{ "type": "URL", "indicator": "https://dev.p2p.ihost.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://dev.p2p.ihost.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4102810755, "indicator": "https://dev.p2p.ihost.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "68ee5e9f8cfc5fbc73142660", "name": "Gaming Studios - YouTube - MyDoom", "description": "", "modified": "2025-11-13T12:05:32.283000", "created": "2025-10-14T14:30:55.471000", "tags": [ "no expiration", "url https", "url http", "iocs", "ipv4", "enter source", "indicator role", "title added", "active related", "united", "present jul", "unknown ns", "search", "for privacy", "moved", "ip address", "encrypt", "a domains", "script urls", "meta", "pragma", "general full", "reverse dns", "software", "resource", "security tls", "piscataway", "asn20473", "asn15169", "google", "asvultr", "portfolio", "josh theriault", "upei", "university", "island", "roblox", "jmt studios", "moon engine", "android", "icpc", "north america", "qualifier", "hello", "apache", "runner", "eric everest", "games", "cloudflar", "amazon02", "as autonomous", "system", "canada", "value", "domainpath name", "cgjerrieegaggq", "name value", "form", "game development", "blog", "jmt99", "developer", "event", "bullseye", "trick or treat", "unofficial trick or treat 2014", "unofficial trick or treat 2015", "egg hunt", "gift hunt", "hallows quest", "studio", "experience", "fall", "january", "july", "founder", "studio head", "passive dns", "urls", "registrar", "title", "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"", "press copyright", "contact", "privacy policy", "safety how", "youtube", "test", "nfl sunday", "ticket", "google llc", "data upload", "extraction", "failed", "files", "twitter", "variables", "cgjjtbieggagla", "nid value", "expiration date", "files ip", "dynamicloader", "write c", "delete c", "intel", "ms windows", "medium", "default", "write", "guard", "mozilla", "malware", "defender", "unknown", "domains", "hashes", "url analysis", "unknown aaaa", "script domains", "certificate", "game", "servers", "unofficial", "settings", "public", "endpoints", "currently", "game servers", "current", "meta name", "robots content", "x ua", "ieedge chrome1", "incapsula", "request", "role title", "related pulses", "domain v", "url indicator", "nameilname", "ascii text", "mitre att", "ck id", "ck matrix", "hybrid", "general", "local", "path", "click", "strings", "pe file", "high", "yara detections", "dynamic", "v hostname", "se fos", "include v", "domain url", "data", "alltypes", "win32mydoom oct", "trojan", "url add", "http", "related nids", "files location", "canada flag", "canada hostname", "canada unknown", "canada", "present aug", "name servers", "present sep", "aaaa", "present oct", "crlf line", "unicode text", "music", "suspicious", "bricked.wtf", "flag united", "google safe", "domain", "address domain", "united states", "filehashsha256", "hostname xn", "finland unknown", "filehashmd5", "indicators hong", "kong", "south korea", "present jun", "present mar", "present may", "olet", "cnr12", "tlsv1", "get updates", "upatre", "added active", "apple", "everest", "josh paul", "upadter", "convagent", "info stealing", "delete service", "phishing", "fraud", "social engineering", "gamer", "hacker", "adversaries", "icloud", "found", "gmt content", "error", "redacted for", "meta http", "content", "gmt server", "france unknown", "poland unknown", "content type", "xml title", "hostname add", "address", "location united", "life", "century link llc", "xfinity", "livesex", "domain add", "users", "show", "delete", "blocked by quad9", "showing", "record value", "location canada", "canada asn", "accept", "cookie", "macbook", "ipv4 add", "america flag", "america asn", "asn as714", "less", "woodynet", "next associated", "status", "exclude sugges", "ip related", "t1027.013" ], "references": [ "https://www.jmtstudios.org/farewell/", "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw", "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system", "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html", "ConventionEngine_Term_Dropbox \u2022 Dropbox", "http://api.jmtstudios.org/", "bricked.wtf", "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com", "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com", "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/", "https://forwardemail.net/es/blog/open-source/apple-email-clients", "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud", "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link", "http://www.visitbooker.com/Dropbox-07/index.htm", "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/", "Appears to be closely associated with close relative and initial victim of attack.", "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party." ], "public": 1, "adversary": "", "targeted_countries": [ "Hong Kong", "United States of America" ], "malware_families": [ { "id": "Win.Malware.Convagent-9981433-0", "display_name": "Win.Malware.Convagent-9981433-0", "target": null }, { "id": "Upadter", "display_name": "Upadter", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6996, "FileHash-MD5": 281, "FileHash-SHA1": 220, "FileHash-SHA256": 2673, "domain": 1747, "email": 24, "hostname": 2803, "SSLCertFingerprint": 3 }, "indicator_count": 14747, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "157 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68ee5ea4d51d4a1cabdb4ee9", "name": "Gaming Studios - YouTube - MyDoom", "description": "", "modified": "2025-11-13T12:05:32.283000", "created": "2025-10-14T14:31:00.172000", "tags": [ "no expiration", "url https", "url http", "iocs", "ipv4", "enter source", "indicator role", "title added", "active related", "united", "present jul", "unknown ns", "search", "for privacy", "moved", "ip address", "encrypt", "a domains", "script urls", "meta", "pragma", "general full", "reverse dns", "software", "resource", "security tls", "piscataway", "asn20473", "asn15169", "google", "asvultr", "portfolio", "josh theriault", "upei", "university", "island", "roblox", "jmt studios", "moon engine", "android", "icpc", "north america", "qualifier", "hello", "apache", "runner", "eric everest", "games", "cloudflar", "amazon02", "as autonomous", "system", "canada", "value", "domainpath name", "cgjerrieegaggq", "name value", "form", "game development", "blog", "jmt99", "developer", "event", "bullseye", "trick or treat", "unofficial trick or treat 2014", "unofficial trick or treat 2015", "egg hunt", "gift hunt", "hallows quest", "studio", "experience", "fall", "january", "july", "founder", "studio head", "passive dns", "urls", "registrar", "title", "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"", "press copyright", "contact", "privacy policy", "safety how", "youtube", "test", "nfl sunday", "ticket", "google llc", "data upload", "extraction", "failed", "files", "twitter", "variables", "cgjjtbieggagla", "nid value", "expiration date", "files ip", "dynamicloader", "write c", "delete c", "intel", "ms windows", "medium", "default", "write", "guard", "mozilla", "malware", "defender", "unknown", "domains", "hashes", "url analysis", "unknown aaaa", "script domains", "certificate", "game", "servers", "unofficial", "settings", "public", "endpoints", "currently", "game servers", "current", "meta name", "robots content", "x ua", "ieedge chrome1", "incapsula", "request", "role title", "related pulses", "domain v", "url indicator", "nameilname", "ascii text", "mitre att", "ck id", "ck matrix", "hybrid", "general", "local", "path", "click", "strings", "pe file", "high", "yara detections", "dynamic", "v hostname", "se fos", "include v", "domain url", "data", "alltypes", "win32mydoom oct", "trojan", "url add", "http", "related nids", "files location", "canada flag", "canada hostname", "canada unknown", "canada", "present aug", "name servers", "present sep", "aaaa", "present oct", "crlf line", "unicode text", "music", "suspicious", "bricked.wtf", "flag united", "google safe", "domain", "address domain", "united states", "filehashsha256", "hostname xn", "finland unknown", "filehashmd5", "indicators hong", "kong", "south korea", "present jun", "present mar", "present may", "olet", "cnr12", "tlsv1", "get updates", "upatre", "added active", "apple", "everest", "josh paul", "upadter", "convagent", "info stealing", "delete service", "phishing", "fraud", "social engineering", "gamer", "hacker", "adversaries", "icloud", "found", "gmt content", "error", "redacted for", "meta http", "content", "gmt server", "france unknown", "poland unknown", "content type", "xml title", "hostname add", "address", "location united", "life", "century link llc", "xfinity", "livesex", "domain add", "users", "show", "delete", "blocked by quad9", "showing", "record value", "location canada", "canada asn", "accept", "cookie", "macbook", "ipv4 add", "america flag", "america asn", "asn as714", "less", "woodynet", "next associated", "status", "exclude sugges", "ip related", "t1027.013" ], "references": [ "https://www.jmtstudios.org/farewell/", "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw", "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system", "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html", "ConventionEngine_Term_Dropbox \u2022 Dropbox", "http://api.jmtstudios.org/", "bricked.wtf", "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com", "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com", "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/", "https://forwardemail.net/es/blog/open-source/apple-email-clients", "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud", "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link", "http://www.visitbooker.com/Dropbox-07/index.htm", "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/", "Appears to be closely associated with close relative and initial victim of attack.", "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party." ], "public": 1, "adversary": "", "targeted_countries": [ "Hong Kong", "United States of America" ], "malware_families": [ { "id": "Win.Malware.Convagent-9981433-0", "display_name": "Win.Malware.Convagent-9981433-0", "target": null }, { "id": "Upadter", "display_name": "Upadter", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6996, "FileHash-MD5": 281, "FileHash-SHA1": 220, "FileHash-SHA256": 2673, "domain": 1747, "email": 24, "hostname": 2803, "SSLCertFingerprint": 3 }, "indicator_count": 14747, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "157 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "688716977e80a4274f2eafa9", "name": "LeadIQ | The Smart B2B Prospecting Platform | Malware Packed | Agent Tesla & more", "description": "Found in Bot joining Pulse.", "modified": "2025-08-27T06:03:05.020000", "created": "2025-07-28T06:20:07.660000", "tags": [ "present jul", "united", "entries", "search", "moved", "ip address", "creation date", "record value", "date", "showing", "body", "meta", "passive dns", "next associated", "win32spigot apr", "title error", "ipv4 add", "pulse pulses", "urls", "files", "adaptivebee", "worm", "win32", "urls show", "date checked", "url hostname", "server response", "google safe", "results jul", "location united", "asn asnone", "nameservers", "less whois", "registrar", "csc corporate", "status", "servers", "name servers", "hostname", "hostname add", "a domains", "script urls", "unknown aaaa", "technology one", "script script", "certificate", "null", "trojan", "twitter", "domain", "files ip", "address domain", "ip related", "pulses otx", "virtool", "http", "present jun", "present may", "pulse submit", "url analysis", "reverse dns", "australia asn", "as55532 squiz", "dns resolutions", "overview ip", "address", "ipv4", "iocs", "data upload", "extraction", "ided iocs", "failed", "shaw", "ail tvnas", "rl irl", "domain add", "ostname add", "verdict", "show", "types", "type", "indicator data", "searc type", "a indicator", "data", "select across", "all pages", "domain domain", "checked url", "hostname server", "response ip", "address google", "safe browsing", "msie", "chrome", "present dec", "base", "read c", "port", "destination", "delete", "copy", "write", "memcommit", "cryptexportkey", "invalid pointer", "writeconsolea", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "spawns", "defense evasion", "t1480 execution", "signing defense", "copy md5", "copy sha1", "copy sha256", "sha1", "sha256", "pattern match", "size", "ascii text", "crlf line", "mitre att", "error", "click", "hybrid", "local", "path", "starfield", "strings", "refresh", "tools", "onload", "span", "form", "adversaries", "windows nt", "generic http", "exe upload", "inbound", "outbound", "yara detections", "malware", "expiration date", "whois show", "name andrew", "bauer name", "div id", "beginstring", "beginerror", "script", "general", "cloud", "find", "footer", "ninite feb", "telper", "ninite mar", "ninite apr", "trojandropper", "mtb mar", "url https", "general full", "security tls", "software", "resource hash", "protocol h2", "frankfurt", "main", "germany", "input", "skype", "opciones", "july", "es form", "dom name", "post https", "imagen", "microsoft", "iniciar sesin", "value", "variables", "config", "debug", "loader", "geturl", "b function", "addlistener", "proof", "amazon02", "dk summary", "amazon rsa", "september", "browsing", "resource", "asn16509", "name value", "queueprogress", "timestamp input", "status actions" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 487, "FileHash-SHA1": 461, "URL": 10732, "domain": 1672, "email": 6, "hostname": 3039, "FileHash-SHA256": 2569, "SSLCertFingerprint": 7 }, "indicator_count": 18973, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "235 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "688343b9e60e8693f50e515f", "name": "Cycbot & worse - Palantir Monitoring Target/s", "description": "Palantir \u2022 Gotham \u2022 Foundry Top tier sells tools used to monitor, harass, smear , invoke fear, even \u2018kill\u2019. Used by military., too many partners to name (includes the entire government., heavy military, NSA use) of course Twitter, Apple Facebook, Pegasus related, possibly Paragon if what I\u2019ve read and researched is true. *There are 188 Palantir Foundry links in this pulse. ||\nMonitored target || Apparently ,\u2018tool\u2019 is weaponized against civilians for unknown and unwarranted purposes. || Lofty and unclear how or why a manner of death of target was predicted and posted online 12 years ago. || More research is needed.\n\nMalware named was found in research. \n\n #targeted #rip #palantir #foundry #gotham #twitter #techbromafia #silencing #overreach #quasi_gov #ongoing #active #moved #dangerous", "modified": "2025-08-24T06:01:34.920000", "created": "2025-07-25T08:43:37.734000", "tags": [ "status", "united", "unknown ns", "passive dns", "urls", "creation date", "search", "emails", "date", "expiration date", "tcp include", "top source", "top destination", "show", "source source", "data upload", "extraction", "showing", "moved", "certificate", "ip address", "domain", "body", "present jul", "present jun", "present aug", "present sep", "trojan", "name servers", "twitter", "vtflooder", "foundry", "virustotal", "gotham", "palantir", "tools", "destination", "port", "msie", "windows nt", "unknown", "read c", "etpro trojan", "malware", "copy", "write", "infostealer", "possible", "virustotal", "copyleft", "present jan", "entries", "next associated", "ipv4 add", "pulse submit", "url analysis", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "spawns", "defense evasion", "t1480 execution", "discovery att", "hostname add", "files", "copy md5", "copy sha1", "copy sha256", "sha1", "sha256", "ascii text", "mitre att", "pattern match", "show technique", "null", "refresh", "span", "hybrid", "general", "local", "path", "click", "strings", "error", "look", "verify", "restart", "se extri", "referen", "etpro tr", "virtool", "referencec", "failed", "se extra", "eanioae", "include review", "exclude sugges", "includec review", "exclude", "suggest data", "open ports", "reverse dns", "location united", "america flag", "boardman", "t1045", "ck ids", "packing", "t1060", "run keys", "startup", "folder", "t1057", "discovery", "t1071", "value emails", "name domain", "org microsoft", "microsoft way", "city redmond", "country us", "dnssec", "t1012", "t1047", "instrumentation", "t1053", "taskjob", "spyware", "source", "signing defense", "size", "meta", "onload", "dynamicloader", "unicode text", "crlf line", "utf8", "medium", "write c", "default", "delphi", "win32", "code", "stream", "next", "akamai rank", "show process", "prefetch2", "dns server", "network traffic", "virus", "monitored target", "tofsee", "generic http", "exe upload", "inbound", "outbound", "delete", "yara detections", "markus", "flowid22101", "pixelevtid11771", "dvid", "urls show", "date checked", "188 palantir results", "adversaries", "development att", "ssl certificate", "flag", "stop", "facebook", "4328", "5943", "stealer", "unknown aaaa", "present may", "domain add", "hyundaitx", "twitter", "monitored tsara", "brashears", "apple", "ios", "remote", "cycbot", "maudio fw", "heur", "productversion", "fileversion", "maudio firewire" ], "references": [ "palantirfoundry.com \u2022 https://edenglobalpartners.palantirfoundry.com/", "247seekscenter.com \u2022 ns-1986.awsdns-56.co.uk: | 365-notifcation.com", "ETPRO TROJAN Win32/Oderoor Checkin \u2022 ET INFO DYNAMIC_DNS Query to *.dyndns. Domain", "Domain ET WEB_CLIENT SUSPICOUS Possible automated connectivity check (www.google.com)", "ET POLICY Internal Host Retrieving External IP via ipchicken.com - Possible Infection", "platform.twitter.co \u2022 rm.twitter.co \u2022 upload.twitter.co \u2022 http://2fsyndication.twitter.co/", "http://legal.twitter.co \u2022 http://mobile.twitter.co/", "ec2-44-228-94-74.us-west-2.compute.amazonaws.com \u2022 defender.palantirfoundry.com", "https://embaxter.palantirfoundry.com \u2022 https://amgistudios.palantirfoundry.com", "https://ametrine-containers.palantirfoundry.com \u2022 https://amfp.palantirfoundry.com", "https://ameteklms.palantirfoundry.com \u2022 https://ametrine-compute.palantirfoundry.com", "https://amiable-constellation.palantirfoundry.com \u2022 https://amplifi.palantirfoundry.com", "https://oscar.palantirfoundry.com/ \u2022 https://replica.palantirfoundry.com/", "https://statemed.palantirgov.com/workspace/settings/notifications \u2022 https://cchbc.palantirfoundry.com", "https://test-1.washington.palantircloud.com \u2022 https://tarn.palantirgov.com \u2022 https://stateplatform.palantirgov.com", "https://imperium-dev-1.palantircloud.com \u2022 https://hii.palantirgov.com \u2022 https://genoa.washington.palantircloud.com", "tsystems.palantirfoundry.com \u2022 https://statemed.palantirgov.com \u2022 https://statecms.palantirgov.com", "https://replica.palantirfoundry.com/ \u2022 https://spacejam.palantirfoundry.com/ \u2022", "https://pl.pornhub.mrst.one/ \u2022 hotamateurpornsite.xxx \u2022 squirting.porn \u2022 https://de-pornhub.mrst.one/", "Hostname: hcl-dna-sandbox.palantirfoundry.com", "https://www.hyundaitx.com/", "ETPRO TROJAN Win32/Tofsee.AX google.com connectivity check", "https://remote.downloadnow-1.com/", "Alerts: injection_runpe deletes_self persistence_autorun stealth_file antivirus_virustotal infostealer_ftp", "Alerts: infostealer_mail network_smtp persistence_ads recon_programs injection", "Monitored Target - Spawned process \"iexplore.exe\" w/commandline \"SCODEF:5860 CREDAT:275457 /prefetch:2\" (Show Process) source", "Monitored Target: Queries DNS server details \"www.hyundaitx.com\" source Network Traffic T1071.004", "Palantir/ Hyuandi coexist | Confirmed Targets transportation was a Hyuandi SUV |", "ipad-steals-app-ideas_1_.jpg - MD5 6dd66b729a649dec250b24533a58a996" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Vtflooder-9783271-0", "display_name": "Win.Malware.Vtflooder-9783271-0", "target": null }, { "id": "Trojan.Kazy-237", "display_name": "Trojan.Kazy-237", "target": null }, { "id": "Trojan.Vundo-5335", "display_name": "Trojan.Vundo-5335", "target": null }, { "id": "Generic31.BKFG", "display_name": "Generic31.BKFG", "target": null }, { "id": "Win.Packed.Krucky-6941986-0", "display_name": "Win.Packed.Krucky-6941986-0", "target": null }, { "id": "ALF:HSTR:KrunchyMalPacker!MTB", "display_name": "ALF:HSTR:KrunchyMalPacker!MTB", "target": null }, { "id": "Win.Trojan.Agent-920890", "display_name": "Win.Trojan.Agent-920890", "target": null }, { "id": "Win.Trojan.Jorik-10365", "display_name": "Win.Trojan.Jorik-10365", "target": null }, { "id": "Trojan.Adload-2492", "display_name": "Trojan.Adload-2492", "target": null }, { "id": "Trojan.Spy-59563", "display_name": "Trojan.Spy-59563", "target": null }, { "id": "Ransom:Win32/Cryptor", "display_name": "Ransom:Win32/Cryptor", "target": "/malware/Ransom:Win32/Cryptor" }, { "id": "Win32/Blacked", "display_name": "Win32/Blacked", "target": null }, { "id": "Win.Trojan.Cycbot-764", "display_name": "Win.Trojan.Cycbot-764", "target": null }, { "id": "Trojan.VB-47534", "display_name": "Trojan.VB-47534", "target": null }, { "id": "Backdoor:Win32/Drixed.J ,", "display_name": "Backdoor:Win32/Drixed.J ,", "target": "/malware/Backdoor:Win32/Drixed.J ," }, { "id": "ALF:HeraklezEval:PWS:Win32/Ldpinch!rfn", "display_name": "ALF:HeraklezEval:PWS:Win32/Ldpinch!rfn", "target": null }, { "id": "ALF:HeraklezEval:PWS:Win32/Ldpinch!rfn", "display_name": "ALF:HeraklezEval:PWS:Win32/Ldpinch!rfn", "target": null }, { "id": "Malware Tool", "display_name": "Malware Tool", "target": null }, { "id": "Palantir Spyware", "display_name": "Palantir Spyware", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "TA0030", "name": "Defense Evasion", "display_name": "TA0030 - Defense Evasion" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1589", "name": "Gather Victim Identity Information", "display_name": "T1589 - Gather Victim Identity Information" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1003.008", "name": "/etc/passwd and /etc/shadow", "display_name": "T1003.008 - /etc/passwd and /etc/shadow" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" }, { "id": "T1088", "name": "Bypass User Account Control", "display_name": "T1088 - Bypass User Account Control" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4203, "domain": 1218, "email": 9, "hostname": 2006, "FileHash-SHA256": 2740, "FileHash-MD5": 424, "FileHash-SHA1": 419, "SSLCertFingerprint": 12 }, "indicator_count": 11031, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "238 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6882e2a53af80b1af320079d", "name": "VirusTotal - Palantir- KrunchyMalPacker | Vflooder", "description": "-> Hostname: \u2022 edenglobalpartners.palantirfoundry.com\n\u2022 c.twitterintegration.com\n*Trojan:Win32/Vflooder.E\nIDS Detections:\n- Win32/Flooder.Agent.NAS CnC Domain in DNS Lookup\n\u2022 Virus Total vtapi DOS\n\u2022 Generic HTTP EXE Upload Inbound\n\u2022 Observed Suspicious UA (Mozilla/5.0)\n\u2022 Generic HTTP EXE Upload Outbound || \n*ALF:HSTR:KrunchyMalPacker!MTB\t\n IDS Detections\n-Win32/Vflooder.B Checkin\n\u2022 TLS Handshake Failure\nYara Detections: \nkkrunchy023alpha2\nAlerts:\n\u2022 static_pe_anomaly\n\u2022 suricata_alert\n\u2022 dynamic_function_loading\n\u2022 network_cnc_https_generic\n\u2022 reads_self\n\u2022 network_cnc_http\n\u2022 network_http\n\u2022 packer_unknown_pe_section_name\n\u2022 packer_entropy\n\u2022 injection_rwx ||\n__________\nIP\u2019s Contacted:\n\u2022 34.54.88.138\n\u2022 162.159.140.229\nDomains Contacted\n\u2022 twitter.com (SBKA - Palantir?)\n\u2022 www.virustotal.com\n#botnetresulttesting #virustotal_unsafe #vtflooder #palantir #twitter #gotham foundry #brian_sabey_has_a_new_toy #targeting #tsara_brashears", "modified": "2025-08-24T01:04:01.801000", "created": "2025-07-25T01:49:25.325000", "tags": [ "windows nt", "dynamicloader", "contentlength", "tls handshake", "failure", "host", "show", "medium", "search", "entries", "copy", "write", "malware", "generic http", "exe upload", "inbound", "outbound", "domain", "trojan", "u0019", "trojandropper", "backdoor", "mtb jul", "united", "passive dns", "open ports", "win32berbew jul", "ipv4 add", "present jul", "present jun", "cname", "present aug", "present sep", "status", "certificate", "date", "twitter", "unknown ns", "name servers", "servers", "showing", "urls", "creation date" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1903, "hostname": 806, "FileHash-SHA256": 1594, "FileHash-MD5": 264, "FileHash-SHA1": 297, "SSLCertFingerprint": 1, "domain": 515, "email": 5 }, "indicator_count": 5385, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "238 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://ameteklms.palantirfoundry.com \u2022 https://ametrine-compute.palantirfoundry.com", "bricked.wtf", "ET POLICY Internal Host Retrieving External IP via ipchicken.com - Possible Infection", "https://test-1.washington.palantircloud.com \u2022 https://tarn.palantirgov.com \u2022 https://stateplatform.palantirgov.com", "Appears to be closely associated with close relative and initial victim of attack.", "https://amiable-constellation.palantirfoundry.com \u2022 https://amplifi.palantirfoundry.com", "ETPRO TROJAN Win32/Tofsee.AX google.com connectivity check", "https://replica.palantirfoundry.com/ \u2022 https://spacejam.palantirfoundry.com/ \u2022", "https://statemed.palantirgov.com/workspace/settings/notifications \u2022 https://cchbc.palantirfoundry.com", "http://www.visitbooker.com/Dropbox-07/index.htm", "Domain ET WEB_CLIENT SUSPICOUS Possible automated connectivity check (www.google.com)", "https://pl.pornhub.mrst.one/ \u2022 hotamateurpornsite.xxx \u2022 squirting.porn \u2022 https://de-pornhub.mrst.one/", "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system", "247seekscenter.com \u2022 ns-1986.awsdns-56.co.uk: | 365-notifcation.com", "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/", "Monitored Target: Queries DNS server details \"www.hyundaitx.com\" source Network Traffic T1071.004", "Alerts: infostealer_mail network_smtp persistence_ads recon_programs injection", "https://ametrine-containers.palantirfoundry.com \u2022 https://amfp.palantirfoundry.com", "palantirfoundry.com \u2022 https://edenglobalpartners.palantirfoundry.com/", "https://forwardemail.net/es/blog/open-source/apple-email-clients", "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com", "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link", "https://oscar.palantirfoundry.com/ \u2022 https://replica.palantirfoundry.com/", "https://www.hyundaitx.com/", "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/", "ipad-steals-app-ideas_1_.jpg - MD5 6dd66b729a649dec250b24533a58a996", "ec2-44-228-94-74.us-west-2.compute.amazonaws.com \u2022 defender.palantirfoundry.com", "https://www.jmtstudios.org/farewell/", "ETPRO TROJAN Win32/Oderoor Checkin \u2022 ET INFO DYNAMIC_DNS Query to *.dyndns. Domain", "Monitored Target - Spawned process \"iexplore.exe\" w/commandline \"SCODEF:5860 CREDAT:275457 /prefetch:2\" (Show Process) source", "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud", "https://imperium-dev-1.palantircloud.com \u2022 https://hii.palantirgov.com \u2022 https://genoa.washington.palantircloud.com", "Hostname: hcl-dna-sandbox.palantirfoundry.com", "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party.", "http://legal.twitter.co \u2022 http://mobile.twitter.co/", "platform.twitter.co \u2022 rm.twitter.co \u2022 upload.twitter.co \u2022 http://2fsyndication.twitter.co/", "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com", "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw", "ConventionEngine_Term_Dropbox \u2022 Dropbox", "http://api.jmtstudios.org/", "Alerts: injection_runpe deletes_self persistence_autorun stealth_file antivirus_virustotal infostealer_ftp", "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html", "tsystems.palantirfoundry.com \u2022 https://statemed.palantirgov.com \u2022 https://statecms.palantirgov.com", "Palantir/ Hyuandi coexist | Confirmed Targets transportation was a Hyuandi SUV |", "https://remote.downloadnow-1.com/", "https://embaxter.palantirfoundry.com \u2022 https://amgistudios.palantirfoundry.com" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Win.malware.vtflooder-9783271-0", "Trojan.vb-47534", "Win.trojan.jorik-10365", "Trojan.vundo-5335", "Malware tool", "Win.malware.convagent-9981433-0", "Palantir spyware", "Trojan.adload-2492", "Win.packed.krucky-6941986-0", "Ransom:win32/cryptor", "Win32/blacked", "Upadter", "Trojan.spy-59563", "Win.trojan.agent-920890", "Mydoom", "Trojan.kazy-237", "Backdoor:win32/drixed.j ,", "Alf:hstr:krunchymalpacker!mtb", "Alf:heraklezeval:pws:win32/ldpinch!rfn", "Generic31.bkfg", "Win.trojan.cycbot-764" ], "industries": [], "unique_indicators": 44066 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/ihost.com", "whois": "http://whois.domaintools.com/ihost.com", "domain": "ihost.com", "hostname": "dev.p2p.ihost.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "68ee5e9f8cfc5fbc73142660", "name": "Gaming Studios - YouTube - MyDoom", "description": "", "modified": "2025-11-13T12:05:32.283000", "created": "2025-10-14T14:30:55.471000", "tags": [ "no expiration", "url https", "url http", "iocs", "ipv4", "enter source", "indicator role", "title added", "active related", "united", "present jul", "unknown ns", "search", "for privacy", "moved", "ip address", "encrypt", "a domains", "script urls", "meta", "pragma", "general full", "reverse dns", "software", "resource", "security tls", "piscataway", "asn20473", "asn15169", "google", "asvultr", "portfolio", "josh theriault", "upei", "university", "island", "roblox", "jmt studios", "moon engine", "android", "icpc", "north america", "qualifier", "hello", "apache", "runner", "eric everest", "games", "cloudflar", "amazon02", "as autonomous", "system", "canada", "value", "domainpath name", "cgjerrieegaggq", "name value", "form", "game development", "blog", "jmt99", "developer", "event", "bullseye", "trick or treat", "unofficial trick or treat 2014", "unofficial trick or treat 2015", "egg hunt", "gift hunt", "hallows quest", "studio", "experience", "fall", "january", "july", "founder", "studio head", "passive dns", "urls", "registrar", "title", "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"", "press copyright", "contact", "privacy policy", "safety how", "youtube", "test", "nfl sunday", "ticket", "google llc", "data upload", "extraction", "failed", "files", "twitter", "variables", "cgjjtbieggagla", "nid value", "expiration date", "files ip", "dynamicloader", "write c", "delete c", "intel", "ms windows", "medium", "default", "write", "guard", "mozilla", "malware", "defender", "unknown", "domains", "hashes", "url analysis", "unknown aaaa", "script domains", "certificate", "game", "servers", "unofficial", "settings", "public", "endpoints", "currently", "game servers", "current", "meta name", "robots content", "x ua", "ieedge chrome1", "incapsula", "request", "role title", "related pulses", "domain v", "url indicator", "nameilname", "ascii text", "mitre att", "ck id", "ck matrix", "hybrid", "general", "local", "path", "click", "strings", "pe file", "high", "yara detections", "dynamic", "v hostname", "se fos", "include v", "domain url", "data", "alltypes", "win32mydoom oct", "trojan", "url add", "http", "related nids", "files location", "canada flag", "canada hostname", "canada unknown", "canada", "present aug", "name servers", "present sep", "aaaa", "present oct", "crlf line", "unicode text", "music", "suspicious", "bricked.wtf", "flag united", "google safe", "domain", "address domain", "united states", "filehashsha256", "hostname xn", "finland unknown", "filehashmd5", "indicators hong", "kong", "south korea", "present jun", "present mar", "present may", "olet", "cnr12", "tlsv1", "get updates", "upatre", "added active", "apple", "everest", "josh paul", "upadter", "convagent", "info stealing", "delete service", "phishing", "fraud", "social engineering", "gamer", "hacker", "adversaries", "icloud", "found", "gmt content", "error", "redacted for", "meta http", "content", "gmt server", "france unknown", "poland unknown", "content type", "xml title", "hostname add", "address", "location united", "life", "century link llc", "xfinity", "livesex", "domain add", "users", "show", "delete", "blocked by quad9", "showing", "record value", "location canada", "canada asn", "accept", "cookie", "macbook", "ipv4 add", "america flag", "america asn", "asn as714", "less", "woodynet", "next associated", "status", "exclude sugges", "ip related", "t1027.013" ], "references": [ "https://www.jmtstudios.org/farewell/", "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw", "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system", "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html", "ConventionEngine_Term_Dropbox \u2022 Dropbox", "http://api.jmtstudios.org/", "bricked.wtf", "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com", "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com", "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/", "https://forwardemail.net/es/blog/open-source/apple-email-clients", "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud", "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link", "http://www.visitbooker.com/Dropbox-07/index.htm", "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/", "Appears to be closely associated with close relative and initial victim of attack.", "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party." ], "public": 1, "adversary": "", "targeted_countries": [ "Hong Kong", "United States of America" ], "malware_families": [ { "id": "Win.Malware.Convagent-9981433-0", "display_name": "Win.Malware.Convagent-9981433-0", "target": null }, { "id": "Upadter", "display_name": "Upadter", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6996, "FileHash-MD5": 281, "FileHash-SHA1": 220, "FileHash-SHA256": 2673, "domain": 1747, "email": 24, "hostname": 2803, "SSLCertFingerprint": 3 }, "indicator_count": 14747, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "157 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68ee5ea4d51d4a1cabdb4ee9", "name": "Gaming Studios - YouTube - MyDoom", "description": "", "modified": "2025-11-13T12:05:32.283000", "created": "2025-10-14T14:31:00.172000", "tags": [ "no expiration", "url https", "url http", "iocs", "ipv4", "enter source", "indicator role", "title added", "active related", "united", "present jul", "unknown ns", "search", "for privacy", "moved", "ip address", "encrypt", "a domains", "script urls", "meta", "pragma", "general full", "reverse dns", "software", "resource", "security tls", "piscataway", "asn20473", "asn15169", "google", "asvultr", "portfolio", "josh theriault", "upei", "university", "island", "roblox", "jmt studios", "moon engine", "android", "icpc", "north america", "qualifier", "hello", "apache", "runner", "eric everest", "games", "cloudflar", "amazon02", "as autonomous", "system", "canada", "value", "domainpath name", "cgjerrieegaggq", "name value", "form", "game development", "blog", "jmt99", "developer", "event", "bullseye", "trick or treat", "unofficial trick or treat 2014", "unofficial trick or treat 2015", "egg hunt", "gift hunt", "hallows quest", "studio", "experience", "fall", "january", "july", "founder", "studio head", "passive dns", "urls", "registrar", "title", "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"", "press copyright", "contact", "privacy policy", "safety how", "youtube", "test", "nfl sunday", "ticket", "google llc", "data upload", "extraction", "failed", "files", "twitter", "variables", "cgjjtbieggagla", "nid value", "expiration date", "files ip", "dynamicloader", "write c", "delete c", "intel", "ms windows", "medium", "default", "write", "guard", "mozilla", "malware", "defender", "unknown", "domains", "hashes", "url analysis", "unknown aaaa", "script domains", "certificate", "game", "servers", "unofficial", "settings", "public", "endpoints", "currently", "game servers", "current", "meta name", "robots content", "x ua", "ieedge chrome1", "incapsula", "request", "role title", "related pulses", "domain v", "url indicator", "nameilname", "ascii text", "mitre att", "ck id", "ck matrix", "hybrid", "general", "local", "path", "click", "strings", "pe file", "high", "yara detections", "dynamic", "v hostname", "se fos", "include v", "domain url", "data", "alltypes", "win32mydoom oct", "trojan", "url add", "http", "related nids", "files location", "canada flag", "canada hostname", "canada unknown", "canada", "present aug", "name servers", "present sep", "aaaa", "present oct", "crlf line", "unicode text", "music", "suspicious", "bricked.wtf", "flag united", "google safe", "domain", "address domain", "united states", "filehashsha256", "hostname xn", "finland unknown", "filehashmd5", "indicators hong", "kong", "south korea", "present jun", "present mar", "present may", "olet", "cnr12", "tlsv1", "get updates", "upatre", "added active", "apple", "everest", "josh paul", "upadter", "convagent", "info stealing", "delete service", "phishing", "fraud", "social engineering", "gamer", "hacker", "adversaries", "icloud", "found", "gmt content", "error", "redacted for", "meta http", "content", "gmt server", "france unknown", "poland unknown", "content type", "xml title", "hostname add", "address", "location united", "life", "century link llc", "xfinity", "livesex", "domain add", "users", "show", "delete", "blocked by quad9", "showing", "record value", "location canada", "canada asn", "accept", "cookie", "macbook", "ipv4 add", "america flag", "america asn", "asn as714", "less", "woodynet", "next associated", "status", "exclude sugges", "ip related", "t1027.013" ], "references": [ "https://www.jmtstudios.org/farewell/", "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw", "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system", "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html", "ConventionEngine_Term_Dropbox \u2022 Dropbox", "http://api.jmtstudios.org/", "bricked.wtf", "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com", "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com", "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/", "https://forwardemail.net/es/blog/open-source/apple-email-clients", "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud", "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link", "http://www.visitbooker.com/Dropbox-07/index.htm", "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/", "Appears to be closely associated with close relative and initial victim of attack.", "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party." ], "public": 1, "adversary": "", "targeted_countries": [ "Hong Kong", "United States of America" ], "malware_families": [ { "id": "Win.Malware.Convagent-9981433-0", "display_name": "Win.Malware.Convagent-9981433-0", "target": null }, { "id": "Upadter", "display_name": "Upadter", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6996, "FileHash-MD5": 281, "FileHash-SHA1": 220, "FileHash-SHA256": 2673, "domain": 1747, "email": 24, "hostname": 2803, "SSLCertFingerprint": 3 }, "indicator_count": 14747, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "157 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "688716977e80a4274f2eafa9", "name": "LeadIQ | The Smart B2B Prospecting Platform | Malware Packed | Agent Tesla & more", "description": "Found in Bot joining Pulse.", "modified": "2025-08-27T06:03:05.020000", "created": "2025-07-28T06:20:07.660000", "tags": [ "present jul", "united", "entries", "search", "moved", "ip address", "creation date", "record value", "date", "showing", "body", "meta", "passive dns", "next associated", "win32spigot apr", "title error", "ipv4 add", "pulse pulses", "urls", "files", "adaptivebee", "worm", "win32", "urls show", "date checked", "url hostname", "server response", "google safe", "results jul", "location united", "asn asnone", "nameservers", "less whois", "registrar", "csc corporate", "status", "servers", "name servers", "hostname", "hostname add", "a domains", "script urls", "unknown aaaa", "technology one", "script script", "certificate", "null", "trojan", "twitter", "domain", "files ip", "address domain", "ip related", "pulses otx", "virtool", "http", "present jun", "present may", "pulse submit", "url analysis", "reverse dns", "australia asn", "as55532 squiz", "dns resolutions", "overview ip", "address", "ipv4", "iocs", "data upload", "extraction", "ided iocs", "failed", "shaw", "ail tvnas", "rl irl", "domain add", "ostname add", "verdict", "show", "types", "type", "indicator data", "searc type", "a indicator", "data", "select across", "all pages", "domain domain", "checked url", "hostname server", "response ip", "address google", "safe browsing", "msie", "chrome", "present dec", "base", "read c", "port", "destination", "delete", "copy", "write", "memcommit", "cryptexportkey", "invalid pointer", "writeconsolea", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "spawns", "defense evasion", "t1480 execution", "signing defense", "copy md5", "copy sha1", "copy sha256", "sha1", "sha256", "pattern match", "size", "ascii text", "crlf line", "mitre att", "error", "click", "hybrid", "local", "path", "starfield", "strings", "refresh", "tools", "onload", "span", "form", "adversaries", "windows nt", "generic http", "exe upload", "inbound", "outbound", "yara detections", "malware", "expiration date", "whois show", "name andrew", "bauer name", "div id", "beginstring", "beginerror", "script", "general", "cloud", "find", "footer", "ninite feb", "telper", "ninite mar", "ninite apr", "trojandropper", "mtb mar", "url https", "general full", "security tls", "software", "resource hash", "protocol h2", "frankfurt", "main", "germany", "input", "skype", "opciones", "july", "es form", "dom name", "post https", "imagen", "microsoft", "iniciar sesin", "value", "variables", "config", "debug", "loader", "geturl", "b function", "addlistener", "proof", "amazon02", "dk summary", "amazon rsa", "september", "browsing", "resource", "asn16509", "name value", "queueprogress", "timestamp input", "status actions" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 487, "FileHash-SHA1": 461, "URL": 10732, "domain": 1672, "email": 6, "hostname": 3039, "FileHash-SHA256": 2569, "SSLCertFingerprint": 7 }, "indicator_count": 18973, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "235 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "688343b9e60e8693f50e515f", "name": "Cycbot & worse - Palantir Monitoring Target/s", "description": "Palantir \u2022 Gotham \u2022 Foundry Top tier sells tools used to monitor, harass, smear , invoke fear, even \u2018kill\u2019. Used by military., too many partners to name (includes the entire government., heavy military, NSA use) of course Twitter, Apple Facebook, Pegasus related, possibly Paragon if what I\u2019ve read and researched is true. *There are 188 Palantir Foundry links in this pulse. ||\nMonitored target || Apparently ,\u2018tool\u2019 is weaponized against civilians for unknown and unwarranted purposes. || Lofty and unclear how or why a manner of death of target was predicted and posted online 12 years ago. || More research is needed.\n\nMalware named was found in research. \n\n #targeted #rip #palantir #foundry #gotham #twitter #techbromafia #silencing #overreach #quasi_gov #ongoing #active #moved #dangerous", "modified": "2025-08-24T06:01:34.920000", "created": "2025-07-25T08:43:37.734000", "tags": [ "status", "united", "unknown ns", "passive dns", "urls", "creation date", "search", "emails", "date", "expiration date", "tcp include", "top source", "top destination", "show", "source source", "data upload", "extraction", "showing", "moved", "certificate", "ip address", "domain", "body", "present jul", "present jun", "present aug", "present sep", "trojan", "name servers", "twitter", "vtflooder", "foundry", "virustotal", "gotham", "palantir", "tools", "destination", "port", "msie", "windows nt", "unknown", "read c", "etpro trojan", "malware", "copy", "write", "infostealer", "possible", "virustotal", "copyleft", "present jan", "entries", "next associated", "ipv4 add", "pulse submit", "url analysis", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "spawns", "defense evasion", "t1480 execution", "discovery att", "hostname add", "files", "copy md5", "copy sha1", "copy sha256", "sha1", "sha256", "ascii text", "mitre att", "pattern match", "show technique", "null", "refresh", "span", "hybrid", "general", "local", "path", "click", "strings", "error", "look", "verify", "restart", "se extri", "referen", "etpro tr", "virtool", "referencec", "failed", "se extra", "eanioae", "include review", "exclude sugges", "includec review", "exclude", "suggest data", "open ports", "reverse dns", "location united", "america flag", "boardman", "t1045", "ck ids", "packing", "t1060", "run keys", "startup", "folder", "t1057", "discovery", "t1071", "value emails", "name domain", "org microsoft", "microsoft way", "city redmond", "country us", "dnssec", "t1012", "t1047", "instrumentation", "t1053", "taskjob", "spyware", "source", "signing defense", "size", "meta", "onload", "dynamicloader", "unicode text", "crlf line", "utf8", "medium", "write c", "default", "delphi", "win32", "code", "stream", "next", "akamai rank", "show process", "prefetch2", "dns server", "network traffic", "virus", "monitored target", "tofsee", "generic http", "exe upload", "inbound", "outbound", "delete", "yara detections", "markus", "flowid22101", "pixelevtid11771", "dvid", "urls show", "date checked", "188 palantir results", "adversaries", "development att", "ssl certificate", "flag", "stop", "facebook", "4328", "5943", "stealer", "unknown aaaa", "present may", "domain add", "hyundaitx", "twitter", "monitored tsara", "brashears", "apple", "ios", "remote", "cycbot", "maudio fw", "heur", "productversion", "fileversion", "maudio firewire" ], "references": [ "palantirfoundry.com \u2022 https://edenglobalpartners.palantirfoundry.com/", "247seekscenter.com \u2022 ns-1986.awsdns-56.co.uk: | 365-notifcation.com", "ETPRO TROJAN Win32/Oderoor Checkin \u2022 ET INFO DYNAMIC_DNS Query to *.dyndns. Domain", "Domain ET WEB_CLIENT SUSPICOUS Possible automated connectivity check (www.google.com)", "ET POLICY Internal Host Retrieving External IP via ipchicken.com - Possible Infection", "platform.twitter.co \u2022 rm.twitter.co \u2022 upload.twitter.co \u2022 http://2fsyndication.twitter.co/", "http://legal.twitter.co \u2022 http://mobile.twitter.co/", "ec2-44-228-94-74.us-west-2.compute.amazonaws.com \u2022 defender.palantirfoundry.com", "https://embaxter.palantirfoundry.com \u2022 https://amgistudios.palantirfoundry.com", "https://ametrine-containers.palantirfoundry.com \u2022 https://amfp.palantirfoundry.com", "https://ameteklms.palantirfoundry.com \u2022 https://ametrine-compute.palantirfoundry.com", "https://amiable-constellation.palantirfoundry.com \u2022 https://amplifi.palantirfoundry.com", "https://oscar.palantirfoundry.com/ \u2022 https://replica.palantirfoundry.com/", "https://statemed.palantirgov.com/workspace/settings/notifications \u2022 https://cchbc.palantirfoundry.com", "https://test-1.washington.palantircloud.com \u2022 https://tarn.palantirgov.com \u2022 https://stateplatform.palantirgov.com", "https://imperium-dev-1.palantircloud.com \u2022 https://hii.palantirgov.com \u2022 https://genoa.washington.palantircloud.com", "tsystems.palantirfoundry.com \u2022 https://statemed.palantirgov.com \u2022 https://statecms.palantirgov.com", "https://replica.palantirfoundry.com/ \u2022 https://spacejam.palantirfoundry.com/ \u2022", "https://pl.pornhub.mrst.one/ \u2022 hotamateurpornsite.xxx \u2022 squirting.porn \u2022 https://de-pornhub.mrst.one/", "Hostname: hcl-dna-sandbox.palantirfoundry.com", "https://www.hyundaitx.com/", "ETPRO TROJAN Win32/Tofsee.AX google.com connectivity check", "https://remote.downloadnow-1.com/", "Alerts: injection_runpe deletes_self persistence_autorun stealth_file antivirus_virustotal infostealer_ftp", "Alerts: infostealer_mail network_smtp persistence_ads recon_programs injection", "Monitored Target - Spawned process \"iexplore.exe\" w/commandline \"SCODEF:5860 CREDAT:275457 /prefetch:2\" (Show Process) source", "Monitored Target: Queries DNS server details \"www.hyundaitx.com\" source Network Traffic T1071.004", "Palantir/ Hyuandi coexist | Confirmed Targets transportation was a Hyuandi SUV |", "ipad-steals-app-ideas_1_.jpg - MD5 6dd66b729a649dec250b24533a58a996" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Vtflooder-9783271-0", "display_name": "Win.Malware.Vtflooder-9783271-0", "target": null }, { "id": "Trojan.Kazy-237", "display_name": "Trojan.Kazy-237", "target": null }, { "id": "Trojan.Vundo-5335", "display_name": "Trojan.Vundo-5335", "target": null }, { "id": "Generic31.BKFG", "display_name": "Generic31.BKFG", "target": null }, { "id": "Win.Packed.Krucky-6941986-0", "display_name": "Win.Packed.Krucky-6941986-0", "target": null }, { "id": "ALF:HSTR:KrunchyMalPacker!MTB", "display_name": "ALF:HSTR:KrunchyMalPacker!MTB", "target": null }, { "id": "Win.Trojan.Agent-920890", "display_name": "Win.Trojan.Agent-920890", "target": null }, { "id": "Win.Trojan.Jorik-10365", "display_name": "Win.Trojan.Jorik-10365", "target": null }, { "id": "Trojan.Adload-2492", "display_name": "Trojan.Adload-2492", "target": null }, { "id": "Trojan.Spy-59563", "display_name": "Trojan.Spy-59563", "target": null }, { "id": "Ransom:Win32/Cryptor", "display_name": "Ransom:Win32/Cryptor", "target": "/malware/Ransom:Win32/Cryptor" }, { "id": "Win32/Blacked", "display_name": "Win32/Blacked", "target": null }, { "id": "Win.Trojan.Cycbot-764", "display_name": "Win.Trojan.Cycbot-764", "target": null }, { "id": "Trojan.VB-47534", "display_name": "Trojan.VB-47534", "target": null }, { "id": "Backdoor:Win32/Drixed.J ,", "display_name": "Backdoor:Win32/Drixed.J ,", "target": "/malware/Backdoor:Win32/Drixed.J ," }, { "id": "ALF:HeraklezEval:PWS:Win32/Ldpinch!rfn", "display_name": "ALF:HeraklezEval:PWS:Win32/Ldpinch!rfn", "target": null }, { "id": "ALF:HeraklezEval:PWS:Win32/Ldpinch!rfn", "display_name": "ALF:HeraklezEval:PWS:Win32/Ldpinch!rfn", "target": null }, { "id": "Malware Tool", "display_name": "Malware Tool", "target": null }, { "id": "Palantir Spyware", "display_name": "Palantir Spyware", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "TA0030", "name": "Defense Evasion", "display_name": "TA0030 - Defense Evasion" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1589", "name": "Gather Victim Identity Information", "display_name": "T1589 - Gather Victim Identity Information" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1003.008", "name": "/etc/passwd and /etc/shadow", "display_name": "T1003.008 - /etc/passwd and /etc/shadow" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" }, { "id": "T1088", "name": "Bypass User Account Control", "display_name": "T1088 - Bypass User Account Control" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4203, "domain": 1218, "email": 9, "hostname": 2006, "FileHash-SHA256": 2740, "FileHash-MD5": 424, "FileHash-SHA1": 419, "SSLCertFingerprint": 12 }, "indicator_count": 11031, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "238 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6882e2a53af80b1af320079d", "name": "VirusTotal - Palantir- KrunchyMalPacker | Vflooder", "description": "-> Hostname: \u2022 edenglobalpartners.palantirfoundry.com\n\u2022 c.twitterintegration.com\n*Trojan:Win32/Vflooder.E\nIDS Detections:\n- Win32/Flooder.Agent.NAS CnC Domain in DNS Lookup\n\u2022 Virus Total vtapi DOS\n\u2022 Generic HTTP EXE Upload Inbound\n\u2022 Observed Suspicious UA (Mozilla/5.0)\n\u2022 Generic HTTP EXE Upload Outbound || \n*ALF:HSTR:KrunchyMalPacker!MTB\t\n IDS Detections\n-Win32/Vflooder.B Checkin\n\u2022 TLS Handshake Failure\nYara Detections: \nkkrunchy023alpha2\nAlerts:\n\u2022 static_pe_anomaly\n\u2022 suricata_alert\n\u2022 dynamic_function_loading\n\u2022 network_cnc_https_generic\n\u2022 reads_self\n\u2022 network_cnc_http\n\u2022 network_http\n\u2022 packer_unknown_pe_section_name\n\u2022 packer_entropy\n\u2022 injection_rwx ||\n__________\nIP\u2019s Contacted:\n\u2022 34.54.88.138\n\u2022 162.159.140.229\nDomains Contacted\n\u2022 twitter.com (SBKA - Palantir?)\n\u2022 www.virustotal.com\n#botnetresulttesting #virustotal_unsafe #vtflooder #palantir #twitter #gotham foundry #brian_sabey_has_a_new_toy #targeting #tsara_brashears", "modified": "2025-08-24T01:04:01.801000", "created": "2025-07-25T01:49:25.325000", "tags": [ "windows nt", "dynamicloader", "contentlength", "tls handshake", "failure", "host", "show", "medium", "search", "entries", "copy", "write", "malware", "generic http", "exe upload", "inbound", "outbound", "domain", "trojan", "u0019", "trojandropper", "backdoor", "mtb jul", "united", "passive dns", "open ports", "win32berbew jul", "ipv4 add", "present jul", "present jun", "cname", "present aug", "present sep", "status", "certificate", "date", "twitter", "unknown ns", "name servers", "servers", "showing", "urls", "creation date" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1903, "hostname": 806, "FileHash-SHA256": 1594, "FileHash-MD5": 264, "FileHash-SHA1": 297, "SSLCertFingerprint": 1, "domain": 515, "email": 5 }, "indicator_count": 5385, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "238 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://dev.p2p.ihost.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://dev.p2p.ihost.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776638940.5054324 }