{ "type": "URL", "indicator": "https://dghfhfgjfhjghj6699.net/help.php", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://dghfhfgjfhjghj6699.net/help.php", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4140275160, "indicator": "https://dghfhfgjfhjghj6699.net/help.php", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "692fdb10627488a886ec6f8f", "name": "Apple \u2022 Gamarue | Fully compromised iOS | Ahmanm , Tulach , Sabey and ?", "description": "Device testing. Calling Apple : scam pop ups, apple advisors ,emails, screen shares. Calling : State and Government offices : scam receptionists , investigators, dropped calls, connect without ringing. Calling businesses: routed to scam to scammers. | Apps : all fake. random data. \n\nAligned with same attackers listed. Indicator deletion and attorney caught hijacking. \n\nCannot open LevelBlue Indicators on affected. device. Device can create a mini pulse. \n,", "modified": "2026-01-02T05:01:36.144000", "created": "2025-12-03T06:39:12.995000", "tags": [ "united", "servers", "data upload", "extraction", "sc data", "boot", "techniques none", "modules", "logon autostart", "execu", "privilege", "process", "evasion", "search", "info", "techniques low", "execution flow", "injection", "apple", "rootkit", "hybrid analysis", "click", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "ip address", "process details", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "spawns", "command", "found", "defense evasion", "a061s.exe", "tulach", "christopher p ahmanm", "passive dns", "urls", "url add", "http", "files domain", "files related", "pulses otx", "virustotal", "foundry", "helix", "mapkit", "hacking", "denver", "retaliation", "redirect", "no server", "reroute", "scammers", "coconut island", "brain sabey", "dns requests", "domain address", "contacted hosts", "t1480 execution", "file defense" ], "references": [ "getsupport.apple.com\t \u2022 apple.com", "Matches rule Registry Modification to Hidden File Extension by frack113", "Matches rule Msiexec Initiated Connection by frack113", "Matches rule Creation of an Executable by an Executable by frack113", "Matches rule CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)", "Matches rule SERVER-OTHER Squid HTTP Vary response header denial of service attempt", "Tulach \u2022 114.114.114.114", "http://foundry2-lbl.dvr.dn2.n-helix.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Trojan/Win32.Gamarue.C1976125", "display_name": "Trojan/Win32.Gamarue.C1976125", "target": null }, { "id": "Trojan.GenericKDZ.93839", "display_name": "Trojan.GenericKDZ.93839", "target": null }, { "id": "Tulach Malware", "display_name": "Tulach Malware", "target": null }, { "id": "Trojan.MyDoom/Mudrop", "display_name": "Trojan.MyDoom/Mudrop", "target": null }, { "id": "Trojan.Win.Small", "display_name": "Trojan.Win.Small", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1401", "name": "Device Administrator Permissions", "display_name": "T1401 - Device Administrator Permissions" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1408", "name": "Disguise Root/Jailbreak Indicators", "display_name": "T1408 - Disguise Root/Jailbreak Indicators" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "display_name": "T1036.004 - Masquerade Task or Service" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "TA0008", "name": "Lateral Movement", "display_name": "TA0008 - Lateral Movement" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1529", "name": "System Shutdown/Reboot", "display_name": "T1529 - System Shutdown/Reboot" }, { "id": "T1542.003", "name": "Bootkit", "display_name": "T1542.003 - Bootkit" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1454", "name": "Malicious SMS Message", "display_name": "T1454 - Malicious SMS Message" } ], "industries": [ "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 413, "FileHash-MD5": 14, "FileHash-SHA1": 4, "URL": 1321, "domain": 219, "email": 3, "FileHash-SHA256": 696 }, "indicator_count": 2670, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "149 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68efedf37890e1b32d60eb55", "name": "Assurant Insurance \u2022 Injection, Crypt , ProRat , Tofsee and a version Mirai affecting Assurant , T-Mobile & me", "description": "Injection, Crypt , ProRat , Tofsee and a version Mirai affecting Assurant and T-Mobile and me. There is truth to the tip I received. This is the 3rd time all of my networks went down , even my phone disconnected and phone number changed temporarily. \n\nJosh T found again. Online profile possibly staged. Stated he is a gamer , self trained in Lua, , CS major in Canada. He is a malicious hacker and streamer and probably an entity. Eric _E iCloud related. Found DoD & Mil hackers related. I haven\u2019t taken the time to authenticate.. Very malicious and talented hackers attacking. I can\u2019t ignore the .mil and DoD items that populated in previous pulses. \n \n[OTX Auto Populated-Trojan-gen-Glupteba, Danabot, Prorat, and other names have been identified as the names of those affected by the latest cyber-attack on the internet.]", "modified": "2025-11-14T17:02:12.746000", "created": "2025-10-15T18:54:43.205000", "tags": [ "ipv4", "email abuse", "email info", "active related", "passive dns", "files related", "related tags", "none google", "external", "present aug", "present sep", "present jun", "present jul", "present oct", "ipv4 https", "crosscountry", "mortgagefamily", "port", "read c", "destination", "high", "intel", "ms windows", "stream", "explorer", "write", "malware", "united", "asnone", "et trojan", "windows nt", "suspicious", "win64", "zune", "et", "netherlands", "segoe ui", "found content", "length", "content type", "ipv4 add", "pulse pulses", "urls", "error", "ip address", "pulse submit", "url analysis", "files", "domain", "ip related", "pulses none", "learn", "ck id", "name tactics", "informative", "adversaries", "spawns", "command", "found", "defense evasion", "ssl certificate", "execution", "path", "secure", "show technique", "mitre att", "ck matrix", "maxage31536000", "expirestue", "brand", "microsoft edge", "date", "cookie", "sha1", "ascii text", "sha256", "pattern match", "hybrid", "local", "click", "strings", "show process", "flag", "programfiles", "command decode", "comspec", "model", "general", "starfield", "encrypt", "iframe", "development att", "backdoor", "win32", "reverse dns", "location india", "india asn", "trojan", "mtb win32" ], "references": [ "Assurant \u2022 https://otx.alienvault.com/indicator/domain/assurant.com", "20.50.2.51 \u2022 https://hybrid-analysis.com/sample/903834f3326ee0dccde4c134fd51799ea728e7200e6b1d699a0500e6de276f79/68efd2a168a5e234250286cf", "Crypt3.BOJE \u2022 https://otx.alienvault.com/indicator/file/b7a2657fc02c6dea2c4f99c80c6a938d3b6b2b76767d27ff837276ca46851984", "p2d.josht.ca \u2022 test.josht.ca \u2022 josht.ca \u2022 dev.josht.ca \u2022 pma.josht.ca \u2022 staging.josht.ca \u2022 http://dev.josht.ca/", "http://josht.ca/portfolio/ \u2022 https://sa.josht.ca/ \u2022 https://test.josht.ca/ \u2022 https://p2d.josht.ca/api/depots/info/?depot=", "http://p2d.josht.ca/ \u2022 http://p2d.josht.ca/assets/content-delivery/depots/download/", "you.are.poor.i.got.trap.money?", "Assurant \u2022 BC.Win.Packer.Troll-11 \u2022 https://otx.alienvault.com/indicator/domain/assurant.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "United Kingdom of Great Britain and Northern Ireland", "Germany", "Romania", "South Africa" ], "malware_families": [ { "id": "BC.Win.Packer.Troll-11", "display_name": "BC.Win.Packer.Troll-11", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Crypt3.BOJE", "display_name": "Crypt3.BOJE", "target": null }, { "id": "Crypt3.BXMJ", "display_name": "Crypt3.BXMJ", "target": null }, { "id": "Trojan:Win32/Glupteba.OV!MTB", "display_name": "Trojan:Win32/Glupteba.OV!MTB", "target": "/malware/Trojan:Win32/Glupteba.OV!MTB" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "ProRat", "display_name": "ProRat", "target": null }, { "id": "Backdoor:Win32/Prorat.L", "display_name": "Backdoor:Win32/Prorat.L", "target": "/malware/Backdoor:Win32/Prorat.L" }, { "id": "Win32:Malware-gen", "display_name": "Win32:Malware-gen", "target": null }, { "id": "Win32:Trojan", "display_name": "Win32:Trojan", "target": null }, { "id": "DanaBot", "display_name": "DanaBot", "target": null }, { "id": "Atros3.AHFB", "display_name": "Atros3.AHFB", "target": null }, { "id": "Crypt5.BBYH", "display_name": "Crypt5.BBYH", "target": null }, { "id": "Crypt4.AHSW", "display_name": "Crypt4.AHSW", "target": null }, { "id": "Crypt3.COIZ", "display_name": "Crypt3.COIZ", "target": null }, { "id": "Crypt3.CMTM", "display_name": "Crypt3.CMTM", "target": null }, { "id": "Crypt3.CKTO", "display_name": "Crypt3.CKTO", "target": null }, { "id": "Crypt3.BXVC", "display_name": "Crypt3.BXVC", "target": null }, { "id": "Crypt3.BXGR", "display_name": "Crypt3.BXGR", "target": null }, { "id": "Crypt3.BXVC", "display_name": "Crypt3.BXVC", "target": null }, { "id": "Crypt3.BOQD", "display_name": "Crypt3.BOQD", "target": null }, { "id": "Crypt3.BLXP", "display_name": "Crypt3.BLXP", "target": null }, { "id": "Crypt3.BOIU", "display_name": "Crypt3.BOIU", "target": null }, { "id": "Inject2.BHBW", "display_name": "Inject2.BHBW", "target": null }, { "id": "Inject2.BIVE", "display_name": "Inject2.BIVE", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" } ], "industries": [ "Telecommunications", "Insurance" ], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10010, "FileHash-MD5": 150, "FileHash-SHA1": 144, "FileHash-SHA256": 2869, "domain": 2046, "email": 6, "hostname": 3705, "SSLCertFingerprint": 19 }, "indicator_count": 18949, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "197 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68efee5ba882db423d3bad8f", "name": "Assurant & T-Mobile BLYP Checkin ET MALWARE TROJAN \u2022 Kryptic", "description": "", "modified": "2025-11-14T17:02:12.746000", "created": "2025-10-15T18:56:27.950000", "tags": [ "ipv4", "email abuse", "email info", "active related", "passive dns", "files related", "related tags", "none google", "external", "present aug", "present sep", "present jun", "present jul", "present oct", "ipv4 https", "crosscountry", "mortgagefamily", "port", "read c", "destination", "high", "intel", "ms windows", "stream", "explorer", "write", "malware", "united", "asnone", "et trojan", "windows nt", "suspicious", "win64", "zune", "et", "netherlands", "segoe ui", "found content", "length", "content type", "ipv4 add", "pulse pulses", "urls", "error", "ip address", "pulse submit", "url analysis", "files", "domain", "ip related", "pulses none", "learn", "ck id", "name tactics", "informative", "adversaries", "spawns", "command", "found", "defense evasion", "ssl certificate", "execution", "path", "secure", "show technique", "mitre att", "ck matrix", "maxage31536000", "expirestue", "brand", "microsoft edge", "date", "cookie", "sha1", "ascii text", "sha256", "pattern match", "hybrid", "local", "click", "strings", "show process", "flag", "programfiles", "command decode", "comspec", "model", "general", "starfield", "encrypt", "iframe", "development att", "backdoor", "win32", "reverse dns", "location india", "india asn", "trojan", "mtb win32" ], "references": [ "Assurant \u2022 https://otx.alienvault.com/indicator/domain/assurant.com", "20.50.2.51 \u2022 https://hybrid-analysis.com/sample/903834f3326ee0dccde4c134fd51799ea728e7200e6b1d699a0500e6de276f79/68efd2a168a5e234250286cf", "Crypt3.BOJE \u2022 https://otx.alienvault.com/indicator/file/b7a2657fc02c6dea2c4f99c80c6a938d3b6b2b76767d27ff837276ca46851984", "p2d.josht.ca \u2022 test.josht.ca \u2022 josht.ca \u2022 dev.josht.ca \u2022 pma.josht.ca \u2022 staging.josht.ca \u2022 http://dev.josht.ca/", "http://josht.ca/portfolio/ \u2022 https://sa.josht.ca/ \u2022 https://test.josht.ca/ \u2022 https://p2d.josht.ca/api/depots/info/?depot=", "http://p2d.josht.ca/ \u2022 http://p2d.josht.ca/assets/content-delivery/depots/download/", "you.are.poor.i.got.trap.money?", "Assurant \u2022 BC.Win.Packer.Troll-11 \u2022 https://otx.alienvault.com/indicator/domain/assurant.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "United Kingdom of Great Britain and Northern Ireland", "Germany", "Romania", "South Africa" ], "malware_families": [ { "id": "BC.Win.Packer.Troll-11", "display_name": "BC.Win.Packer.Troll-11", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Crypt3.BOJE", "display_name": "Crypt3.BOJE", "target": null }, { "id": "Crypt3.BXMJ", "display_name": "Crypt3.BXMJ", "target": null }, { "id": "Trojan:Win32/Glupteba.OV!MTB", "display_name": "Trojan:Win32/Glupteba.OV!MTB", "target": "/malware/Trojan:Win32/Glupteba.OV!MTB" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "ProRat", "display_name": "ProRat", "target": null }, { "id": "Backdoor:Win32/Prorat.L", "display_name": "Backdoor:Win32/Prorat.L", "target": "/malware/Backdoor:Win32/Prorat.L" }, { "id": "Win32:Malware-gen", "display_name": "Win32:Malware-gen", "target": null }, { "id": "Win32:Trojan", "display_name": "Win32:Trojan", "target": null }, { "id": "DanaBot", "display_name": "DanaBot", "target": null }, { "id": "Atros3.AHFB", "display_name": "Atros3.AHFB", "target": null }, { "id": "Crypt5.BBYH", "display_name": "Crypt5.BBYH", "target": null }, { "id": "Crypt4.AHSW", "display_name": "Crypt4.AHSW", "target": null }, { "id": "Crypt3.COIZ", "display_name": "Crypt3.COIZ", "target": null }, { "id": "Crypt3.CMTM", "display_name": "Crypt3.CMTM", "target": null }, { "id": "Crypt3.CKTO", "display_name": "Crypt3.CKTO", "target": null }, { "id": "Crypt3.BXVC", "display_name": "Crypt3.BXVC", "target": null }, { "id": "Crypt3.BXGR", "display_name": "Crypt3.BXGR", "target": null }, { "id": "Crypt3.BXVC", "display_name": "Crypt3.BXVC", "target": null }, { "id": "Crypt3.BOQD", "display_name": "Crypt3.BOQD", "target": null }, { "id": "Crypt3.BLXP", "display_name": "Crypt3.BLXP", "target": null }, { "id": "Crypt3.BOIU", "display_name": "Crypt3.BOIU", "target": null }, { "id": "Inject2.BHBW", "display_name": "Inject2.BHBW", "target": null }, { "id": "Inject2.BIVE", "display_name": "Inject2.BIVE", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" } ], "industries": [ "Telecommunications", "Insurance" ], "TLP": "white", "cloned_from": "68efedf37890e1b32d60eb55", "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10010, "FileHash-MD5": 150, "FileHash-SHA1": 144, "FileHash-SHA256": 2869, "domain": 2046, "email": 6, "hostname": 3705, "SSLCertFingerprint": 19 }, "indicator_count": 18949, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "197 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68eff0848071708f9ee0c0bd", "name": "Gamarue \u2022 G3nasom\u2022 Simda\u2022 Ganelp affecting Assurant and T-Mobile Part 3", "description": "", "modified": "2025-11-14T17:02:12.746000", "created": "2025-10-15T19:05:40.466000", "tags": [ "ipv4", "email abuse", "email info", "active related", "passive dns", "files related", "related tags", "none google", "external", "present aug", "present sep", "present jun", "present jul", "present oct", "ipv4 https", "crosscountry", "mortgagefamily", "port", "read c", "destination", "high", "intel", "ms windows", "stream", "explorer", "write", "malware", "united", "asnone", "et trojan", "windows nt", "suspicious", "win64", "zune", "et", "netherlands", "segoe ui", "found content", "length", "content type", "ipv4 add", "pulse pulses", "urls", "error", "ip address", "pulse submit", "url analysis", "files", "domain", "ip related", "pulses none", "learn", "ck id", "name tactics", "informative", "adversaries", "spawns", "command", "found", "defense evasion", "ssl certificate", "execution", "path", "secure", "show technique", "mitre att", "ck matrix", "maxage31536000", "expirestue", "brand", "microsoft edge", "date", "cookie", "sha1", "ascii text", "sha256", "pattern match", "hybrid", "local", "click", "strings", "show process", "flag", "programfiles", "command decode", "comspec", "model", "general", "starfield", "encrypt", "iframe", "development att", "backdoor", "win32", "reverse dns", "location india", "india asn", "trojan", "mtb win32" ], "references": [ "Assurant \u2022 https://otx.alienvault.com/indicator/domain/assurant.com", "20.50.2.51 \u2022 https://hybrid-analysis.com/sample/903834f3326ee0dccde4c134fd51799ea728e7200e6b1d699a0500e6de276f79/68efd2a168a5e234250286cf", "Crypt3.BOJE \u2022 https://otx.alienvault.com/indicator/file/b7a2657fc02c6dea2c4f99c80c6a938d3b6b2b76767d27ff837276ca46851984", "p2d.josht.ca \u2022 test.josht.ca \u2022 josht.ca \u2022 dev.josht.ca \u2022 pma.josht.ca \u2022 staging.josht.ca \u2022 http://dev.josht.ca/", "http://josht.ca/portfolio/ \u2022 https://sa.josht.ca/ \u2022 https://test.josht.ca/ \u2022 https://p2d.josht.ca/api/depots/info/?depot=", "http://p2d.josht.ca/ \u2022 http://p2d.josht.ca/assets/content-delivery/depots/download/", "you.are.poor.i.got.trap.money?", "Assurant \u2022 BC.Win.Packer.Troll-11 \u2022 https://otx.alienvault.com/indicator/domain/assurant.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "United Kingdom of Great Britain and Northern Ireland", "Germany", "Romania", "South Africa" ], "malware_families": [ { "id": "BC.Win.Packer.Troll-11", "display_name": "BC.Win.Packer.Troll-11", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Crypt3.BOJE", "display_name": "Crypt3.BOJE", "target": null }, { "id": "Crypt3.BXMJ", "display_name": "Crypt3.BXMJ", "target": null }, { "id": "Trojan:Win32/Glupteba.OV!MTB", "display_name": "Trojan:Win32/Glupteba.OV!MTB", "target": "/malware/Trojan:Win32/Glupteba.OV!MTB" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "ProRat", "display_name": "ProRat", "target": null }, { "id": "Backdoor:Win32/Prorat.L", "display_name": "Backdoor:Win32/Prorat.L", "target": "/malware/Backdoor:Win32/Prorat.L" }, { "id": "Win32:Malware-gen", "display_name": "Win32:Malware-gen", "target": null }, { "id": "Win32:Trojan", "display_name": "Win32:Trojan", "target": null }, { "id": "DanaBot", "display_name": "DanaBot", "target": null }, { "id": "Atros3.AHFB", "display_name": "Atros3.AHFB", "target": null }, { "id": "Crypt5.BBYH", "display_name": "Crypt5.BBYH", "target": null }, { "id": "Crypt4.AHSW", "display_name": "Crypt4.AHSW", "target": null }, { "id": "Crypt3.COIZ", "display_name": "Crypt3.COIZ", "target": null }, { "id": "Crypt3.CMTM", "display_name": "Crypt3.CMTM", "target": null }, { "id": "Crypt3.CKTO", "display_name": "Crypt3.CKTO", "target": null }, { "id": "Crypt3.BXVC", "display_name": "Crypt3.BXVC", "target": null }, { "id": "Crypt3.BXGR", "display_name": "Crypt3.BXGR", "target": null }, { "id": "Crypt3.BXVC", "display_name": "Crypt3.BXVC", "target": null }, { "id": "Crypt3.BOQD", "display_name": "Crypt3.BOQD", "target": null }, { "id": "Crypt3.BLXP", "display_name": "Crypt3.BLXP", "target": null }, { "id": "Crypt3.BOIU", "display_name": "Crypt3.BOIU", "target": null }, { "id": "Inject2.BHBW", "display_name": "Inject2.BHBW", "target": null }, { "id": "Inject2.BIVE", "display_name": "Inject2.BIVE", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" } ], "industries": [ "Telecommunications", "Insurance" ], "TLP": "white", "cloned_from": "68efee5ba882db423d3bad8f", "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10010, "FileHash-MD5": 150, "FileHash-SHA1": 144, "FileHash-SHA256": 2869, "domain": 2046, "email": 6, "hostname": 3705, "SSLCertFingerprint": 19 }, "indicator_count": 18949, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "197 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "Matches rule Registry Modification to Hidden File Extension by frack113", "Matches rule CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)", "p2d.josht.ca \u2022 test.josht.ca \u2022 josht.ca \u2022 dev.josht.ca \u2022 pma.josht.ca \u2022 staging.josht.ca \u2022 http://dev.josht.ca/", "Matches rule Msiexec Initiated Connection by frack113", "getsupport.apple.com\t \u2022 apple.com", "http://p2d.josht.ca/ \u2022 http://p2d.josht.ca/assets/content-delivery/depots/download/", "http://foundry2-lbl.dvr.dn2.n-helix.com", "Assurant \u2022 BC.Win.Packer.Troll-11 \u2022 https://otx.alienvault.com/indicator/domain/assurant.com", "you.are.poor.i.got.trap.money?", "Assurant \u2022 https://otx.alienvault.com/indicator/domain/assurant.com", "Crypt3.BOJE \u2022 https://otx.alienvault.com/indicator/file/b7a2657fc02c6dea2c4f99c80c6a938d3b6b2b76767d27ff837276ca46851984", "Tulach \u2022 114.114.114.114", "Matches rule SERVER-OTHER Squid HTTP Vary response header denial of service attempt", "http://josht.ca/portfolio/ \u2022 https://sa.josht.ca/ \u2022 https://test.josht.ca/ \u2022 https://p2d.josht.ca/api/depots/info/?depot=", "Matches rule Creation of an Executable by an Executable by frack113", "20.50.2.51 \u2022 https://hybrid-analysis.com/sample/903834f3326ee0dccde4c134fd51799ea728e7200e6b1d699a0500e6de276f79/68efd2a168a5e234250286cf" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Inject2.bhbw", "Tofsee", "Crypt3.ckto", "Crypt3.coiz", "Crypt3.boje", "Win32:trojan", "Trojan:win32/glupteba.ov!mtb", "Crypt3.cmtm", "Atros3.ahfb", "Crypt4.ahsw", "Crypt3.blxp", "Trojan.generickdz.93839", "Crypt3.boiu", "Trojan.win.small", "Et", "Crypt3.bxvc", "Trojan.mydoom/mudrop", "Bc.win.packer.troll-11", "Inject2.bive", "Crypt5.bbyh", "Crypt3.bxgr", "Tulach malware", "Crypt3.bxmj", "Prorat", "Danabot", "Backdoor:win32/prorat.l", "Crypt3.boqd", "Trojan/win32.gamarue.c1976125", "Win32:malware-gen" ], "industries": [ "Insurance", "Telecommunications" ], "unique_indicators": 21854 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/dghfhfgjfhjghj6699.net", "whois": "http://whois.domaintools.com/dghfhfgjfhjghj6699.net", "domain": "dghfhfgjfhjghj6699.net", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "692fdb10627488a886ec6f8f", "name": "Apple \u2022 Gamarue | Fully compromised iOS | Ahmanm , Tulach , Sabey and ?", "description": "Device testing. Calling Apple : scam pop ups, apple advisors ,emails, screen shares. Calling : State and Government offices : scam receptionists , investigators, dropped calls, connect without ringing. Calling businesses: routed to scam to scammers. | Apps : all fake. random data. \n\nAligned with same attackers listed. Indicator deletion and attorney caught hijacking. \n\nCannot open LevelBlue Indicators on affected. device. Device can create a mini pulse. \n,", "modified": "2026-01-02T05:01:36.144000", "created": "2025-12-03T06:39:12.995000", "tags": [ "united", "servers", "data upload", "extraction", "sc data", "boot", "techniques none", "modules", "logon autostart", "execu", "privilege", "process", "evasion", "search", "info", "techniques low", "execution flow", "injection", "apple", "rootkit", "hybrid analysis", "click", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "ip address", "process details", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "spawns", "command", "found", "defense evasion", "a061s.exe", "tulach", "christopher p ahmanm", "passive dns", "urls", "url add", "http", "files domain", "files related", "pulses otx", "virustotal", "foundry", "helix", "mapkit", "hacking", "denver", "retaliation", "redirect", "no server", "reroute", "scammers", "coconut island", "brain sabey", "dns requests", "domain address", "contacted hosts", "t1480 execution", "file defense" ], "references": [ "getsupport.apple.com\t \u2022 apple.com", "Matches rule Registry Modification to Hidden File Extension by frack113", "Matches rule Msiexec Initiated Connection by frack113", "Matches rule Creation of an Executable by an Executable by frack113", "Matches rule CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)", "Matches rule SERVER-OTHER Squid HTTP Vary response header denial of service attempt", "Tulach \u2022 114.114.114.114", "http://foundry2-lbl.dvr.dn2.n-helix.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Trojan/Win32.Gamarue.C1976125", "display_name": "Trojan/Win32.Gamarue.C1976125", "target": null }, { "id": "Trojan.GenericKDZ.93839", "display_name": "Trojan.GenericKDZ.93839", "target": null }, { "id": "Tulach Malware", "display_name": "Tulach Malware", "target": null }, { "id": "Trojan.MyDoom/Mudrop", "display_name": "Trojan.MyDoom/Mudrop", "target": null }, { "id": "Trojan.Win.Small", "display_name": "Trojan.Win.Small", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1401", "name": "Device Administrator Permissions", "display_name": "T1401 - Device Administrator Permissions" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1408", "name": "Disguise Root/Jailbreak Indicators", "display_name": "T1408 - Disguise Root/Jailbreak Indicators" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "display_name": "T1036.004 - Masquerade Task or Service" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "TA0008", "name": "Lateral Movement", "display_name": "TA0008 - Lateral Movement" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1529", "name": "System Shutdown/Reboot", "display_name": "T1529 - System Shutdown/Reboot" }, { "id": "T1542.003", "name": "Bootkit", "display_name": "T1542.003 - Bootkit" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1454", "name": "Malicious SMS Message", "display_name": "T1454 - Malicious SMS Message" } ], "industries": [ "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 413, "FileHash-MD5": 14, "FileHash-SHA1": 4, "URL": 1321, "domain": 219, "email": 3, "FileHash-SHA256": 696 }, "indicator_count": 2670, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "149 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68efedf37890e1b32d60eb55", "name": "Assurant Insurance \u2022 Injection, Crypt , ProRat , Tofsee and a version Mirai affecting Assurant , T-Mobile & me", "description": "Injection, Crypt , ProRat , Tofsee and a version Mirai affecting Assurant and T-Mobile and me. There is truth to the tip I received. This is the 3rd time all of my networks went down , even my phone disconnected and phone number changed temporarily. \n\nJosh T found again. Online profile possibly staged. Stated he is a gamer , self trained in Lua, , CS major in Canada. He is a malicious hacker and streamer and probably an entity. Eric _E iCloud related. Found DoD & Mil hackers related. I haven\u2019t taken the time to authenticate.. Very malicious and talented hackers attacking. I can\u2019t ignore the .mil and DoD items that populated in previous pulses. \n \n[OTX Auto Populated-Trojan-gen-Glupteba, Danabot, Prorat, and other names have been identified as the names of those affected by the latest cyber-attack on the internet.]", "modified": "2025-11-14T17:02:12.746000", "created": "2025-10-15T18:54:43.205000", "tags": [ "ipv4", "email abuse", "email info", "active related", "passive dns", "files related", "related tags", "none google", "external", "present aug", "present sep", "present jun", "present jul", "present oct", "ipv4 https", "crosscountry", "mortgagefamily", "port", "read c", "destination", "high", "intel", "ms windows", "stream", "explorer", "write", "malware", "united", "asnone", "et trojan", "windows nt", "suspicious", "win64", "zune", "et", "netherlands", "segoe ui", "found content", "length", "content type", "ipv4 add", "pulse pulses", "urls", "error", "ip address", "pulse submit", "url analysis", "files", "domain", "ip related", "pulses none", "learn", "ck id", "name tactics", "informative", "adversaries", "spawns", "command", "found", "defense evasion", "ssl certificate", "execution", "path", "secure", "show technique", "mitre att", "ck matrix", "maxage31536000", "expirestue", "brand", "microsoft edge", "date", "cookie", "sha1", "ascii text", "sha256", "pattern match", "hybrid", "local", "click", "strings", "show process", "flag", "programfiles", "command decode", "comspec", "model", "general", "starfield", "encrypt", "iframe", "development att", "backdoor", "win32", "reverse dns", "location india", "india asn", "trojan", "mtb win32" ], "references": [ "Assurant \u2022 https://otx.alienvault.com/indicator/domain/assurant.com", "20.50.2.51 \u2022 https://hybrid-analysis.com/sample/903834f3326ee0dccde4c134fd51799ea728e7200e6b1d699a0500e6de276f79/68efd2a168a5e234250286cf", "Crypt3.BOJE \u2022 https://otx.alienvault.com/indicator/file/b7a2657fc02c6dea2c4f99c80c6a938d3b6b2b76767d27ff837276ca46851984", "p2d.josht.ca \u2022 test.josht.ca \u2022 josht.ca \u2022 dev.josht.ca \u2022 pma.josht.ca \u2022 staging.josht.ca \u2022 http://dev.josht.ca/", "http://josht.ca/portfolio/ \u2022 https://sa.josht.ca/ \u2022 https://test.josht.ca/ \u2022 https://p2d.josht.ca/api/depots/info/?depot=", "http://p2d.josht.ca/ \u2022 http://p2d.josht.ca/assets/content-delivery/depots/download/", "you.are.poor.i.got.trap.money?", "Assurant \u2022 BC.Win.Packer.Troll-11 \u2022 https://otx.alienvault.com/indicator/domain/assurant.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "United Kingdom of Great Britain and Northern Ireland", "Germany", "Romania", "South Africa" ], "malware_families": [ { "id": "BC.Win.Packer.Troll-11", "display_name": "BC.Win.Packer.Troll-11", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Crypt3.BOJE", "display_name": "Crypt3.BOJE", "target": null }, { "id": "Crypt3.BXMJ", "display_name": "Crypt3.BXMJ", "target": null }, { "id": "Trojan:Win32/Glupteba.OV!MTB", "display_name": "Trojan:Win32/Glupteba.OV!MTB", "target": "/malware/Trojan:Win32/Glupteba.OV!MTB" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "ProRat", "display_name": "ProRat", "target": null }, { "id": "Backdoor:Win32/Prorat.L", "display_name": "Backdoor:Win32/Prorat.L", "target": "/malware/Backdoor:Win32/Prorat.L" }, { "id": "Win32:Malware-gen", "display_name": "Win32:Malware-gen", "target": null }, { "id": "Win32:Trojan", "display_name": "Win32:Trojan", "target": null }, { "id": "DanaBot", "display_name": "DanaBot", "target": null }, { "id": "Atros3.AHFB", "display_name": "Atros3.AHFB", "target": null }, { "id": "Crypt5.BBYH", "display_name": "Crypt5.BBYH", "target": null }, { "id": "Crypt4.AHSW", "display_name": "Crypt4.AHSW", "target": null }, { "id": "Crypt3.COIZ", "display_name": "Crypt3.COIZ", "target": null }, { "id": "Crypt3.CMTM", "display_name": "Crypt3.CMTM", "target": null }, { "id": "Crypt3.CKTO", "display_name": "Crypt3.CKTO", "target": null }, { "id": "Crypt3.BXVC", "display_name": "Crypt3.BXVC", "target": null }, { "id": "Crypt3.BXGR", "display_name": "Crypt3.BXGR", "target": null }, { "id": "Crypt3.BXVC", "display_name": "Crypt3.BXVC", "target": null }, { "id": "Crypt3.BOQD", "display_name": "Crypt3.BOQD", "target": null }, { "id": "Crypt3.BLXP", "display_name": "Crypt3.BLXP", "target": null }, { "id": "Crypt3.BOIU", "display_name": "Crypt3.BOIU", "target": null }, { "id": "Inject2.BHBW", "display_name": "Inject2.BHBW", "target": null }, { "id": "Inject2.BIVE", "display_name": "Inject2.BIVE", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" } ], "industries": [ "Telecommunications", "Insurance" ], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10010, "FileHash-MD5": 150, "FileHash-SHA1": 144, "FileHash-SHA256": 2869, "domain": 2046, "email": 6, "hostname": 3705, "SSLCertFingerprint": 19 }, "indicator_count": 18949, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "197 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68efee5ba882db423d3bad8f", "name": "Assurant & T-Mobile BLYP Checkin ET MALWARE TROJAN \u2022 Kryptic", "description": "", "modified": "2025-11-14T17:02:12.746000", "created": "2025-10-15T18:56:27.950000", "tags": [ "ipv4", "email abuse", "email info", "active related", "passive dns", "files related", "related tags", "none google", "external", "present aug", "present sep", "present jun", "present jul", "present oct", "ipv4 https", "crosscountry", "mortgagefamily", "port", "read c", "destination", "high", "intel", "ms windows", "stream", "explorer", "write", "malware", "united", "asnone", "et trojan", "windows nt", "suspicious", "win64", "zune", "et", "netherlands", "segoe ui", "found content", "length", "content type", "ipv4 add", "pulse pulses", "urls", "error", "ip address", "pulse submit", "url analysis", "files", "domain", "ip related", "pulses none", "learn", "ck id", "name tactics", "informative", "adversaries", "spawns", "command", "found", "defense evasion", "ssl certificate", "execution", "path", "secure", "show technique", "mitre att", "ck matrix", "maxage31536000", "expirestue", "brand", "microsoft edge", "date", "cookie", "sha1", "ascii text", "sha256", "pattern match", "hybrid", "local", "click", "strings", "show process", "flag", "programfiles", "command decode", "comspec", "model", "general", "starfield", "encrypt", "iframe", "development att", "backdoor", "win32", "reverse dns", "location india", "india asn", "trojan", "mtb win32" ], "references": [ "Assurant \u2022 https://otx.alienvault.com/indicator/domain/assurant.com", "20.50.2.51 \u2022 https://hybrid-analysis.com/sample/903834f3326ee0dccde4c134fd51799ea728e7200e6b1d699a0500e6de276f79/68efd2a168a5e234250286cf", "Crypt3.BOJE \u2022 https://otx.alienvault.com/indicator/file/b7a2657fc02c6dea2c4f99c80c6a938d3b6b2b76767d27ff837276ca46851984", "p2d.josht.ca \u2022 test.josht.ca \u2022 josht.ca \u2022 dev.josht.ca \u2022 pma.josht.ca \u2022 staging.josht.ca \u2022 http://dev.josht.ca/", "http://josht.ca/portfolio/ \u2022 https://sa.josht.ca/ \u2022 https://test.josht.ca/ \u2022 https://p2d.josht.ca/api/depots/info/?depot=", "http://p2d.josht.ca/ \u2022 http://p2d.josht.ca/assets/content-delivery/depots/download/", "you.are.poor.i.got.trap.money?", "Assurant \u2022 BC.Win.Packer.Troll-11 \u2022 https://otx.alienvault.com/indicator/domain/assurant.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "United Kingdom of Great Britain and Northern Ireland", "Germany", "Romania", "South Africa" ], "malware_families": [ { "id": "BC.Win.Packer.Troll-11", "display_name": "BC.Win.Packer.Troll-11", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Crypt3.BOJE", "display_name": "Crypt3.BOJE", "target": null }, { "id": "Crypt3.BXMJ", "display_name": "Crypt3.BXMJ", "target": null }, { "id": "Trojan:Win32/Glupteba.OV!MTB", "display_name": "Trojan:Win32/Glupteba.OV!MTB", "target": "/malware/Trojan:Win32/Glupteba.OV!MTB" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "ProRat", "display_name": "ProRat", "target": null }, { "id": "Backdoor:Win32/Prorat.L", "display_name": "Backdoor:Win32/Prorat.L", "target": "/malware/Backdoor:Win32/Prorat.L" }, { "id": "Win32:Malware-gen", "display_name": "Win32:Malware-gen", "target": null }, { "id": "Win32:Trojan", "display_name": "Win32:Trojan", "target": null }, { "id": "DanaBot", "display_name": "DanaBot", "target": null }, { "id": "Atros3.AHFB", "display_name": "Atros3.AHFB", "target": null }, { "id": "Crypt5.BBYH", "display_name": "Crypt5.BBYH", "target": null }, { "id": "Crypt4.AHSW", "display_name": "Crypt4.AHSW", "target": null }, { "id": "Crypt3.COIZ", "display_name": "Crypt3.COIZ", "target": null }, { "id": "Crypt3.CMTM", "display_name": "Crypt3.CMTM", "target": null }, { "id": "Crypt3.CKTO", "display_name": "Crypt3.CKTO", "target": null }, { "id": "Crypt3.BXVC", "display_name": "Crypt3.BXVC", "target": null }, { "id": "Crypt3.BXGR", "display_name": "Crypt3.BXGR", "target": null }, { "id": "Crypt3.BXVC", "display_name": "Crypt3.BXVC", "target": null }, { "id": "Crypt3.BOQD", "display_name": "Crypt3.BOQD", "target": null }, { "id": "Crypt3.BLXP", "display_name": "Crypt3.BLXP", "target": null }, { "id": "Crypt3.BOIU", "display_name": "Crypt3.BOIU", "target": null }, { "id": "Inject2.BHBW", "display_name": "Inject2.BHBW", "target": null }, { "id": "Inject2.BIVE", "display_name": "Inject2.BIVE", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" } ], "industries": [ "Telecommunications", "Insurance" ], "TLP": "white", "cloned_from": "68efedf37890e1b32d60eb55", "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10010, "FileHash-MD5": 150, "FileHash-SHA1": 144, "FileHash-SHA256": 2869, "domain": 2046, "email": 6, "hostname": 3705, "SSLCertFingerprint": 19 }, "indicator_count": 18949, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "197 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68eff0848071708f9ee0c0bd", "name": "Gamarue \u2022 G3nasom\u2022 Simda\u2022 Ganelp affecting Assurant and T-Mobile Part 3", "description": "", "modified": "2025-11-14T17:02:12.746000", "created": "2025-10-15T19:05:40.466000", "tags": [ "ipv4", "email abuse", "email info", "active related", "passive dns", "files related", "related tags", "none google", "external", "present aug", "present sep", "present jun", "present jul", "present oct", "ipv4 https", "crosscountry", "mortgagefamily", "port", "read c", "destination", "high", "intel", "ms windows", "stream", "explorer", "write", "malware", "united", "asnone", "et trojan", "windows nt", "suspicious", "win64", "zune", "et", "netherlands", "segoe ui", "found content", "length", "content type", "ipv4 add", "pulse pulses", "urls", "error", "ip address", "pulse submit", "url analysis", "files", "domain", "ip related", "pulses none", "learn", "ck id", "name tactics", "informative", "adversaries", "spawns", "command", "found", "defense evasion", "ssl certificate", "execution", "path", "secure", "show technique", "mitre att", "ck matrix", "maxage31536000", "expirestue", "brand", "microsoft edge", "date", "cookie", "sha1", "ascii text", "sha256", "pattern match", "hybrid", "local", "click", "strings", "show process", "flag", "programfiles", "command decode", "comspec", "model", "general", "starfield", "encrypt", "iframe", "development att", "backdoor", "win32", "reverse dns", "location india", "india asn", "trojan", "mtb win32" ], "references": [ "Assurant \u2022 https://otx.alienvault.com/indicator/domain/assurant.com", "20.50.2.51 \u2022 https://hybrid-analysis.com/sample/903834f3326ee0dccde4c134fd51799ea728e7200e6b1d699a0500e6de276f79/68efd2a168a5e234250286cf", "Crypt3.BOJE \u2022 https://otx.alienvault.com/indicator/file/b7a2657fc02c6dea2c4f99c80c6a938d3b6b2b76767d27ff837276ca46851984", "p2d.josht.ca \u2022 test.josht.ca \u2022 josht.ca \u2022 dev.josht.ca \u2022 pma.josht.ca \u2022 staging.josht.ca \u2022 http://dev.josht.ca/", "http://josht.ca/portfolio/ \u2022 https://sa.josht.ca/ \u2022 https://test.josht.ca/ \u2022 https://p2d.josht.ca/api/depots/info/?depot=", "http://p2d.josht.ca/ \u2022 http://p2d.josht.ca/assets/content-delivery/depots/download/", "you.are.poor.i.got.trap.money?", "Assurant \u2022 BC.Win.Packer.Troll-11 \u2022 https://otx.alienvault.com/indicator/domain/assurant.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "United Kingdom of Great Britain and Northern Ireland", "Germany", "Romania", "South Africa" ], "malware_families": [ { "id": "BC.Win.Packer.Troll-11", "display_name": "BC.Win.Packer.Troll-11", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Crypt3.BOJE", "display_name": "Crypt3.BOJE", "target": null }, { "id": "Crypt3.BXMJ", "display_name": "Crypt3.BXMJ", "target": null }, { "id": "Trojan:Win32/Glupteba.OV!MTB", "display_name": "Trojan:Win32/Glupteba.OV!MTB", "target": "/malware/Trojan:Win32/Glupteba.OV!MTB" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "ProRat", "display_name": "ProRat", "target": null }, { "id": "Backdoor:Win32/Prorat.L", "display_name": "Backdoor:Win32/Prorat.L", "target": "/malware/Backdoor:Win32/Prorat.L" }, { "id": "Win32:Malware-gen", "display_name": "Win32:Malware-gen", "target": null }, { "id": "Win32:Trojan", "display_name": "Win32:Trojan", "target": null }, { "id": "DanaBot", "display_name": "DanaBot", "target": null }, { "id": "Atros3.AHFB", "display_name": "Atros3.AHFB", "target": null }, { "id": "Crypt5.BBYH", "display_name": "Crypt5.BBYH", "target": null }, { "id": "Crypt4.AHSW", "display_name": "Crypt4.AHSW", "target": null }, { "id": "Crypt3.COIZ", "display_name": "Crypt3.COIZ", "target": null }, { "id": "Crypt3.CMTM", "display_name": "Crypt3.CMTM", "target": null }, { "id": "Crypt3.CKTO", "display_name": "Crypt3.CKTO", "target": null }, { "id": "Crypt3.BXVC", "display_name": "Crypt3.BXVC", "target": null }, { "id": "Crypt3.BXGR", "display_name": "Crypt3.BXGR", "target": null }, { "id": "Crypt3.BXVC", "display_name": "Crypt3.BXVC", "target": null }, { "id": "Crypt3.BOQD", "display_name": "Crypt3.BOQD", "target": null }, { "id": "Crypt3.BLXP", "display_name": "Crypt3.BLXP", "target": null }, { "id": "Crypt3.BOIU", "display_name": "Crypt3.BOIU", "target": null }, { "id": "Inject2.BHBW", "display_name": "Inject2.BHBW", "target": null }, { "id": "Inject2.BIVE", "display_name": "Inject2.BIVE", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" } ], "industries": [ "Telecommunications", "Insurance" ], "TLP": "white", "cloned_from": "68efee5ba882db423d3bad8f", "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10010, "FileHash-MD5": 150, "FileHash-SHA1": 144, "FileHash-SHA256": 2869, "domain": 2046, "email": 6, "hostname": 3705, "SSLCertFingerprint": 19 }, "indicator_count": 18949, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "197 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://dghfhfgjfhjghj6699.net/help.php", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://dghfhfgjfhjghj6699.net/help.php", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780211770.2181416 }