443 ma2592000", "ipv4 add", "files", "title", "date", "found", "gmt content", "hostname", "verdict", "error", "code", "present aug", "present sep", "aaaa", "search", "domain", "present apr", "present jun", "address google", "safe browsing", "present oct", "match info", "mitre att", "control ta0011", "protocol t1071", "protocol t1095", "match medium", "icmp traffic", "port t1571", "info", "c0002 wininet", "flag", "markmonitor", "domain address", "contacted hosts", "process details", "size", "iend ihdridatx", "qrmf", "qkdi", "qiyay", "kjtn8", "r0x3", "ihdridatx", "yg6qp", "kkrz", "t6 ex", "click", "windir", "openurl c", "prefetch2", "data upload", "extraction", "failed", "please", "your browser", "learn", "opera mozilla", "firefox google", "chrome remind", "privacy policy", "safety", "google llc", "youtube", "mozilla firefox", "safari google", "edge opera", "browse youtube", "file", "indicator", "pattern match", "ascii text", "ck id", "ck matrix", "href", "general", "local", "path", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "t1590 gather", "victim network", "files domain", "files related", "related tags", "registrar", "files ip", "asn as15169", "address domain", "ip whois", "service address", "po box", "city hayes", "country gb", "dnssec", "domain name", "emails", "script urls", "a domains", "texas flyover", "script domains", "script script", "trojan", "meta", "window", "msie", "chrome", "twitter", "unknown aaaa", "record value", "content type", "united states", "dynamicloader", "medium", "write c", "high", "show", "digicert", "olet", "encrypt", "win64", "responder", "write", "next", "unknown", "install", "dummy", "entries", "displayname", "windows", "united", "tofsee", "copy", "stream", "malware", "hostile", "body", "hostile client", "apollo", "jaik", "code overlap", "sri lanka", "pintuck sri", "lanka", "unknown ns", "moved", "buy apparal", "win32", "trojandropper", "virtool", "susp", "ipv4", "pulse pulses", "urls", "reverse dns", "location united", "installer" ], "references": [ "https://www.youtube.com/watch?v=5KmpT-BoVf4", "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D5KmpT-BoVf4", "critical-failure-alert8768.70jf59844149.com-1kafl-hs0pt4m8f.trade", "http://www.whatbrowser.com/intl/en/ \u2022 ghb.console.adtarget.com.tr.88.1.8b13f8ac.roksit.net", "canary5.nycl.do.ubersmith.com \u2022 debian-test.nyc3.do.ubersmith.com", "docs-old.ubersmith.com \u2022 edgevana.trial.ubersmith.com", "ghb.unoadsrv.com.88.1.8b13f8ac.roksit.net", "malware.sale \u2022 http://virii.es/U/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf", "IDS: Win32/Tofsee.AX google.com connectivity check Query to a *.top domain -", "Likely Hostile Http Client Body contains pwd= in cleartext Cleartext WordPress Login", "Yara Detections: RansomWin32Apollo \u2022 216.239.32.27" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Jaik-9968280-0", "display_name": "Win.Malware.Jaik-9968280-0", "target": null }, { "id": "Malware + Code Overlap", "display_name": "Malware + Code Overlap", "target": null }, { "id": "Trojan:Win32/Qbot.R!MTB", "display_name": "Trojan:Win32/Qbot.R!MTB", "target": "/malware/Trojan:Win32/Qbot.R!MTB" }, { "id": "Trojandownloader:Win32/Upatre", "display_name": "Trojandownloader:Win32/Upatre", "target": "/malware/Trojandownloader:Win32/Upatre" }, { "id": "Trojan:BAT/Musecador", "display_name": "Trojan:BAT/Musecador", "target": "/malware/Trojan:BAT/Musecador" }, { "id": "Win32:Trojan", "display_name": "Win32:Trojan", "target": null }, { "id": "Bancos", "display_name": "Bancos", "target": null }, { "id": "Hematite", "display_name": "Hematite", "target": null }, { "id": "Trojanspy:Win32/Banker.LY", "display_name": "Trojanspy:Win32/Banker.LY", "target": "/malware/Trojanspy:Win32/Banker.LY" }, { "id": "Trojan:Win32/Vflooder!rfn", "display_name": "Trojan:Win32/Vflooder!rfn", "target": "/malware/Trojan:Win32/Vflooder!rfn" }, { "id": "Win32:MalwareX", "display_name": "Win32:MalwareX", "target": null }, { "id": "Malwarex", "display_name": "Malwarex", "target": null }, { "id": "Virtool:Win32/CeeInject.AKZ!bit", "display_name": "Virtool:Win32/CeeInject.AKZ!bit", "target": "/malware/Virtool:Win32/CeeInject.AKZ!bit" }, { "id": "Win32:Dropper", "display_name": "Win32:Dropper", "target": null }, { "id": "Ymacco", "display_name": "Ymacco", "target": null }, { "id": "Upatre", "display_name": "Upatre", "target": null }, { "id": "Trojandownloader:Win32/Upatre.A", "display_name": "Trojandownloader:Win32/Upatre.A", "target": "/malware/Trojandownloader:Win32/Upatre.A" }, { "id": "Win32:Evo", "display_name": "Win32:Evo", "target": null }, { "id": "Trojandropper:Win32/BcryptInject.B!MSR", "display_name": "Trojandropper:Win32/BcryptInject.B!MSR", "target": "/malware/Trojandropper:Win32/BcryptInject.B!MSR" }, { "id": "Win32:TrojanX-gen\\ [Trj]", "display_name": "Win32:TrojanX-gen\\ [Trj]", "target": null }, { "id": "Win32:Cleaman-K\\ [Trj]", "display_name": "Win32:Cleaman-K\\ [Trj]", "target": null }, { "id": "Asacky", "display_name": "Asacky", "target": null }, { "id": "Backdoor:Win32/Plugx.N!dha", "display_name": "Backdoor:Win32/Plugx.N!dha", "target": "/malware/Backdoor:Win32/Plugx.N!dha" } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [ "Media" ], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4746, "hostname": 1829, "domain": 913, "FileHash-MD5": 249, "FileHash-SHA1": 213, "FileHash-SHA256": 1765, "email": 3, "SSLCertFingerprint": 17 }, "indicator_count": 9735, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "187 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68a0cb6a89a10d13623a0018", "name": "Medicaid Mirai Botnet | United Healthcare Mirai Botnet", "description": "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll. Medicaid Botnet work managed by Lumen Technologies as part of a massive silencing campaign. |\n\nPhone calls routed since forces and investigated disclosures of several attack resulting in great bodily harm and life threatening, ending injuries.\nThis campaign date has one start date 11/13/2013.\n#missed assaults internal investigated 10/08/2013 -11/31/ 2013.\nI\u2019m sure other targets are impacted . This stems from targets personal , documented experiences. \nFormerly k/a Century Link was confronted by associate of targets when a plain clothed male entered targets yard in 11/ 2013, told their box controlled entire neighborhood. Continuously accessed properties. \n\n\n\n#rip #lumen #botnet #fencing #malware #silencing #civil_liberties # monitored_target #remote #corruption #privacy_abuse #centurylink", "modified": "2025-09-15T16:04:47.043000", "created": "2025-08-16T18:18:18.657000", "tags": [ "url https", "search", "type indicator", "role title", "added active", "related pulses", "entries", "httponly", "samesitelax", "read c", "medium", "rgba", "unicode", "port", "memcommit", "delete", "next", "dock", "write", "execution", "present aug", "united", "ip address", "name servers", "unknown ns", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "spawns", "mitre att", "ck techniques", "evasion att", "pattern match", "show technique", "ck matrix", "refresh", "body", "span", "august", "hybrid", "general", "local", "path", "click", "strings", "error", "tools", "look", "verify", "restart", "href", "size", "t1480 execution", "file defense", "ascii text", "trojan", "passive dns", "trojandropper", "next associated", "fastly error", "please", "sea p", "mozilla", "accept", "ipv4 add", "urls", "files", "location united", "ipv4", "url analysis", "america flag", "america asn", "backdoor", "win32", "malware", "date", "domain", "segoe ui", "a domains", "security tls", "san jose", "asn8075", "reverse dns", "software", "resource hash", "general full", "status", "emails", "expiration date", "asp", "microsoft oem", "found", "running webserver", "netherlands", "creation date", "aaaa", "certificate", "protocol h2", "name value", "hash", "present jun", "present apr", "moved", "control att", "t1573 encrypted", "channel command", "decrypted ssl", "runtime process", "appdata", "windows nt", "svg scalable", "patch", "internal", "core", "high", "tcp syn", "icmp traffic", "dns query", "av detections", "ashburn", "ai device id", "telnet", "windows script", "microsoft", "host", "yara detections", "pdb path", "pe resource", "script host", "test", "hostname add", "files ip", "domains", "hashes", "ireland", "mtb jun", "mtb may", "device local", "remotewd", "nemtih", "url add", "http", "hostname", "files domain", "files related", "pulses otx", "present jul", "domain add", "colorado", "quasi", "contracts", "botnet", "remote access", "virginia", "c++", "hacking", "monitored target", "silencing campaign", "audio recording", "cameras", "full service", "tactics" ], "references": [ "Handled by Lumen Technologies | What kind of darkness is this?", "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll https://myhpnmedicaid.com/Provider", "dev.myhpnmedicaid.com", "ELF:Mirai-ATI | United Healthcare Dark? | https://otx.alienvault.com/indicator/ip/205.132.162.113", "https://hybrid-analysis.com/sample/e439d3dd3d943ecc702d12998a32e15c00008a8f276e6c89cb54f6de43f36de8/689fccb81c4f237eb6009b0f", "https://hybrid-analysis.com/sample/f095ee58f390749315e72cfa46d979cb25a15884b66c7951719c844ebc82b3a3/689fcc753aca4827cd036851", "https://hybrid-analysis.com/sample/dd09e575e6dfa77f081bf0014b2494e02f90cb23723fbb35d6b2a92e7c629920/689fcc40b786f8eaa20534b5", "Primary Request aspnet dotnet.microsoft.com/en-us/apps/ Redirect Chain http://asp.net/ https://asp.net/ https://www.asp.net/ https://dotnet.microsoft.com/en-us/apps/aspnet", "Redirect Chain http://asp.net/ https://asp.net/ https://www.asp.net/", "https://dotnet.microsoft.com/en-us/apps/aspnet", "ASP.net - Hack Together: Mar 1-15 Join the hack. Build an app with NET & Microsoft Graph for a\u2026 .", "ASP.net - chance to win prizes! \u53e3\u3001\u4ecb\u5973\u8fa3 All Microsoft Learn more ASP.NET Free. Cross-platform\u2026.", "ASP.net Open source. A framework for building web apps and services with .NET and C#", "Registrant Org: Japan Computer Emergency Response Team Coordination Center", "Interesting: unitedhealthcare cdn.member.unitedhealthcare.com \u2022 data.aca.unitedhealthcare.com \u2022 data.member.unitedhealthcare.com", "Interesting Domain Tactics: https://click.benefits.unitedhealthcare.com/", "Interesting: dev-optum-dataintelligence.com \u2022 optumcoding.xxx \u2022 optuminsightcoding.xxx \u2022 optumrx.xxx", "Interesting: memberforms.optumrx.com \u2022 myoptum.info \u2022 optumrx.com \u2022 cte-scl.new.optumrx.com \u2022 dev-scl.optumrx.com", "http://www.nexcentra.com/fox-news-faces-another-sexual-harassment-lawsuit" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Trojan:Win32/Zombie.A", "display_name": "Trojan:Win32/Zombie.A", "target": "/malware/Trojan:Win32/Zombie.A" }, { "id": "Win.Packed.Generic-9967832-0", "display_name": "Win.Packed.Generic-9967832-0", "target": null }, { "id": "Custom Malware", "display_name": "Custom Malware", "target": null }, { "id": "Trojan:Win32/Daws", "display_name": "Trojan:Win32/Daws", "target": "/malware/Trojan:Win32/Daws" }, { "id": "ELF:Mirai-ATI", "display_name": "ELF:Mirai-ATI", "target": null }, { "id": "Trojan:Win32/IRCbot", "display_name": "Trojan:Win32/IRCbot", "target": "/malware/Trojan:Win32/IRCbot" }, { "id": "alf:JASYP:Trojan:Win32/IRCbot!atmn", "display_name": "alf:JASYP:Trojan:Win32/IRCbot!atmn", "target": null }, { "id": "Trojandropper:Win32/Muldrop.V!MTB", "display_name": "Trojandropper:Win32/Muldrop.V!MTB", "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1092", "name": "Communication Through Removable Media", "display_name": "T1092 - Communication Through Removable Media" }, { "id": "T1433", "name": "Access Call Log", "display_name": "T1433 - Access Call Log" } ], "industries": [ "Technology", "Telecommunications", "Contracts", "Government", "Finance", "Insurance", "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 37, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4880, "domain": 575, "hostname": 1419, "FileHash-SHA256": 1745, "FileHash-MD5": 284, "FileHash-SHA1": 263, "email": 5, "CVE": 1 }, "indicator_count": 9172, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "216 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://dataproc-test.cloud.google/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://dataproc-test.cloud.google/", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776672736.0252924 }