{ "type": "URL", "indicator": "https://ep2.adtrafficquality.google/sodar/sodar2.js5x", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://ep2.adtrafficquality.google/sodar/sodar2.js5x", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4129947298, "indicator": "https://ep2.adtrafficquality.google/sodar/sodar2.js5x", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 10, "pulses": [ { "id": "69aa0a62f94a92b5168405c2", "name": "fedpaypal clone Q vashti", "description": "", "modified": "2026-03-06T06:39:27.872000", "created": "2026-03-05T22:57:38.559000", "tags": [ "present sep", "virtool", "cryp", "win32", "ip address", "trojan", "ransom", "asn as54113", "passive dns", "msil", "united states", "dynamicloader", "qaeaav12", "high", "qbeipbdii", "write", "paypal", "medium", "search", "vmware", "floodfix", "malware", "united", "mtb apr", "hostname add", "write c", "read c", "yara detections", "upxoepplace", "next", "markus", "april", "ping", "meta http", "content", "gmt server", "th th", "443 ma2592000", "ipv4 add", "url analysis", "urls", "body", "title", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "t1590 gather", "victim network", "status", "name servers", "set cookie", "script urls", "present feb", "cookie", "template", "present oct", "present jul", "present dec", "present jun", "next associated", "urls show", "date checked", "present apr", "url hostname", "united kingdom", "unknown ns", "servers", "great britain", "msr aug", "msr apr", "msr nov", "ite o", "server response", "script script", "files show", "date hash", "avast avg", "creation date", "lcid1033", "sminnotek", "spnvirtualbox", "bvvirtualbox", "present mar", "present nov", "exploit", "error", "server response", "google safe", "results sep", "backdoor", "certificate", "mtb sep", "next http", "scans show", "present may", "results jun", "results jan", "worm", "echo request", "sweep", "payload hello", "world", "ids detections", "cape", "viking", "philis", "et", "torop", "des moines", "contacted hosts", "content reputation", "sabey type", "tulach type", "rexx type", "foundry type", "fred scherr", "twitter", "apple", "monitored target", "financial theft", "psalms 27: 1 - 14" ], "references": [ "fed.paypal.com [redirect for monitored target \u2022 1st documented 2020- still active]", "nr-data.net \u2022 init.ess.apple.com\t\u2022 apple-id-ifind.com \u2022 https://apple-id-ifind.com/\t\u2022 apple-lostandfound.com", "https://www.speakup.it/magazines/places/new-york-city-on-a-budget-big-apple-little-money_2368", "https://login.apple-mac.banugoker.com/cgi-sys/defaultwebpage.cgi \u2022 lsupport-apple.com", "login.apple-mac.banugoker.com \u2022 www.apple-mac.banugoker.com \u2022 http://apple-mac.banugoker.com/", "https://apple-mac.banugoker.com/ \u2022 https://login.apple-mac.banugoker.com/", "http://45.159.189.105/bot/regex \u2022 https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net", "wallpapers-nature.com \u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://wallpapers-nature.com/ tsara-brashears/urlscan-io\t \u2022 https://wallpapers-nature.com/%20tsara-brashears/urlscan-io", "http://www.mof.gov.cn.lxcvc.com/ \u2022 http://www.mohurd.gov.cn.lxcvc.\u2022 com/ \u2022 https://www.csrc.gov.cn.lxcvc.com/", "https://lk-prod-webcol.laika.com.co/category/bog/cat/farmacia/collares-isabelinos/todos/todo-para-mascota/1", "https://twitter.com/PORNO_SEXYBABES \u2022 https://megapornfreehd.com/2025/04/360", "https://57d5.zhanyu66.com/com.slamyugllp.strangerrun.xc.apk/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win32:MalOb-BX\\ [Cryp]", "display_name": "Win32:MalOb-BX\\ [Cryp]", "target": null }, { "id": "Win.Trojan.Fraudpack", "display_name": "Win.Trojan.Fraudpack", "target": null }, { "id": "Fakeav", "display_name": "Fakeav", "target": null }, { "id": "Ransom:MSIL/Genasom.I", "display_name": "Ransom:MSIL/Genasom.I", "target": "/malware/Ransom:MSIL/Genasom.I" }, { "id": "Virtool:Win32/Obfuscator.KI", "display_name": "Virtool:Win32/Obfuscator.KI", "target": "/malware/Virtool:Win32/Obfuscator.KI" }, { "id": "Toga!rfn", "display_name": "Toga!rfn", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Trojan:Win32/Floxif.E", "display_name": "Trojan:Win32/Floxif.E", "target": "/malware/Trojan:Win32/Floxif.E" }, { "id": "Win.Malware.Remoteadmin-7056666-0", "display_name": "Win.Malware.Remoteadmin-7056666-0", "target": null }, { "id": "Floxif", "display_name": "Floxif", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win.Dropper.Unruy-9994363-0", "display_name": "Win.Dropper.Unruy-9994363-0", "target": null }, { "id": "Win.Trojan.Cycler-47", "display_name": "Win.Trojan.Cycler-47", "target": null }, { "id": "Win.Trojan.Clicker-3506", "display_name": "Win.Trojan.Clicker-3506", "target": null }, { "id": "Win.Downloader.Unruy-10026469-0", "display_name": "Win.Downloader.Unruy-10026469-0", "target": null }, { "id": "Trojan:Win32/Floxif.E", "display_name": "Trojan:Win32/Floxif.E", "target": "/malware/Trojan:Win32/Floxif.E" }, { "id": "Win.Malware.Urelas", "display_name": "Win.Malware.Urelas", "target": null }, { "id": "Win.Malware.Zusy", "display_name": "Win.Malware.Zusy", "target": null }, { "id": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn", "display_name": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn", "target": null }, { "id": "Win.Malware.Eclz-9953021-0", "display_name": "Win.Malware.Eclz-9953021-0", "target": null }, { "id": "#Lowfi:SuspiciousSectionName", "display_name": "#Lowfi:SuspiciousSectionName", "target": null }, { "id": "Worm:Win32/Autorun", "display_name": "Worm:Win32/Autorun", "target": "/malware/Worm:Win32/Autorun" }, { "id": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit", "display_name": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit", "target": null }, { "id": "Win.Dropper.Tiggre-9845940-0", "display_name": "Win.Dropper.Tiggre-9845940-0", "target": null }, { "id": "PWS:Win32/QQpass.B!MTB", "display_name": "PWS:Win32/QQpass.B!MTB", "target": "/malware/PWS:Win32/QQpass.B!MTB" }, { "id": "Win.Malware.Sfwx-9853337-0", "display_name": "Win.Malware.Sfwx-9853337-0", "target": null }, { "id": "Backdoor:Win32/Tofsee.T", "display_name": "Backdoor:Win32/Tofsee.T", "target": "/malware/Backdoor:Win32/Tofsee.T" }, { "id": "Trojan:Win32/Kaicorn!rf", "display_name": "Trojan:Win32/Kaicorn!rf", "target": "/malware/Trojan:Win32/Kaicorn!rf" }, { "id": "Win32:Banker", "display_name": "Win32:Banker", "target": null }, { "id": "Worm:Win32/Cambot!rfn", "display_name": "Worm:Win32/Cambot!rfn", "target": "/malware/Worm:Win32/Cambot!rfn" }, { "id": "Win32:Malware", "display_name": "Win32:Malware", "target": null }, { "id": "Win.Malware.Midie-6847892-0", "display_name": "Win.Malware.Midie-6847892-0", "target": null }, { "id": "ET", "display_name": "ET", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1450", "name": "Exploit SS7 to Track Device Location", "display_name": "T1450 - Exploit SS7 to Track Device Location" }, { "id": "T1459", "name": "Device Unlock Code Guessing or Brute Force", "display_name": "T1459 - Device Unlock Code Guessing or Brute Force" }, { "id": "T1401", "name": "Device Administrator Permissions", "display_name": "T1401 - Device Administrator Permissions" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1595", "name": "Active Scanning", "display_name": "T1595 - Active Scanning" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1595.002", "name": "Vulnerability Scanning", "display_name": "T1595.002 - Vulnerability Scanning" }, { "id": "T1464", "name": "Jamming or Denial of Service", "display_name": "T1464 - Jamming or Denial of Service" }, { "id": "T1588.001", "name": "Malware", "display_name": "T1588.001 - Malware" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" } ], "industries": [], "TLP": "white", "cloned_from": "68c5743593a4bcc81dd94b0b", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1323, "URL": 4360, "FileHash-MD5": 759, "FileHash-SHA1": 748, "FileHash-SHA256": 5148, "domain": 1076, "email": 7 }, "indicator_count": 13421, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "87 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6961a8ed7b492f9e0ba38990", "name": "HeartSender.A and other Malware attacks originating from Palantirs Pahamify Pegasus", "description": "Pahamify Pegasus : HackTool \u2022 Speedcat \u2022 HeartSender.A \u2022 Zbot and other malware found.\nSearc begins with single FileHash referenced below. \nI\u2019m checking the processes and sharing it here one group at a time. Too much research at once could bring Amazon AWS down. Again.", "modified": "2026-02-09T00:04:37.974000", "created": "2026-01-10T01:18:36.999000", "tags": [ "read c", "write c", "port", "destination", "united", "medium", "as16509", "memcommit", "write", "execution", "dock", "persistence", "next executed", "commands graph", "tree", "sample hash", "passive dns", "present jan", "title error", "urls", "files", "date hash", "avast avg", "dynamicloader", "host", "utf8", "unicode text", "crlf line", "binary resource", "ms windows", "search", "intel", "pcspeedcat", "win32", "internal", "malware", "local", "unknown", "get na", "http", "okrnserver", "ip address", "http traffic", "guard", "powershell", "ipv4 add", "servers", "name servers", "capture", "link", "gateway", "tofsee att", "ck ids", "t1055", "injection", "t1071", "protocol", "t1573", "target", "url http", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "adversaries", "spawns", "t1480 execution", "discovery att", "mitre att", "ck matrix", "ascii text", "hybrid", "general", "path", "click", "strings", "high", "etpro malware", "next", "stack", "format", "error", "unicode", "head http", "regsetvalueexa", "qt binary", "resource file", "pe32", "hostile", "unknown aaaa", "unknown ns", "x content", "gmt cache", "domain add", "title", "present sep", "a td", "td tr", "dir td", "td td", "present may", "present jun", "present apr", "present aug", "present oct", "head body", "gmt server", "index", "main", "accept", "status", "th tr", "moved", "record value", "expiration date", "germany unknown", "present dec", "cache control", "present nov", "max age1000000", "cookie", "hosting", "reverse dns", "location france", "france asn", "as16276", "trojandropper", "next associated", "mtb jan", "exploit", "emails", "trojan", "pegasus", "hostname add", "url analysis", "domain", "files ip", "address", "france unknown", "asn as16276", "backdoor", "entries", "setcookie", "twitter", "refloadapihash", "virtool", "show", "displayname", "windows", "rndhex", "tofsee", "stream", "encrypt", "push", "creation date", "france", "date", "body", "pup", "amazon", "amazon aws", "salesforce", "herokuappdev", "google", "igoogle", "monitored target", "cats" ], "references": [ "FileHash-SHA256\t9f66cab9d7c581cf2dd28b6ae3178bb3d38975ff257c3ffb67c3e89d0f7135ee", "https://otx.alienvault.com/indicator/ip/3.163.24.10", "External Hosts: 52.57.183.74\t access.pcspeedcat.com\taccess.pcspeedcat.com\tGermany\tAS16509 amazon.com inc\taccess.pcspeedcat.com Germany AS16509 amazon.", "External Hosts: 3.163.24.10\t www.pcspeedcat.com\twww.pcspeedcat.com\tUnited States ASNone", "https://otx.alienvault.com/indicator/hostname/pegasus.pahamify.com", "https://otx.alienvault.com/indicator/url/https://pegasus.pahamify.com/", "https://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV", "http://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV", "biblegateway.comwww.biblegateway.com \u2022 www.biblegateway.com", "Malicious Application Development: herokuappdev.com (Patter match 8 years +)", "direwolf-8b1a1bc476.staging.herokuappdev.com", "Malicious Application Development: herokuappdev.com (pattern matching spans 8+ years)" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Generic-9871124-0", "display_name": "Win.Malware.Generic-9871124-0", "target": null }, { "id": "ALF:HackTool:MSIL/HeartSender.A", "display_name": "ALF:HackTool:MSIL/HeartSender.A", "target": null }, { "id": "Win.Malware.Speedcat-6957425", "display_name": "Win.Malware.Speedcat-6957425", "target": null }, { "id": "Tofsee Attack", "display_name": "Tofsee Attack", "target": null }, { "id": "Zbot", "display_name": "Zbot", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1192", "name": "Spearphishing Link", "display_name": "T1192 - Spearphishing Link" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1608", "name": "Stage Capabilities", "display_name": "T1608 - Stage Capabilities" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" } ], "industries": [ "Civil Society", "Telecommunications", "Technology" ], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 404, "FileHash-SHA1": 286, "FileHash-SHA256": 1419, "SSLCertFingerprint": 7, "domain": 441, "URL": 4233, "hostname": 1217, "email": 10 }, "indicator_count": 8017, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "112 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69544c73467a9c3858556698", "name": "Mira Malware Drive By Compromise Google.com search engine | Microsoft | Apple", "description": "Microsoft Mira Malware Drive By Compromise Google.com.\n Device infected with MyDoom zombie maker. \nEstablished user location, screen captures, corrupted Apple device via Google search engine browser redirect. Attack began 12.30.2025 past midnight. Threat actor powered on cameras, microphones, and preformed their hacker intentions. #stateofcolorado", "modified": "2026-01-29T21:02:54.448000", "created": "2025-12-30T22:04:35.565000", "tags": [ "content", "kb body", "p3p cp", "date tue", "gmt server", "html info", "12.30.2025", "urls", "url add", "http", "ip address", "related nids", "files location", "united", "flag united", "handle", "address range", "cidr", "network name", "allocation type", "assigned pa", "status", "whois server", "ripe ncc", "ripe network", "abuse contact", "orgid", "address", "orgabuseref", "postalcode", "ripe", "email", "flag", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "dns requests", "domain address", "contacted hosts", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "found", "ssl certificate", "execution", "google llc", "ascii text", "mitre att", "hybrid", "general", "local", "path", "click", "strings", "data upload", "extraction", "ta0004", "evasion ta0005", "injection t1055", "t1055", "col ta0011", "l t1071", "encrypted ch", "t1573", "present nov", "present oct", "certificate", "present dec", "aaaa", "search", "servers", "record value", "emails", "title", "leveidiuelabs", "include", "review", "exclude data", "suggested ogs", "find s", "command decode", "development att", "initial access", "t1189 driveby", "html", "execution att", "href", "size", "pattern match", "filehash", "md5 add", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "file score", "medium risk", "malware", "trojan", "mira malware", "push", "dynamicloader", "windows nt", "msie", "wow64", "slcc2", "media center", "yara rule", "program", "runtime error", "medium", "python", "win64", "unknown", "guard", "accept", "write", "launcher", "updater", "smartassembly", "delphi", "ee fc", "ff d5", "f0 ff", "eb e1", "ff ff", "c1 e8", "c1 c0", "eb e8", "copy", "next", "mydoom checkin", "win32mydoom dec", "name servers", "creation date", "passive dns", "domain", "expiration date", "hostname", "date", "google chrome", "screen capture", "locate human", "target", "black hat", "apple", "microsoft", "google", "stateofcolorado", "christopher ahmann", "brian sabey" ], "references": [ "Google.com sorry not sorry index | https://www.google.com/search", "cb=loaded_h_0&sei=7xhUabPOD4LmwN4P57CMuQc 2025", "redirector.gvt1.com", "Names: cb=loaded_h_0&sei=7xhUabPOD4LmwN4P57CMuQc", "microsoft-falcon.net", "hattchett.ddns.net", "Office Open XML Spreadsheet: jnlwore.exe \u2022 Office Open: XML Spreadsheet \u2022 logs.xlsx", "XML: sharedStrings.xml \u2022Text: blacklist-6649dcf91af1d.csv", "https://www.virustotal.com/gui/file/de41f4d690511126ce2b8b5df3c0ffdde792df495ea6bb9fe2fec5f8b175e408/summary", "x-hallmonitor-challenge CgwI-LPQygYQwp6yigISBGuywgs", "https://www.google.com/sorry/index \u2022 http://g.co/p3p...-> g.co", "https://7849f20f.open.convertkit-mail2.com/68une4gx9xi8h50394ziohpe59okkh9hdg44x", "Microsoft Corporation: FileVersion: 1.0.0.155 Microsoft Corporation Legal Trademark: Mira Malware", "Yara Detections SUSP_Imphash_Mar23_2", "https://otx.alienvault.com/indicator/hostname/mx-in-ma.apple.com", "userlocation-prod.ingress.kors.microsoft-falcon.net ->", "\u4e3b\u9875\uff0c\u6574\u4e2a\u4e16\u754c X + < \u2192 C \u2022 hao.360.com/?src=lm&ls=n6abbbb598c ->", "To get future Google Chrome updates, you'll need" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan:Win32/Mira", "display_name": "Trojan:Win32/Mira", "target": "/malware/Trojan:Win32/Mira" }, { "id": "Upatre", "display_name": "Upatre", "target": null }, { "id": "Mydoom Checkin", "display_name": "Mydoom Checkin", "target": null } ], "attack_ids": [ { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1608.004", "name": "Drive-by Target", "display_name": "T1608.004 - Drive-by Target" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1048.001", "name": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol", "display_name": "T1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1939, "hostname": 1205, "URL": 3310, "domain": 432, "FileHash-MD5": 396, "CIDR": 3, "email": 16, "FileHash-SHA1": 373, "SSLCertFingerprint": 13, "CVE": 1 }, "indicator_count": 7688, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "122 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6940b852c28f2a2c6abb4aad", "name": "FRITZ!Box \u2026.Connecting to Apple devices", "description": "Connecting to targeted Apple\ndevices overnight. \n\nHow to connect to the FRITZ!Box, how to access all of the product's functions, and what to do with the device if you are not connected to it in your home network.", "modified": "2026-01-15T01:02:47.757000", "created": "2025-12-16T01:39:30.381000", "tags": [ "fritz", "strong", "main navigation", "deutsch", "englisch", "funktionen der", "verbindung zur", "wifi", "ip address", "box avm", "lowfi", "win32", "susp", "urls", "files", "asn as44716", "related tags", "indicator facts", "germany unknown", "a domains", "meta", "typo3", "body doctype", "kasper skaarhoj", "gmt server", "pragma", "a nxdomain", "nxdomain", "whitelisted", "present aug", "present jul", "present oct", "present jun", "united", "present sep", "present nov", "next http", "scans show", "title", "div div", "a li", "wir suchen", "li ul", "avm karriere", "dich a", "reverse dns", "berlin", "germany asn", "dns resolutions", "domains top", "level", "unique tlds", "related pulses", "none related", "passive dns", "ipv4", "url analysis", "present dec", "moved", "certificate", "vertriebs gmbh", "aaaa", "as12732 gutcon", "domain", "hostname", "verdict", "files ip", "address", "germany", "as13335", "as8220 colt", "present may", "united kingdom", "regsetvalueexa", "regdword", "regbinary", "show", "yara detections", "regsetvalueexw", "regsz", "medium", "suspicious", "delphi", "malware", "write", "as6878", "msie", "chrome", "gmt content", "germany showing", "createobject", "set http", "search", "high", "read c", "et trojan", "jfif", "ascii text", "detected", "trojan generic", "checkin", "pony downloader", "http library", "virustotal", "riskware", "mcafee", "drweb", "vipre", "trojan", "panda", "next", "unknown", "as15169 google", "status", "name servers", "record value", "emails", "error", "trojandropper", "results dec", "ddos", "worm", "mtb trojan", "mtb apr", "exev2e", "ia256", "extraction", "get http", "post http", "learn", "command", "ck id", "name tactics", "informative", "spawns", "mitre att", "ck techniques", "evasion att", "germany germany", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "dns requests", "domain address", "contacted hosts", "pattern match", "show technique", "ck matrix", "show process", "network traffic", "t1057", "t1071", "hybrid", "local", "path", "t1204 user", "defense evasion", "t1480 execution", "sha1", "sha256", "size", "script", "null", "span", "refresh", "footer", "body", "june", "general", "click", "strings", "tools", "tracker", "code", "look", "verify", "restart", "bad traffic", "et info", "tls handshake", "failure", "process details", "flag", "link", "present feb", "servers", "redacted for", "as20546 soprado", "encrypt", "mtb sep", "ransom", "next associated", "twitter", "virtool", "hostname add", "location russia", "as200350", "russia unknown", "federation flag", "ipv4 add", "asn as200350", "related", "domain add", "unknown ns", "expiration date", "http version", "windows nt", "gbot", "post method", "port", "destination", "delete", "get na", "as15169", "expiration", "url https", "no expiration", "showing", "entries", "url add", "pulse pulses", "http", "files domain", "files related", "pulses none", "unknown cname", "cname", "asn as24940", "less", "date", "pulse submit" ], "references": [ "https://fritz.box/login | router.box | wlan.box | mesh.box | myfritz.box | https://business.kozow.com/bbox/ |", "https://avm.de/ Connection: close Content Type: text/html charset=iso 8859 1", "AVM Computersysteme Vertriebs GmbH Certificate Subject: IT Certificate Subject *.avm.de Certificate Issuer: US", "Certificate Issuer: DigiCert Inc Certificate Issuer: |DigiCert SHA2 Secur Server CA", "Subject: DE Certificate Subject: Berlin Certificate Subject", "https://uutiskirje.professiogroup.com/go/54382390-5506438-191003959\u241d", "http://b25d1a05.click.convertkit-mail2.com \u2022 https://b25d1a05.click.convertkit-mail2.com", "https://push.adac.passcreator.com/ | passcreator-metrics.e07cc1.flownative.cloud", "ecs-80-158-49-8.reverse.open-telekom-cloud.com", "http://24.211.14.182:5555/login.htm?page=%2F | s5wpr2nreqby04v9.myfritz.ne", "HYPERTRM.EXE - FileHash-SHA256 21cf992aba3d4adbc8a6bd65337f46a93983fbec8fe0f4639be826571ae469ba", "Copyright \u00a9 Hilgraeve, Inc. 2001 Product Microsoft\u00ae Windows\u00ae Operating System Description HyperTerminal Applet", "Original Name HYPERTRM.EXE Internal Name HyperTrm File Version 5.1.2600.0", "Comments HyperTerminal \u00ae was developed by Hilgraeve, Inc. for Microsoft", "ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System", "ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.\t192.168.56.103\t173.194.113.114", "ET TROJAN Trojan Generic - POST To gate.php with no referer\t192.168.56.103\t173.194.113.114", "ET TROJAN Fareit/Pony Downloader Checkin 2\t192.168.56.103\t173.194.113.114", "ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98\t192.168.56.103\t173.194.113.114", "http://applewaebastian.fritz.box/ \u2022 applewaebastian.fritz.box", "http://netuser.joymeng.com/charge_apple/notify", "https://www.passcreator.com/en/apple-wallet-passes", "https://sso.myfritz.net/static/images/icons/apple-touch-icon-76x76.png No", "apple-business.cancom.at", "Apple - 162.55.158.153", "Crypt2.AZDI - FileHash-SHA256 62ffd7a3a21a5732870c4ad92fad7287a5270e4a5508752cfef0aa6f9ea30d1f", "Inject.BRDV - FileHash-SHA256\t25f639cdaae06656ab5e0cc80512146aa59097439c388dd15e4cc09343d9a283", "Win32:Androp - FileHash-MD5 99c6c9564af67a954661ebf6e41391d2", "#LowFi:Tool:Win32/VbsToExeV2E - FileHash-MD5\t99c8310538a090d2b7e5db3ea22b839a", "#LowFi:Tool:Win32/VbsToExeV2E - FileHash-SHA1-2f7189e96cda26dbb6948354667fdd1ad37c04c0", "#LowFi:Tool:Win32/VbsToExeV2E - FileHash-SHA256\tae2fb6755dbf52fa44e427fbe0f29bf541aeedf66656edeb08ba9d7ef1617afc", "Ip Traffic: TCP 74.125.24.106:80 (googleapis.com) TCP 85.195.91.179:80 (catch-cdn.com) UDP :53", "ALF:CERT:Adware:Win32/Peapoon Win.Malware.Midie-6847893-0\tTrojanDropper:Win32/Muldrop.V!MTB Win.Malware.Generickdz-9938530-0\tTrojan:Win32/Zombie.A Win.Malware.Genpack-6989317-0\tTrojanDropper:Win32/VB.IL Win.Trojan.VBGeneric-6735875-0\tWorm:Win32/Mofksys" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "#LowFi:Tool:Win32/VbsToExeV2E", "display_name": "#LowFi:Tool:Win32/VbsToExeV2E", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Androp", "display_name": "Androp", "target": null }, { "id": "Inject.BRDV", "display_name": "Inject.BRDV", "target": null }, { "id": "Win32:Androp", "display_name": "Win32:Androp", "target": null }, { "id": "Crypt2.AZDI", "display_name": "Crypt2.AZDI", "target": null }, { "id": "TEL:MSIL/DlSocConSend", "display_name": "TEL:MSIL/DlSocConSend", "target": "/malware/TEL:MSIL/DlSocConSend" }, { "id": "DDOS:Linux/Lightaidra", "display_name": "DDOS:Linux/Lightaidra", "target": "/malware/DDOS:Linux/Lightaidra" }, { "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47", "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47", "target": null }, { "id": "Trojan:Win32/Salgorea.C!MTB", "display_name": "Trojan:Win32/Salgorea.C!MTB", "target": "/malware/Trojan:Win32/Salgorea.C!MTB" }, { "id": "Worm:Win32/Autorun.XFV", "display_name": "Worm:Win32/Autorun.XFV", "target": "/malware/Worm:Win32/Autorun.XFV" }, { "id": "Trojan:Win32/Blihan.A", "display_name": "Trojan:Win32/Blihan.A", "target": "/malware/Trojan:Win32/Blihan.A" }, { "id": "Worm:Win32/Yuner.A", "display_name": "Worm:Win32/Yuner.A", "target": "/malware/Worm:Win32/Yuner.A" }, { "id": "Win.Trojan.Zegost", "display_name": "Win.Trojan.Zegost", "target": null }, { "id": "PWS:Win32/QQpass", "display_name": "PWS:Win32/QQpass", "target": "/malware/PWS:Win32/QQpass" }, { "id": "Trojan:Win32/Glupteba.MT!MTB", "display_name": "Trojan:Win32/Glupteba.MT!MTB", "target": "/malware/Trojan:Win32/Glupteba.MT!MTB" }, { "id": "Trojan:Win32/QQpass", "display_name": "Trojan:Win32/QQpass", "target": "/malware/Trojan:Win32/QQpass" }, { "id": "Win.Trojan.Generic", "display_name": "Win.Trojan.Generic", "target": null }, { "id": "TrojanDropper:Win32/Muldrop.V!MTB", "display_name": "TrojanDropper:Win32/Muldrop.V!MTB", "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB" }, { "id": "Win32/Trickler", "display_name": "Win32/Trickler", "target": null }, { "id": "Win.Malware.Hd0kzai-9985588-0", "display_name": "Win.Malware.Hd0kzai-9985588-0", "target": null }, { "id": "Trojan:Win32/Aenjaris.AL!bit", "display_name": "Trojan:Win32/Aenjaris.AL!bit", "target": "/malware/Trojan:Win32/Aenjaris.AL!bit" }, { "id": "Trojan:Win32/Agent.AG!MTB", "display_name": "Trojan:Win32/Agent.AG!MTB", "target": "/malware/Trojan:Win32/Agent.AG!MTB" }, { "id": "Trojan:Win32/Salgorea", "display_name": "Trojan:Win32/Salgorea", "target": "/malware/Trojan:Win32/Salgorea" }, { "id": "Win.Malware.Barys-6840738-0", "display_name": "Win.Malware.Barys-6840738-0", "target": null }, { "id": "Unruy", "display_name": "Unruy", "target": null }, { "id": "Trojan:Win32/EyeStye.T", "display_name": "Trojan:Win32/EyeStye.T", "target": "/malware/Trojan:Win32/EyeStye.T" }, { "id": "wormWin32/Mofksys.RND!MTB", "display_name": "wormWin32/Mofksys.RND!MTB", "target": null }, { "id": "TrojanDropper:Win32/VB.IL", "display_name": "TrojanDropper:Win32/VB.IL", "target": "/malware/TrojanDropper:Win32/VB.IL" }, { "id": "CVE 2007695", "display_name": "CVE 2007695", "target": null } ], "attack_ids": [ { "id": "T1008", "name": "Fallback Channels", "display_name": "T1008 - Fallback Channels" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 927, "hostname": 2093, "FileHash-SHA256": 1474, "URL": 5935, "FileHash-MD5": 351, "FileHash-SHA1": 252, "email": 5, "CVE": 1, "SSLCertFingerprint": 2 }, "indicator_count": 11040, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "137 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e2bb5d9ee8577ab5519f2c", "name": "Meritshealth with DoD links? ", "description": "", "modified": "2026-01-13T00:05:56.401000", "created": "2025-10-05T18:39:25.286000", "tags": [ "gtmk5nxqc6", "utc amazon", "utc na", "acceptencoding", "gmt contenttype", "connection", "true pragma", "gmt setcookie", "httponly", "gmt vary", "nc000000 up", "html document", "unicode text", "utf8 text", "oc0006 http", "http traffic", "https http", "mitre att", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "number", "ja3s", "algorithm", "azure rsa", "tls issuing", "cus subject", "stwa lredmond", "cnmicrosoft ecc", "update secure", "server ca", "omicrosoft cus", "get http", "dns resolutions", "registrar", "markmonitor inc", "country", "resolver domain", "type name", "html", "apnic", "apnic whois", "please", "rirs", "cidr", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "development att", "name tactics", "binary file", "ck matrix", "wheelchair", "iamrobert", "pattern match", "ascii text", "href", "united", "general", "local", "path", "encrypt", "click", "passive dns", "urls", "files", "reverse dns", "netherlands", "present aug", "a domains", "moved", "first pqc", "ip address", "unknown ns", "unknown aaaa", "title", "body", "meta", "window", "accept", "body doctype", "welcome", "ok server", "gmt content", "present jul", "present sep", "aaaa", "hostname", "error", "defense evasion", "windows nt", "response", "vary", "strings", "core", "t1027.013 encrypted/encoded", "michelin lazy k", "prefetch8", "flag", "date", "starfield", "hybrid", "mobility cr", "extraction", "data upload", "include", "o url", "url url", "included i0", "review ioc", "excluded ic", "suggested", "find sugi", "failed", "cre pul", "enter", "enter sc", "type", "enric", "extra", "type opaste", "data u", "included", "copy md5", "copy sha1", "copy sha256", "null", "refresh", "tools", "look", "verify", "restart", "t1480 execution", "expiration", "url https", "no expiration", "iocs", "ipv4", "text drag", "drop or", "browse to", "select file", "redacted for", "server", "privacy tech", "privacy admin", "postal code", "stateprovince", "organization", "email", "code", "quantum rooms", "sam somalia", "emp", "porn", "media defense", "gov porn", "suck my nips", "reimer suspect", "jeffrey reimer", "dod", "department of defense", "show", "date checked", "url hostname", "server response", "google safe", "results may", "entries http", "scans record", "value status", "sabey type", "merits fake", "y.a.s.", "pornography", "ramsom" ], "references": [ "https://www.meritshealth.com/ Defense.Gov Mobility Co? ", "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67", "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf", "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf", "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html", "https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com", "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/", "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp", "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg", "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)", "https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members", "https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210", "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex", "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf", "https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo", "https://meumundogay-com.sexogratis.page/locker", "https://es.pornhat.com/models/the-sex-creator/", "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA", "Can the DoD no questions asked target a SA victim", "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.", "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise", "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov", "There is fear in silence or speaking out", "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.", "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?", "If someone is believed to be a threat they have right to due process.", "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.", "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.", "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.", "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.", "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot", "iamrobert.com Y.A.S.", "1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam", "Target agreed and complied with all lie detector measures.", "Is the family allowed to have a funeral for Tsara or print an obituary", "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.", "I am very upset. Whoever is doing this is sick." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "TA0042", "name": "Resource Development", "display_name": "TA0042 - Resource Development" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1591", "name": "Gather Victim Org Information", "display_name": "T1591 - Gather Victim Org Information" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "display_name": "T1562.004 - Disable or Modify System Firewall" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1562.008", "name": "Disable Cloud Logs", "display_name": "T1562.008 - Disable Cloud Logs" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1056.003", "name": "Web Portal Capture", "display_name": "T1056.003 - Web Portal Capture" }, { "id": "T1512", "name": "Capture Camera", "display_name": "T1512 - Capture Camera" }, { "id": "T1180", "name": "Screensaver", "display_name": "T1180 - Screensaver" } ], "industries": [], "TLP": "white", "cloned_from": "68e2b14d83bb63502feac65e", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1365, "URL": 11172, "hostname": 2780, "FileHash-MD5": 381, "FileHash-SHA256": 4420, "FileHash-SHA1": 338, "CIDR": 4, "SSLCertFingerprint": 24, "CVE": 1, "email": 1 }, "indicator_count": 20486, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "139 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e2b14d83bb63502feac65e", "name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.", "description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech needed. Later denies ever being a mobility technician. They killed a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?", "modified": "2026-01-07T00:00:30.717000", "created": "2025-10-05T17:56:29.109000", "tags": [ "gtmk5nxqc6", "utc amazon", "utc na", "acceptencoding", "gmt contenttype", "connection", "true pragma", "gmt setcookie", "httponly", "gmt vary", "nc000000 up", "html document", "unicode text", "utf8 text", "oc0006 http", "http traffic", "https http", "mitre att", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "number", "ja3s", "algorithm", "azure rsa", "tls issuing", "cus subject", "stwa lredmond", "cnmicrosoft ecc", "update secure", "server ca", "omicrosoft cus", "get http", "dns resolutions", "registrar", "markmonitor inc", "country", "resolver domain", "type name", "html", "apnic", "apnic whois", "please", "rirs", "cidr", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "development att", "name tactics", "binary file", "ck matrix", "wheelchair", "iamrobert", "pattern match", "ascii text", "href", "united", "general", "local", "path", "encrypt", "click", "passive dns", "urls", "files", "reverse dns", "netherlands", "present aug", "a domains", "moved", "first pqc", "ip address", "unknown ns", "unknown aaaa", "title", "body", "meta", "window", "accept", "body doctype", "welcome", "ok server", "gmt content", "present jul", "present sep", "aaaa", "hostname", "error", "defense evasion", "windows nt", "response", "vary", "strings", "core", "t1027.013 encrypted/encoded", "michelin lazy k", "prefetch8", "flag", "date", "starfield", "hybrid", "mobility cr", "extraction", "data upload", "include", "o url", "url url", "included i0", "review ioc", "excluded ic", "suggested", "find sugi", "failed", "cre pul", "enter", "enter sc", "type", "enric", "extra", "type opaste", "data u", "included", "copy md5", "copy sha1", "copy sha256", "null", "refresh", "tools", "look", "verify", "restart", "t1480 execution", "expiration", "url https", "no expiration", "iocs", "ipv4", "text drag", "drop or", "browse to", "select file", "redacted for", "server", "privacy tech", "privacy admin", "postal code", "stateprovince", "organization", "email", "code", "quantum rooms", "sam somalia", "emp", "porn", "media defense", "gov porn", "suck my nips", "reimer suspect", "jeffrey reimer", "dod", "department of defense", "show", "date checked", "url hostname", "server response", "google safe", "results may", "entries http", "scans record", "value status", "sabey type", "merits fake", "y.a.s.", "pornography", "ramsom" ], "references": [ "https://www.meritshealth.com/ Defense.Gov Mobility Co? ", "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67", "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf", "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf", "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html", "https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com", "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/", "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp", "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg", "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)", "https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members", "https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210", "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex", "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf", "https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo", "https://meumundogay-com.sexogratis.page/locker", "https://es.pornhat.com/models/the-sex-creator/", "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA", "Can the DoD no questions asked target a SA victim", "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.", "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise", "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov", "There is fear in silence or speaking out", "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.", "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?", "If someone is believed to be a threat they have right to due process.", "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.", "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.", "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.", "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.", "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot", "iamrobert.com Y.A.S.", "1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam", "Target agreed and complied with all lie detector measures.", "Is the family allowed to have a funeral for Tsara or print an obituary", "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.", "I am very upset. Whoever is doing this is sick." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "TA0042", "name": "Resource Development", "display_name": "TA0042 - Resource Development" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1591", "name": "Gather Victim Org Information", "display_name": "T1591 - Gather Victim Org Information" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "display_name": "T1562.004 - Disable or Modify System Firewall" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1562.008", "name": "Disable Cloud Logs", "display_name": "T1562.008 - Disable Cloud Logs" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1056.003", "name": "Web Portal Capture", "display_name": "T1056.003 - Web Portal Capture" }, { "id": "T1512", "name": "Capture Camera", "display_name": "T1512 - Capture Camera" }, { "id": "T1180", "name": "Screensaver", "display_name": "T1180 - Screensaver" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1328, "URL": 9931, "hostname": 2621, "FileHash-MD5": 381, "FileHash-SHA256": 4360, "FileHash-SHA1": 338, "CIDR": 4, "SSLCertFingerprint": 24, "CVE": 1, "email": 1 }, "indicator_count": 18989, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "145 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "692e068ff95076bb8e75bd9f", "name": "Telehealth Exploit", "description": "", "modified": "2025-12-31T21:02:25", "created": "2025-12-01T21:20:15.043000", "tags": [ "passive dns", "urls", "http", "hostname", "files domain", "files related", "pulses none", "related tags", "none google", "safe browsing", "present dec", "status", "date", "united", "name servers", "netherlands", "unknown ns", "ip address", "search", "showing", "local", "data upload", "extraction", "flag", "bad traffic", "et hunting", "domain m2", "suspicious tls", "sni request", "windir", "openurl c", "dns requests", "et info", "tls handshake", "prefetch2", "analysis", "tor analysis", "domain address", "tlsv1", "jfif", "jpeg image", "ascii text", "entries", "as15169", "show", "read c", "write", "next", "persistence", "execution", "crash", "copy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 260, "hostname": 555, "URL": 1803, "FileHash-SHA256": 1437, "FileHash-MD5": 113, "FileHash-SHA1": 13, "email": 4, "SSLCertFingerprint": 18, "CVE": 1 }, "indicator_count": 4204, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "151 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68de7a48636c1d113e6069ff", "name": "911 Call during Remote phone reconfiguration | 3rd Party YouTube | Ransomware", "description": "Tested address. Link based on a 911 call on a known targeted device. Address incorrect but malicious activity found. Hacked device was under an unauthorized reconfiguration over several days. Russian conversion set up, Yandex and a 3rd party YouTube on a device that has never had a YouTube account or any other 3rd party apps.", "modified": "2025-11-01T12:01:18.197000", "created": "2025-10-02T13:12:40.466000", "tags": [ "passive dns", "emails", "servers", "code", "united", "aaaa", "found", "email", "port", "destination", "msie", "windows nt", "wow64", "slcc2", "dock", "write", "execution", "memcommit", "write c", "create c", "delete c", "delete", "april", "trojan", "mtb apr", "ransom", "united states", "hostname", "read c", "users", "win32", "malware", "title", "installer", "america", "password", "injection", "crypt", "zombie", "network", "remote" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Inject.BRDV", "display_name": "Inject.BRDV", "target": null }, { "id": "PSW.Generic11", "display_name": "PSW.Generic11", "target": null }, { "id": "Crypt2.AZDI", "display_name": "Crypt2.AZDI", "target": null }, { "id": "win32:Androp", "display_name": "win32:Androp", "target": null }, { "id": "Trojan:Win32/Zombie", "display_name": "Trojan:Win32/Zombie", "target": "/malware/Trojan:Win32/Zombie" } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1562.003", "name": "Impair Command History Logging", "display_name": "T1562.003 - Impair Command History Logging" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1156", "name": "Malicious Shell Modification", "display_name": "T1156 - Malicious Shell Modification" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "display_name": "T1036.004 - Masquerade Task or Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1122", "name": "Component Object Model Hijacking", "display_name": "T1122 - Component Object Model Hijacking" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1011", "name": "Exfiltration Over Other Network Medium", "display_name": "T1011 - Exfiltration Over Other Network Medium" }, { "id": "T1037.003", "name": "Network Logon Script", "display_name": "T1037.003 - Network Logon Script" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 52, "email": 1, "URL": 172, "hostname": 70, "FileHash-MD5": 155, "FileHash-SHA1": 133, "FileHash-SHA256": 258 }, "indicator_count": 841, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "212 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68d3caa9524bb6b5460615f3", "name": "Legacy.Trojan affects threat researchers networks & portals and/or platforms", "description": "Legacy.Trojan affects threat researchers networks & portals and/or platforms or via platforms as a medium.\n[otx auto populated: Adversaries may be able to gain access to a victim's network through a range of techniques, as well as using a variety of other techniques to evade detection and detection.]\n#honeypot #capture #advesaries #fireeye #github", "modified": "2025-10-24T10:01:25.310000", "created": "2025-09-24T10:40:40.987000", "tags": [ "text drag", "browse to", "select file", "or drop", "yara detections", "runlevel", "av detections", "ids detections", "alerts", "analysis date", "inject", "stncphpphp more", "virustotal api", "comments", "related tags", "passive dns", "republic", "ipv4 add", "location korea", "korea", "asn as9318", "dns resolutions", "pulses otx", "close", "dynamicloader", "backdoor", "tgt session", "reads", "dynamic", "write", "chopper", "pho exploit", "backdoor", "fireeye", "low risk", "drop", "create snapshot", "hangover_appinbot", "kns dropper", "self", "md5 sha256", "google safe", "browsing", "server response", "response code", "vary", "mimikatz", "silence malware", "trojanagent", "legacy", "password", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "initial access", "defense evasion", "spawns", "copy md5", "copy sha1", "copy sha256", "selection", "ascii text", "crlf line", "windir", "openurl c", "appearance code", "password", "urlhttps", "username", "flag", "united", "markmonitor", "github", "server", "date", "click", "apt 1", "high", "read c", "search", "medium", "show", "windows", "cmd c", "ms windows", "next", "copy", "ver", "businesseconomy" ], "references": [ "Files", "Yara : KINS_dropper , apt_win_mutex_apt1 , Hangover_Fuddol , Hangover_Tymtin_Degrab", "Yara: Hangover_Smackdown_various , Hangover_Foler , Hangover_UpdateEx ,", "Yara: Hangover_Smackdown_Downloader , Hangover_Vacrhan_Downloader", "Yara: HKTL_NATBypass_Dec22_1 , power_pe_injection , Mimikatz_Logfile", "Yara: Mimikatz_Strings , Silence_malware_2 , EquationGroup_elgingamble , EquationGroup_cmsd", "Yara: EquationGroup_ebbshave , EquationGroup_eggbasket , EquationGroup_sambal", "Yara: Mimikatz_Logfile SID : * NTLM : Authentication Id : wdigest : Mimikatz_Strings sekurlsa::logonpasswords" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Ireland" ], "malware_families": [ { "id": "Php.Exploit.C99-27", "display_name": "Php.Exploit.C99-27", "target": null }, { "id": "Backdoor:ASP/Chopper.F!dha", "display_name": "Backdoor:ASP/Chopper.F!dha", "target": "/malware/Backdoor:ASP/Chopper.F!dha" }, { "id": "Legacy.Trojan.Agent-37025", "display_name": "Legacy.Trojan.Agent-37025", "target": null }, { "id": "Ver", "display_name": "Ver", "target": null } ], "attack_ids": [ { "id": "T1110.001", "name": "Password Guessing", "display_name": "T1110.001 - Password Guessing" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1110", "name": "Brute Force", "display_name": "T1110 - Brute Force" }, { "id": "T1459", "name": "Device Unlock Code Guessing or Brute Force", "display_name": "T1459 - Device Unlock Code Guessing or Brute Force" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 87, "FileHash-SHA1": 84, "FileHash-SHA256": 1049, "URL": 1688, "hostname": 544, "email": 5, "domain": 292, "CVE": 2 }, "indicator_count": 3751, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "220 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68c5743593a4bcc81dd94b0b", "name": "Fed.PayPal.com - Ransom | Attacks via redirect", "description": "A monitored target, active on various payment platforms for business documented a malicious redirect event 1st seen in 2020. Follows pattern of multiple, critical and ongoing attacks beginning in 2013. In this instance target lost access to PayPal payments. If this is legal, it\u2019s been a grotesque grift. Target was financially and otherwise robbed.\n\n\n#trulymissed #paypal #advesaries #apple #twitter #backdoor #ransom #botnet #reptutationattack", "modified": "2025-10-13T13:27:11.277000", "created": "2025-09-13T13:40:05.671000", "tags": [ "present sep", "virtool", "cryp", "win32", "ip address", "trojan", "ransom", "asn as54113", "passive dns", "msil", "united states", "dynamicloader", "qaeaav12", "high", "qbeipbdii", "write", "paypal", "medium", "search", "vmware", "floodfix", "malware", "united", "mtb apr", "hostname add", "write c", "read c", "yara detections", "upxoepplace", "next", "markus", "april", "ping", "meta http", "content", "gmt server", "th th", "443 ma2592000", "ipv4 add", "url analysis", "urls", "body", "title", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "t1590 gather", "victim network", "status", "name servers", "set cookie", "script urls", "present feb", "cookie", "template", "present oct", "present jul", "present dec", "present jun", "next associated", "urls show", "date checked", "present apr", "url hostname", "united kingdom", "unknown ns", "servers", "great britain", "msr aug", "msr apr", "msr nov", "ite o", "server response", "script script", "files show", "date hash", "avast avg", "creation date", "lcid1033", "sminnotek", "spnvirtualbox", "bvvirtualbox", "present mar", "present nov", "exploit", "error", "server response", "google safe", "results sep", "backdoor", "certificate", "mtb sep", "next http", "scans show", "present may", "results jun", "results jan", "worm", "echo request", "sweep", "payload hello", "world", "ids detections", "cape", "viking", "philis", "et", "torop", "des moines", "contacted hosts", "content reputation", "sabey type", "tulach type", "rexx type", "foundry type", "fred scherr", "twitter", "apple", "monitored target", "financial theft", "psalms 27: 1 - 14" ], "references": [ "fed.paypal.com [redirect for monitored target \u2022 1st documented 2020- still active]", "nr-data.net \u2022 init.ess.apple.com\t\u2022 apple-id-ifind.com \u2022 https://apple-id-ifind.com/\t\u2022 apple-lostandfound.com", "https://www.speakup.it/magazines/places/new-york-city-on-a-budget-big-apple-little-money_2368", "https://login.apple-mac.banugoker.com/cgi-sys/defaultwebpage.cgi \u2022 lsupport-apple.com", "login.apple-mac.banugoker.com \u2022 www.apple-mac.banugoker.com \u2022 http://apple-mac.banugoker.com/", "https://apple-mac.banugoker.com/ \u2022 https://login.apple-mac.banugoker.com/", "http://45.159.189.105/bot/regex \u2022 https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net", "wallpapers-nature.com \u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://wallpapers-nature.com/ tsara-brashears/urlscan-io\t \u2022 https://wallpapers-nature.com/%20tsara-brashears/urlscan-io", "http://www.mof.gov.cn.lxcvc.com/ \u2022 http://www.mohurd.gov.cn.lxcvc.\u2022 com/ \u2022 https://www.csrc.gov.cn.lxcvc.com/", "https://lk-prod-webcol.laika.com.co/category/bog/cat/farmacia/collares-isabelinos/todos/todo-para-mascota/1", "https://twitter.com/PORNO_SEXYBABES \u2022 https://megapornfreehd.com/2025/04/360", "https://57d5.zhanyu66.com/com.slamyugllp.strangerrun.xc.apk/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win32:MalOb-BX\\ [Cryp]", "display_name": "Win32:MalOb-BX\\ [Cryp]", "target": null }, { "id": "Win.Trojan.Fraudpack", "display_name": "Win.Trojan.Fraudpack", "target": null }, { "id": "Fakeav", "display_name": "Fakeav", "target": null }, { "id": "Ransom:MSIL/Genasom.I", "display_name": "Ransom:MSIL/Genasom.I", "target": "/malware/Ransom:MSIL/Genasom.I" }, { "id": "Virtool:Win32/Obfuscator.KI", "display_name": "Virtool:Win32/Obfuscator.KI", "target": "/malware/Virtool:Win32/Obfuscator.KI" }, { "id": "Toga!rfn", "display_name": "Toga!rfn", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Trojan:Win32/Floxif.E", "display_name": "Trojan:Win32/Floxif.E", "target": "/malware/Trojan:Win32/Floxif.E" }, { "id": "Win.Malware.Remoteadmin-7056666-0", "display_name": "Win.Malware.Remoteadmin-7056666-0", "target": null }, { "id": "Floxif", "display_name": "Floxif", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win.Dropper.Unruy-9994363-0", "display_name": "Win.Dropper.Unruy-9994363-0", "target": null }, { "id": "Win.Trojan.Cycler-47", "display_name": "Win.Trojan.Cycler-47", "target": null }, { "id": "Win.Trojan.Clicker-3506", "display_name": "Win.Trojan.Clicker-3506", "target": null }, { "id": "Win.Downloader.Unruy-10026469-0", "display_name": "Win.Downloader.Unruy-10026469-0", "target": null }, { "id": "Trojan:Win32/Floxif.E", "display_name": "Trojan:Win32/Floxif.E", "target": "/malware/Trojan:Win32/Floxif.E" }, { "id": "Win.Malware.Urelas", "display_name": "Win.Malware.Urelas", "target": null }, { "id": "Win.Malware.Zusy", "display_name": "Win.Malware.Zusy", "target": null }, { "id": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn", "display_name": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn", "target": null }, { "id": "Win.Malware.Eclz-9953021-0", "display_name": "Win.Malware.Eclz-9953021-0", "target": null }, { "id": "#Lowfi:SuspiciousSectionName", "display_name": "#Lowfi:SuspiciousSectionName", "target": null }, { "id": "Worm:Win32/Autorun", "display_name": "Worm:Win32/Autorun", "target": "/malware/Worm:Win32/Autorun" }, { "id": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit", "display_name": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit", "target": null }, { "id": "Win.Dropper.Tiggre-9845940-0", "display_name": "Win.Dropper.Tiggre-9845940-0", "target": null }, { "id": "PWS:Win32/QQpass.B!MTB", "display_name": "PWS:Win32/QQpass.B!MTB", "target": "/malware/PWS:Win32/QQpass.B!MTB" }, { "id": "Win.Malware.Sfwx-9853337-0", "display_name": "Win.Malware.Sfwx-9853337-0", "target": null }, { "id": "Backdoor:Win32/Tofsee.T", "display_name": "Backdoor:Win32/Tofsee.T", "target": "/malware/Backdoor:Win32/Tofsee.T" }, { "id": "Trojan:Win32/Kaicorn!rf", "display_name": "Trojan:Win32/Kaicorn!rf", "target": "/malware/Trojan:Win32/Kaicorn!rf" }, { "id": "Win32:Banker", "display_name": "Win32:Banker", "target": null }, { "id": "Worm:Win32/Cambot!rfn", "display_name": "Worm:Win32/Cambot!rfn", "target": "/malware/Worm:Win32/Cambot!rfn" }, { "id": "Win32:Malware", "display_name": "Win32:Malware", "target": null }, { "id": "Win.Malware.Midie-6847892-0", "display_name": "Win.Malware.Midie-6847892-0", "target": null }, { "id": "ET", "display_name": "ET", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1450", "name": "Exploit SS7 to Track Device Location", "display_name": "T1450 - Exploit SS7 to Track Device Location" }, { "id": "T1459", "name": "Device Unlock Code Guessing or Brute Force", "display_name": "T1459 - Device Unlock Code Guessing or Brute Force" }, { "id": "T1401", "name": "Device Administrator Permissions", "display_name": "T1401 - Device Administrator Permissions" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1595", "name": "Active Scanning", "display_name": "T1595 - Active Scanning" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1595.002", "name": "Vulnerability Scanning", "display_name": "T1595.002 - Vulnerability Scanning" }, { "id": "T1464", "name": "Jamming or Denial of Service", "display_name": "T1464 - Jamming or Denial of Service" }, { "id": "T1588.001", "name": "Malware", "display_name": "T1588.001 - Malware" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1321, "URL": 4356, "FileHash-MD5": 759, "FileHash-SHA1": 748, "FileHash-SHA256": 5148, "domain": 1076, "email": 7 }, "indicator_count": 13415, "is_author": false, "is_subscribing": null, "subscriber_count": 146, "modified_text": "231 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://es.pornhat.com/models/the-sex-creator/", "https://meumundogay-com.sexogratis.page/locker", "HYPERTRM.EXE - FileHash-SHA256 21cf992aba3d4adbc8a6bd65337f46a93983fbec8fe0f4639be826571ae469ba", "1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam", "https://avm.de/ Connection: close Content Type: text/html charset=iso 8859 1", "fed.paypal.com [redirect for monitored target \u2022 1st documented 2020- still active]", "Crypt2.AZDI - FileHash-SHA256 62ffd7a3a21a5732870c4ad92fad7287a5270e4a5508752cfef0aa6f9ea30d1f", "login.apple-mac.banugoker.com \u2022 www.apple-mac.banugoker.com \u2022 http://apple-mac.banugoker.com/", "redirector.gvt1.com", "https://www.google.com/sorry/index \u2022 http://g.co/p3p...-> g.co", "https://www.virustotal.com/gui/file/de41f4d690511126ce2b8b5df3c0ffdde792df495ea6bb9fe2fec5f8b175e408/summary", "Copyright \u00a9 Hilgraeve, Inc. 2001 Product Microsoft\u00ae Windows\u00ae Operating System Description HyperTerminal Applet", "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex", "Yara: Mimikatz_Logfile SID : * NTLM : Authentication Id : wdigest : Mimikatz_Strings sekurlsa::logonpasswords", "Win32:Androp - FileHash-MD5 99c6c9564af67a954661ebf6e41391d2", "Is the family allowed to have a funeral for Tsara or print an obituary", "https://wallpapers-nature.com/ tsara-brashears/urlscan-io\t \u2022 https://wallpapers-nature.com/%20tsara-brashears/urlscan-io", "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.", "https://www.meritshealth.com/ Defense.Gov Mobility Co? ", "apple-business.cancom.at", "https://push.adac.passcreator.com/ | passcreator-metrics.e07cc1.flownative.cloud", "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.", "Yara Detections SUSP_Imphash_Mar23_2", "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.", "https://www.passcreator.com/en/apple-wallet-passes", "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov", "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot", "XML: sharedStrings.xml \u2022Text: blacklist-6649dcf91af1d.csv", "ALF:CERT:Adware:Win32/Peapoon Win.Malware.Midie-6847893-0\tTrojanDropper:Win32/Muldrop.V!MTB Win.Malware.Generickdz-9938530-0\tTrojan:Win32/Zombie.A Win.Malware.Genpack-6989317-0\tTrojanDropper:Win32/VB.IL Win.Trojan.VBGeneric-6735875-0\tWorm:Win32/Mofksys", "Subject: DE Certificate Subject: Berlin Certificate Subject", "#LowFi:Tool:Win32/VbsToExeV2E - FileHash-SHA1-2f7189e96cda26dbb6948354667fdd1ad37c04c0", "ET TROJAN Fareit/Pony Downloader Checkin 2\t192.168.56.103\t173.194.113.114", "Can the DoD no questions asked target a SA victim", "Original Name HYPERTRM.EXE Internal Name HyperTrm File Version 5.1.2600.0", "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise", "x-hallmonitor-challenge CgwI-LPQygYQwp6yigISBGuywgs", "ecs-80-158-49-8.reverse.open-telekom-cloud.com", "If someone is believed to be a threat they have right to due process.", "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA", "hattchett.ddns.net", "AVM Computersysteme Vertriebs GmbH Certificate Subject: IT Certificate Subject *.avm.de Certificate Issuer: US", "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67", "Yara: HKTL_NATBypass_Dec22_1 , power_pe_injection , Mimikatz_Logfile", "Yara: EquationGroup_ebbshave , EquationGroup_eggbasket , EquationGroup_sambal", "https://twitter.com/PORNO_SEXYBABES \u2022 https://megapornfreehd.com/2025/04/360", "nr-data.net \u2022 init.ess.apple.com\t\u2022 apple-id-ifind.com \u2022 https://apple-id-ifind.com/\t\u2022 apple-lostandfound.com", "https://lk-prod-webcol.laika.com.co/category/bog/cat/farmacia/collares-isabelinos/todos/todo-para-mascota/1", "Malicious Application Development: herokuappdev.com (Patter match 8 years +)", "https://57d5.zhanyu66.com/com.slamyugllp.strangerrun.xc.apk/", "https://login.apple-mac.banugoker.com/cgi-sys/defaultwebpage.cgi \u2022 lsupport-apple.com", "microsoft-falcon.net", "There is fear in silence or speaking out", "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg", "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/", "https://otx.alienvault.com/indicator/hostname/pegasus.pahamify.com", "Files", "Certificate Issuer: DigiCert Inc Certificate Issuer: |DigiCert SHA2 Secur Server CA", "Inject.BRDV - FileHash-SHA256\t25f639cdaae06656ab5e0cc80512146aa59097439c388dd15e4cc09343d9a283", "https://fritz.box/login | router.box | wlan.box | mesh.box | myfritz.box | https://business.kozow.com/bbox/ |", "https://otx.alienvault.com/indicator/hostname/mx-in-ma.apple.com", "iamrobert.com Y.A.S.", "Yara: Hangover_Smackdown_Downloader , Hangover_Vacrhan_Downloader", "http://www.mof.gov.cn.lxcvc.com/ \u2022 http://www.mohurd.gov.cn.lxcvc.\u2022 com/ \u2022 https://www.csrc.gov.cn.lxcvc.com/", "Yara: Hangover_Smackdown_various , Hangover_Foler , Hangover_UpdateEx ,", "https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210", "https://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV", "https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo", "Yara : KINS_dropper , apt_win_mutex_apt1 , Hangover_Fuddol , Hangover_Tymtin_Degrab", "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?", "direwolf-8b1a1bc476.staging.herokuappdev.com", "https://7849f20f.open.convertkit-mail2.com/68une4gx9xi8h50394ziohpe59okkh9hdg44x", "https://otx.alienvault.com/indicator/ip/3.163.24.10", "Microsoft Corporation: FileVersion: 1.0.0.155 Microsoft Corporation Legal Trademark: Mira Malware", "#LowFi:Tool:Win32/VbsToExeV2E - FileHash-SHA256\tae2fb6755dbf52fa44e427fbe0f29bf541aeedf66656edeb08ba9d7ef1617afc", "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.", "http://applewaebastian.fritz.box/ \u2022 applewaebastian.fritz.box", "\u4e3b\u9875\uff0c\u6574\u4e2a\u4e16\u754c X + < \u2192 C \u2022 hao.360.com/?src=lm&ls=n6abbbb598c ->", "http://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV", "ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System", "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.", "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html", "cb=loaded_h_0&sei=7xhUabPOD4LmwN4P57CMuQc 2025", "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf", "FileHash-SHA256\t9f66cab9d7c581cf2dd28b6ae3178bb3d38975ff257c3ffb67c3e89d0f7135ee", "userlocation-prod.ingress.kors.microsoft-falcon.net ->", "External Hosts: 52.57.183.74\t access.pcspeedcat.com\taccess.pcspeedcat.com\tGermany\tAS16509 amazon.com inc\taccess.pcspeedcat.com Germany AS16509 amazon.", "Comments HyperTerminal \u00ae was developed by Hilgraeve, Inc. for Microsoft", "ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98\t192.168.56.103\t173.194.113.114", "biblegateway.comwww.biblegateway.com \u2022 www.biblegateway.com", "Apple - 162.55.158.153", "https://otx.alienvault.com/indicator/url/https://pegasus.pahamify.com/", "Ip Traffic: TCP 74.125.24.106:80 (googleapis.com) TCP 85.195.91.179:80 (catch-cdn.com) UDP :53", "https://apple-mac.banugoker.com/ \u2022 https://login.apple-mac.banugoker.com/", "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.", "http://24.211.14.182:5555/login.htm?page=%2F | s5wpr2nreqby04v9.myfritz.ne", "I am very upset. Whoever is doing this is sick.", "ET TROJAN Trojan Generic - POST To gate.php with no referer\t192.168.56.103\t173.194.113.114", "Target agreed and complied with all lie detector measures.", "http://45.159.189.105/bot/regex \u2022 https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net", "https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members", "Malicious Application Development: herokuappdev.com (pattern matching spans 8+ years)", "To get future Google Chrome updates, you'll need", "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp", "https://uutiskirje.professiogroup.com/go/54382390-5506438-191003959\u241d", "Office Open XML Spreadsheet: jnlwore.exe \u2022 Office Open: XML Spreadsheet \u2022 logs.xlsx", "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.", "Yara: Mimikatz_Strings , Silence_malware_2 , EquationGroup_elgingamble , EquationGroup_cmsd", "External Hosts: 3.163.24.10\t www.pcspeedcat.com\twww.pcspeedcat.com\tUnited States ASNone", "wallpapers-nature.com \u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com", "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)", "http://b25d1a05.click.convertkit-mail2.com \u2022 https://b25d1a05.click.convertkit-mail2.com", "https://sso.myfritz.net/static/images/icons/apple-touch-icon-76x76.png No", "https://www.speakup.it/magazines/places/new-york-city-on-a-budget-big-apple-little-money_2368", "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf", "http://netuser.joymeng.com/charge_apple/notify", "ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.\t192.168.56.103\t173.194.113.114", "Names: cb=loaded_h_0&sei=7xhUabPOD4LmwN4P57CMuQc", "Google.com sorry not sorry index | https://www.google.com/search", "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf", "#LowFi:Tool:Win32/VbsToExeV2E - FileHash-MD5\t99c8310538a090d2b7e5db3ea22b839a" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Win.trojan.generic", "Win.dropper.unruy-9994363-0", "Win.trojan.fraudpack", "Win.malware.generic-9871124-0", "Alf:heraklezeval:trojan:win32/ymacco.aa47", "Trojan:win32/mira", "Win.trojan.cycler-47", "Pws:win32/qqpass", "Php.exploit.c99-27", "Trojan:win32/qqpass", "Win.malware.speedcat-6957425", "Wormwin32/mofksys.rnd!mtb", "Unruy", "Win.malware.eclz-9953021-0", "Trojan:win32/salgorea.c!mtb", "Androp", "Win32/trickler", "Tofsee", "Trojan:win32/floxif.e", "Alf:heraklezeval:pws:win32/qqpass!rfn", "Worm:win32/cambot!rfn", "Win.downloader.unruy-10026469-0", "Floxif", "Win32:banker", "#lowfi:tool:win32/vbstoexev2e", "Tel:msil/dlsocconsend", "Trojan:win32/salgorea", "Virtool:win32/obfuscator.ki", "Win.malware.urelas", "Worm:win32/yuner.a", "Trojan:win32/zombie", "Zbot", "Legacy.trojan.agent-37025", "Worm:win32/autorun.xfv", "Worm:win32/autorun", "Ransom:msil/genasom.i", "Mydoom checkin", "Trojan:win32/aenjaris.al!bit", "Inject.brdv", "Win.trojan.clicker-3506", "Backdoor:asp/chopper.f!dha", "Win.malware.remoteadmin-7056666-0", "Win32:malware", "Win32:malob-bx\\ [cryp]", "Win.malware.midie-6847892-0", "Trojan:win32/glupteba.mt!mtb", "Upatre", "Trojan:win32/blihan.a", "Psw.generic11", "Pws:win32/qqpass.b!mtb", "Cve 2007695", "Tofsee attack", "Ddos:linux/lightaidra", "Apnic", "Win.malware.zusy", "Win.trojan.zegost", "Trojandropper:win32/vb.il", "Toga!rfn", "#lowfi:suspicioussectionname", "Alf:hstr:trojandownloader:win32/purityscan.a!bit", "Win.malware.sfwx-9853337-0", "Trojandropper:win32/muldrop.v!mtb", "Trojan:win32/agent.ag!mtb", "Backdoor:win32/tofsee.t", "Win32:androp", "Trojan:win32/kaicorn!rf", "Crypt2.azdi", "Ver", "Win.dropper.tiggre-9845940-0", "Fakeav", "Win.malware.barys-6840738-0", "Trojan:win32/eyestye.t", "Malware", "Et", "Alf:hacktool:msil/heartsender.a", "Win.malware.hd0kzai-9985588-0" ], "industries": [ "Telecommunications", "Civil society", "Technology" ], "unique_indicators": 63676 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/adtrafficquality.google", "whois": "http://whois.domaintools.com/adtrafficquality.google", "domain": "adtrafficquality.google", "hostname": "ep2.adtrafficquality.google" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 10, "pulses": [ { "id": "69aa0a62f94a92b5168405c2", "name": "fedpaypal clone Q vashti", "description": "", "modified": "2026-03-06T06:39:27.872000", "created": "2026-03-05T22:57:38.559000", "tags": [ "present sep", "virtool", "cryp", "win32", "ip address", "trojan", "ransom", "asn as54113", "passive dns", "msil", "united states", "dynamicloader", "qaeaav12", "high", "qbeipbdii", "write", "paypal", "medium", "search", "vmware", "floodfix", "malware", "united", "mtb apr", "hostname add", "write c", "read c", "yara detections", "upxoepplace", "next", "markus", "april", "ping", "meta http", "content", "gmt server", "th th", "443 ma2592000", "ipv4 add", "url analysis", "urls", "body", "title", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "t1590 gather", "victim network", "status", "name servers", "set cookie", "script urls", "present feb", "cookie", "template", "present oct", "present jul", "present dec", "present jun", "next associated", "urls show", "date checked", "present apr", "url hostname", "united kingdom", "unknown ns", "servers", "great britain", "msr aug", "msr apr", "msr nov", "ite o", "server response", "script script", "files show", "date hash", "avast avg", "creation date", "lcid1033", "sminnotek", "spnvirtualbox", "bvvirtualbox", "present mar", "present nov", "exploit", "error", "server response", "google safe", "results sep", "backdoor", "certificate", "mtb sep", "next http", "scans show", "present may", "results jun", "results jan", "worm", "echo request", "sweep", "payload hello", "world", "ids detections", "cape", "viking", "philis", "et", "torop", "des moines", "contacted hosts", "content reputation", "sabey type", "tulach type", "rexx type", "foundry type", "fred scherr", "twitter", "apple", "monitored target", "financial theft", "psalms 27: 1 - 14" ], "references": [ "fed.paypal.com [redirect for monitored target \u2022 1st documented 2020- still active]", "nr-data.net \u2022 init.ess.apple.com\t\u2022 apple-id-ifind.com \u2022 https://apple-id-ifind.com/\t\u2022 apple-lostandfound.com", "https://www.speakup.it/magazines/places/new-york-city-on-a-budget-big-apple-little-money_2368", "https://login.apple-mac.banugoker.com/cgi-sys/defaultwebpage.cgi \u2022 lsupport-apple.com", "login.apple-mac.banugoker.com \u2022 www.apple-mac.banugoker.com \u2022 http://apple-mac.banugoker.com/", "https://apple-mac.banugoker.com/ \u2022 https://login.apple-mac.banugoker.com/", "http://45.159.189.105/bot/regex \u2022 https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net", "wallpapers-nature.com \u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://wallpapers-nature.com/ tsara-brashears/urlscan-io\t \u2022 https://wallpapers-nature.com/%20tsara-brashears/urlscan-io", "http://www.mof.gov.cn.lxcvc.com/ \u2022 http://www.mohurd.gov.cn.lxcvc.\u2022 com/ \u2022 https://www.csrc.gov.cn.lxcvc.com/", "https://lk-prod-webcol.laika.com.co/category/bog/cat/farmacia/collares-isabelinos/todos/todo-para-mascota/1", "https://twitter.com/PORNO_SEXYBABES \u2022 https://megapornfreehd.com/2025/04/360", "https://57d5.zhanyu66.com/com.slamyugllp.strangerrun.xc.apk/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win32:MalOb-BX\\ [Cryp]", "display_name": "Win32:MalOb-BX\\ [Cryp]", "target": null }, { "id": "Win.Trojan.Fraudpack", "display_name": "Win.Trojan.Fraudpack", "target": null }, { "id": "Fakeav", "display_name": "Fakeav", "target": null }, { "id": "Ransom:MSIL/Genasom.I", "display_name": "Ransom:MSIL/Genasom.I", "target": "/malware/Ransom:MSIL/Genasom.I" }, { "id": "Virtool:Win32/Obfuscator.KI", "display_name": "Virtool:Win32/Obfuscator.KI", "target": "/malware/Virtool:Win32/Obfuscator.KI" }, { "id": "Toga!rfn", "display_name": "Toga!rfn", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Trojan:Win32/Floxif.E", "display_name": "Trojan:Win32/Floxif.E", "target": "/malware/Trojan:Win32/Floxif.E" }, { "id": "Win.Malware.Remoteadmin-7056666-0", "display_name": "Win.Malware.Remoteadmin-7056666-0", "target": null }, { "id": "Floxif", "display_name": "Floxif", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win.Dropper.Unruy-9994363-0", "display_name": "Win.Dropper.Unruy-9994363-0", "target": null }, { "id": "Win.Trojan.Cycler-47", "display_name": "Win.Trojan.Cycler-47", "target": null }, { "id": "Win.Trojan.Clicker-3506", "display_name": "Win.Trojan.Clicker-3506", "target": null }, { "id": "Win.Downloader.Unruy-10026469-0", "display_name": "Win.Downloader.Unruy-10026469-0", "target": null }, { "id": "Trojan:Win32/Floxif.E", "display_name": "Trojan:Win32/Floxif.E", "target": "/malware/Trojan:Win32/Floxif.E" }, { "id": "Win.Malware.Urelas", "display_name": "Win.Malware.Urelas", "target": null }, { "id": "Win.Malware.Zusy", "display_name": "Win.Malware.Zusy", "target": null }, { "id": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn", "display_name": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn", "target": null }, { "id": "Win.Malware.Eclz-9953021-0", "display_name": "Win.Malware.Eclz-9953021-0", "target": null }, { "id": "#Lowfi:SuspiciousSectionName", "display_name": "#Lowfi:SuspiciousSectionName", "target": null }, { "id": "Worm:Win32/Autorun", "display_name": "Worm:Win32/Autorun", "target": "/malware/Worm:Win32/Autorun" }, { "id": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit", "display_name": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit", "target": null }, { "id": "Win.Dropper.Tiggre-9845940-0", "display_name": "Win.Dropper.Tiggre-9845940-0", "target": null }, { "id": "PWS:Win32/QQpass.B!MTB", "display_name": "PWS:Win32/QQpass.B!MTB", "target": "/malware/PWS:Win32/QQpass.B!MTB" }, { "id": "Win.Malware.Sfwx-9853337-0", "display_name": "Win.Malware.Sfwx-9853337-0", "target": null }, { "id": "Backdoor:Win32/Tofsee.T", "display_name": "Backdoor:Win32/Tofsee.T", "target": "/malware/Backdoor:Win32/Tofsee.T" }, { "id": "Trojan:Win32/Kaicorn!rf", "display_name": "Trojan:Win32/Kaicorn!rf", "target": "/malware/Trojan:Win32/Kaicorn!rf" }, { "id": "Win32:Banker", "display_name": "Win32:Banker", "target": null }, { "id": "Worm:Win32/Cambot!rfn", "display_name": "Worm:Win32/Cambot!rfn", "target": "/malware/Worm:Win32/Cambot!rfn" }, { "id": "Win32:Malware", "display_name": "Win32:Malware", "target": null }, { "id": "Win.Malware.Midie-6847892-0", "display_name": "Win.Malware.Midie-6847892-0", "target": null }, { "id": "ET", "display_name": "ET", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1450", "name": "Exploit SS7 to Track Device Location", "display_name": "T1450 - Exploit SS7 to Track Device Location" }, { "id": "T1459", "name": "Device Unlock Code Guessing or Brute Force", "display_name": "T1459 - Device Unlock Code Guessing or Brute Force" }, { "id": "T1401", "name": "Device Administrator Permissions", "display_name": "T1401 - Device Administrator Permissions" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1595", "name": "Active Scanning", "display_name": "T1595 - Active Scanning" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1595.002", "name": "Vulnerability Scanning", "display_name": "T1595.002 - Vulnerability Scanning" }, { "id": "T1464", "name": "Jamming or Denial of Service", "display_name": "T1464 - Jamming or Denial of Service" }, { "id": "T1588.001", "name": "Malware", "display_name": "T1588.001 - Malware" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" } ], "industries": [], "TLP": "white", "cloned_from": "68c5743593a4bcc81dd94b0b", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1323, "URL": 4360, "FileHash-MD5": 759, "FileHash-SHA1": 748, "FileHash-SHA256": 5148, "domain": 1076, "email": 7 }, "indicator_count": 13421, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "87 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6961a8ed7b492f9e0ba38990", "name": "HeartSender.A and other Malware attacks originating from Palantirs Pahamify Pegasus", "description": "Pahamify Pegasus : HackTool \u2022 Speedcat \u2022 HeartSender.A \u2022 Zbot and other malware found.\nSearc begins with single FileHash referenced below. \nI\u2019m checking the processes and sharing it here one group at a time. Too much research at once could bring Amazon AWS down. Again.", "modified": "2026-02-09T00:04:37.974000", "created": "2026-01-10T01:18:36.999000", "tags": [ "read c", "write c", "port", "destination", "united", "medium", "as16509", "memcommit", "write", "execution", "dock", "persistence", "next executed", "commands graph", "tree", "sample hash", "passive dns", "present jan", "title error", "urls", "files", "date hash", "avast avg", "dynamicloader", "host", "utf8", "unicode text", "crlf line", "binary resource", "ms windows", "search", "intel", "pcspeedcat", "win32", "internal", "malware", "local", "unknown", "get na", "http", "okrnserver", "ip address", "http traffic", "guard", "powershell", "ipv4 add", "servers", "name servers", "capture", "link", "gateway", "tofsee att", "ck ids", "t1055", "injection", "t1071", "protocol", "t1573", "target", "url http", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "adversaries", "spawns", "t1480 execution", "discovery att", "mitre att", "ck matrix", "ascii text", "hybrid", "general", "path", "click", "strings", "high", "etpro malware", "next", "stack", "format", "error", "unicode", "head http", "regsetvalueexa", "qt binary", "resource file", "pe32", "hostile", "unknown aaaa", "unknown ns", "x content", "gmt cache", "domain add", "title", "present sep", "a td", "td tr", "dir td", "td td", "present may", "present jun", "present apr", "present aug", "present oct", "head body", "gmt server", "index", "main", "accept", "status", "th tr", "moved", "record value", "expiration date", "germany unknown", "present dec", "cache control", "present nov", "max age1000000", "cookie", "hosting", "reverse dns", "location france", "france asn", "as16276", "trojandropper", "next associated", "mtb jan", "exploit", "emails", "trojan", "pegasus", "hostname add", "url analysis", "domain", "files ip", "address", "france unknown", "asn as16276", "backdoor", "entries", "setcookie", "twitter", "refloadapihash", "virtool", "show", "displayname", "windows", "rndhex", "tofsee", "stream", "encrypt", "push", "creation date", "france", "date", "body", "pup", "amazon", "amazon aws", "salesforce", "herokuappdev", "google", "igoogle", "monitored target", "cats" ], "references": [ "FileHash-SHA256\t9f66cab9d7c581cf2dd28b6ae3178bb3d38975ff257c3ffb67c3e89d0f7135ee", "https://otx.alienvault.com/indicator/ip/3.163.24.10", "External Hosts: 52.57.183.74\t access.pcspeedcat.com\taccess.pcspeedcat.com\tGermany\tAS16509 amazon.com inc\taccess.pcspeedcat.com Germany AS16509 amazon.", "External Hosts: 3.163.24.10\t www.pcspeedcat.com\twww.pcspeedcat.com\tUnited States ASNone", "https://otx.alienvault.com/indicator/hostname/pegasus.pahamify.com", "https://otx.alienvault.com/indicator/url/https://pegasus.pahamify.com/", "https://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV", "http://www.biblegateway.com/passage/?search=2%20Timothy%203&version=NIV", "biblegateway.comwww.biblegateway.com \u2022 www.biblegateway.com", "Malicious Application Development: herokuappdev.com (Patter match 8 years +)", "direwolf-8b1a1bc476.staging.herokuappdev.com", "Malicious Application Development: herokuappdev.com (pattern matching spans 8+ years)" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Generic-9871124-0", "display_name": "Win.Malware.Generic-9871124-0", "target": null }, { "id": "ALF:HackTool:MSIL/HeartSender.A", "display_name": "ALF:HackTool:MSIL/HeartSender.A", "target": null }, { "id": "Win.Malware.Speedcat-6957425", "display_name": "Win.Malware.Speedcat-6957425", "target": null }, { "id": "Tofsee Attack", "display_name": "Tofsee Attack", "target": null }, { "id": "Zbot", "display_name": "Zbot", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1192", "name": "Spearphishing Link", "display_name": "T1192 - Spearphishing Link" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1608", "name": "Stage Capabilities", "display_name": "T1608 - Stage Capabilities" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" } ], "industries": [ "Civil Society", "Telecommunications", "Technology" ], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 404, "FileHash-SHA1": 286, "FileHash-SHA256": 1419, "SSLCertFingerprint": 7, "domain": 441, "URL": 4233, "hostname": 1217, "email": 10 }, "indicator_count": 8017, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "112 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69544c73467a9c3858556698", "name": "Mira Malware Drive By Compromise Google.com search engine | Microsoft | Apple", "description": "Microsoft Mira Malware Drive By Compromise Google.com.\n Device infected with MyDoom zombie maker. \nEstablished user location, screen captures, corrupted Apple device via Google search engine browser redirect. Attack began 12.30.2025 past midnight. Threat actor powered on cameras, microphones, and preformed their hacker intentions. #stateofcolorado", "modified": "2026-01-29T21:02:54.448000", "created": "2025-12-30T22:04:35.565000", "tags": [ "content", "kb body", "p3p cp", "date tue", "gmt server", "html info", "12.30.2025", "urls", "url add", "http", "ip address", "related nids", "files location", "united", "flag united", "handle", "address range", "cidr", "network name", "allocation type", "assigned pa", "status", "whois server", "ripe ncc", "ripe network", "abuse contact", "orgid", "address", "orgabuseref", "postalcode", "ripe", "email", "flag", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "dns requests", "domain address", "contacted hosts", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "found", "ssl certificate", "execution", "google llc", "ascii text", "mitre att", "hybrid", "general", "local", "path", "click", "strings", "data upload", "extraction", "ta0004", "evasion ta0005", "injection t1055", "t1055", "col ta0011", "l t1071", "encrypted ch", "t1573", "present nov", "present oct", "certificate", "present dec", "aaaa", "search", "servers", "record value", "emails", "title", "leveidiuelabs", "include", "review", "exclude data", "suggested ogs", "find s", "command decode", "development att", "initial access", "t1189 driveby", "html", "execution att", "href", "size", "pattern match", "filehash", "md5 add", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "file score", "medium risk", "malware", "trojan", "mira malware", "push", "dynamicloader", "windows nt", "msie", "wow64", "slcc2", "media center", "yara rule", "program", "runtime error", "medium", "python", "win64", "unknown", "guard", "accept", "write", "launcher", "updater", "smartassembly", "delphi", "ee fc", "ff d5", "f0 ff", "eb e1", "ff ff", "c1 e8", "c1 c0", "eb e8", "copy", "next", "mydoom checkin", "win32mydoom dec", "name servers", "creation date", "passive dns", "domain", "expiration date", "hostname", "date", "google chrome", "screen capture", "locate human", "target", "black hat", "apple", "microsoft", "google", "stateofcolorado", "christopher ahmann", "brian sabey" ], "references": [ "Google.com sorry not sorry index | https://www.google.com/search", "cb=loaded_h_0&sei=7xhUabPOD4LmwN4P57CMuQc 2025", "redirector.gvt1.com", "Names: cb=loaded_h_0&sei=7xhUabPOD4LmwN4P57CMuQc", "microsoft-falcon.net", "hattchett.ddns.net", "Office Open XML Spreadsheet: jnlwore.exe \u2022 Office Open: XML Spreadsheet \u2022 logs.xlsx", "XML: sharedStrings.xml \u2022Text: blacklist-6649dcf91af1d.csv", "https://www.virustotal.com/gui/file/de41f4d690511126ce2b8b5df3c0ffdde792df495ea6bb9fe2fec5f8b175e408/summary", "x-hallmonitor-challenge CgwI-LPQygYQwp6yigISBGuywgs", "https://www.google.com/sorry/index \u2022 http://g.co/p3p...-> g.co", "https://7849f20f.open.convertkit-mail2.com/68une4gx9xi8h50394ziohpe59okkh9hdg44x", "Microsoft Corporation: FileVersion: 1.0.0.155 Microsoft Corporation Legal Trademark: Mira Malware", "Yara Detections SUSP_Imphash_Mar23_2", "https://otx.alienvault.com/indicator/hostname/mx-in-ma.apple.com", "userlocation-prod.ingress.kors.microsoft-falcon.net ->", "\u4e3b\u9875\uff0c\u6574\u4e2a\u4e16\u754c X + < \u2192 C \u2022 hao.360.com/?src=lm&ls=n6abbbb598c ->", "To get future Google Chrome updates, you'll need" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan:Win32/Mira", "display_name": "Trojan:Win32/Mira", "target": "/malware/Trojan:Win32/Mira" }, { "id": "Upatre", "display_name": "Upatre", "target": null }, { "id": "Mydoom Checkin", "display_name": "Mydoom Checkin", "target": null } ], "attack_ids": [ { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1608.004", "name": "Drive-by Target", "display_name": "T1608.004 - Drive-by Target" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1048.001", "name": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol", "display_name": "T1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1939, "hostname": 1205, "URL": 3310, "domain": 432, "FileHash-MD5": 396, "CIDR": 3, "email": 16, "FileHash-SHA1": 373, "SSLCertFingerprint": 13, "CVE": 1 }, "indicator_count": 7688, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "122 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6940b852c28f2a2c6abb4aad", "name": "FRITZ!Box \u2026.Connecting to Apple devices", "description": "Connecting to targeted Apple\ndevices overnight. \n\nHow to connect to the FRITZ!Box, how to access all of the product's functions, and what to do with the device if you are not connected to it in your home network.", "modified": "2026-01-15T01:02:47.757000", "created": "2025-12-16T01:39:30.381000", "tags": [ "fritz", "strong", "main navigation", "deutsch", "englisch", "funktionen der", "verbindung zur", "wifi", "ip address", "box avm", "lowfi", "win32", "susp", "urls", "files", "asn as44716", "related tags", "indicator facts", "germany unknown", "a domains", "meta", "typo3", "body doctype", "kasper skaarhoj", "gmt server", "pragma", "a nxdomain", "nxdomain", "whitelisted", "present aug", "present jul", "present oct", "present jun", "united", "present sep", "present nov", "next http", "scans show", "title", "div div", "a li", "wir suchen", "li ul", "avm karriere", "dich a", "reverse dns", "berlin", "germany asn", "dns resolutions", "domains top", "level", "unique tlds", "related pulses", "none related", "passive dns", "ipv4", "url analysis", "present dec", "moved", "certificate", "vertriebs gmbh", "aaaa", "as12732 gutcon", "domain", "hostname", "verdict", "files ip", "address", "germany", "as13335", "as8220 colt", "present may", "united kingdom", "regsetvalueexa", "regdword", "regbinary", "show", "yara detections", "regsetvalueexw", "regsz", "medium", "suspicious", "delphi", "malware", "write", "as6878", "msie", "chrome", "gmt content", "germany showing", "createobject", "set http", "search", "high", "read c", "et trojan", "jfif", "ascii text", "detected", "trojan generic", "checkin", "pony downloader", "http library", "virustotal", "riskware", "mcafee", "drweb", "vipre", "trojan", "panda", "next", "unknown", "as15169 google", "status", "name servers", "record value", "emails", "error", "trojandropper", "results dec", "ddos", "worm", "mtb trojan", "mtb apr", "exev2e", "ia256", "extraction", "get http", "post http", "learn", "command", "ck id", "name tactics", "informative", "spawns", "mitre att", "ck techniques", "evasion att", "germany germany", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "dns requests", "domain address", "contacted hosts", "pattern match", "show technique", "ck matrix", "show process", "network traffic", "t1057", "t1071", "hybrid", "local", "path", "t1204 user", "defense evasion", "t1480 execution", "sha1", "sha256", "size", "script", "null", "span", "refresh", "footer", "body", "june", "general", "click", "strings", "tools", "tracker", "code", "look", "verify", "restart", "bad traffic", "et info", "tls handshake", "failure", "process details", "flag", "link", "present feb", "servers", "redacted for", "as20546 soprado", "encrypt", "mtb sep", "ransom", "next associated", "twitter", "virtool", "hostname add", "location russia", "as200350", "russia unknown", "federation flag", "ipv4 add", "asn as200350", "related", "domain add", "unknown ns", "expiration date", "http version", "windows nt", "gbot", "post method", "port", "destination", "delete", "get na", "as15169", "expiration", "url https", "no expiration", "showing", "entries", "url add", "pulse pulses", "http", "files domain", "files related", "pulses none", "unknown cname", "cname", "asn as24940", "less", "date", "pulse submit" ], "references": [ "https://fritz.box/login | router.box | wlan.box | mesh.box | myfritz.box | https://business.kozow.com/bbox/ |", "https://avm.de/ Connection: close Content Type: text/html charset=iso 8859 1", "AVM Computersysteme Vertriebs GmbH Certificate Subject: IT Certificate Subject *.avm.de Certificate Issuer: US", "Certificate Issuer: DigiCert Inc Certificate Issuer: |DigiCert SHA2 Secur Server CA", "Subject: DE Certificate Subject: Berlin Certificate Subject", "https://uutiskirje.professiogroup.com/go/54382390-5506438-191003959\u241d", "http://b25d1a05.click.convertkit-mail2.com \u2022 https://b25d1a05.click.convertkit-mail2.com", "https://push.adac.passcreator.com/ | passcreator-metrics.e07cc1.flownative.cloud", "ecs-80-158-49-8.reverse.open-telekom-cloud.com", "http://24.211.14.182:5555/login.htm?page=%2F | s5wpr2nreqby04v9.myfritz.ne", "HYPERTRM.EXE - FileHash-SHA256 21cf992aba3d4adbc8a6bd65337f46a93983fbec8fe0f4639be826571ae469ba", "Copyright \u00a9 Hilgraeve, Inc. 2001 Product Microsoft\u00ae Windows\u00ae Operating System Description HyperTerminal Applet", "Original Name HYPERTRM.EXE Internal Name HyperTrm File Version 5.1.2600.0", "Comments HyperTerminal \u00ae was developed by Hilgraeve, Inc. for Microsoft", "ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System", "ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.\t192.168.56.103\t173.194.113.114", "ET TROJAN Trojan Generic - POST To gate.php with no referer\t192.168.56.103\t173.194.113.114", "ET TROJAN Fareit/Pony Downloader Checkin 2\t192.168.56.103\t173.194.113.114", "ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98\t192.168.56.103\t173.194.113.114", "http://applewaebastian.fritz.box/ \u2022 applewaebastian.fritz.box", "http://netuser.joymeng.com/charge_apple/notify", "https://www.passcreator.com/en/apple-wallet-passes", "https://sso.myfritz.net/static/images/icons/apple-touch-icon-76x76.png No", "apple-business.cancom.at", "Apple - 162.55.158.153", "Crypt2.AZDI - FileHash-SHA256 62ffd7a3a21a5732870c4ad92fad7287a5270e4a5508752cfef0aa6f9ea30d1f", "Inject.BRDV - FileHash-SHA256\t25f639cdaae06656ab5e0cc80512146aa59097439c388dd15e4cc09343d9a283", "Win32:Androp - FileHash-MD5 99c6c9564af67a954661ebf6e41391d2", "#LowFi:Tool:Win32/VbsToExeV2E - FileHash-MD5\t99c8310538a090d2b7e5db3ea22b839a", "#LowFi:Tool:Win32/VbsToExeV2E - FileHash-SHA1-2f7189e96cda26dbb6948354667fdd1ad37c04c0", "#LowFi:Tool:Win32/VbsToExeV2E - FileHash-SHA256\tae2fb6755dbf52fa44e427fbe0f29bf541aeedf66656edeb08ba9d7ef1617afc", "Ip Traffic: TCP 74.125.24.106:80 (googleapis.com) TCP 85.195.91.179:80 (catch-cdn.com) UDP :53", "ALF:CERT:Adware:Win32/Peapoon Win.Malware.Midie-6847893-0\tTrojanDropper:Win32/Muldrop.V!MTB Win.Malware.Generickdz-9938530-0\tTrojan:Win32/Zombie.A Win.Malware.Genpack-6989317-0\tTrojanDropper:Win32/VB.IL Win.Trojan.VBGeneric-6735875-0\tWorm:Win32/Mofksys" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "#LowFi:Tool:Win32/VbsToExeV2E", "display_name": "#LowFi:Tool:Win32/VbsToExeV2E", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Androp", "display_name": "Androp", "target": null }, { "id": "Inject.BRDV", "display_name": "Inject.BRDV", "target": null }, { "id": "Win32:Androp", "display_name": "Win32:Androp", "target": null }, { "id": "Crypt2.AZDI", "display_name": "Crypt2.AZDI", "target": null }, { "id": "TEL:MSIL/DlSocConSend", "display_name": "TEL:MSIL/DlSocConSend", "target": "/malware/TEL:MSIL/DlSocConSend" }, { "id": "DDOS:Linux/Lightaidra", "display_name": "DDOS:Linux/Lightaidra", "target": "/malware/DDOS:Linux/Lightaidra" }, { "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47", "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47", "target": null }, { "id": "Trojan:Win32/Salgorea.C!MTB", "display_name": "Trojan:Win32/Salgorea.C!MTB", "target": "/malware/Trojan:Win32/Salgorea.C!MTB" }, { "id": "Worm:Win32/Autorun.XFV", "display_name": "Worm:Win32/Autorun.XFV", "target": "/malware/Worm:Win32/Autorun.XFV" }, { "id": "Trojan:Win32/Blihan.A", "display_name": "Trojan:Win32/Blihan.A", "target": "/malware/Trojan:Win32/Blihan.A" }, { "id": "Worm:Win32/Yuner.A", "display_name": "Worm:Win32/Yuner.A", "target": "/malware/Worm:Win32/Yuner.A" }, { "id": "Win.Trojan.Zegost", "display_name": "Win.Trojan.Zegost", "target": null }, { "id": "PWS:Win32/QQpass", "display_name": "PWS:Win32/QQpass", "target": "/malware/PWS:Win32/QQpass" }, { "id": "Trojan:Win32/Glupteba.MT!MTB", "display_name": "Trojan:Win32/Glupteba.MT!MTB", "target": "/malware/Trojan:Win32/Glupteba.MT!MTB" }, { "id": "Trojan:Win32/QQpass", "display_name": "Trojan:Win32/QQpass", "target": "/malware/Trojan:Win32/QQpass" }, { "id": "Win.Trojan.Generic", "display_name": "Win.Trojan.Generic", "target": null }, { "id": "TrojanDropper:Win32/Muldrop.V!MTB", "display_name": "TrojanDropper:Win32/Muldrop.V!MTB", "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB" }, { "id": "Win32/Trickler", "display_name": "Win32/Trickler", "target": null }, { "id": "Win.Malware.Hd0kzai-9985588-0", "display_name": "Win.Malware.Hd0kzai-9985588-0", "target": null }, { "id": "Trojan:Win32/Aenjaris.AL!bit", "display_name": "Trojan:Win32/Aenjaris.AL!bit", "target": "/malware/Trojan:Win32/Aenjaris.AL!bit" }, { "id": "Trojan:Win32/Agent.AG!MTB", "display_name": "Trojan:Win32/Agent.AG!MTB", "target": "/malware/Trojan:Win32/Agent.AG!MTB" }, { "id": "Trojan:Win32/Salgorea", "display_name": "Trojan:Win32/Salgorea", "target": "/malware/Trojan:Win32/Salgorea" }, { "id": "Win.Malware.Barys-6840738-0", "display_name": "Win.Malware.Barys-6840738-0", "target": null }, { "id": "Unruy", "display_name": "Unruy", "target": null }, { "id": "Trojan:Win32/EyeStye.T", "display_name": "Trojan:Win32/EyeStye.T", "target": "/malware/Trojan:Win32/EyeStye.T" }, { "id": "wormWin32/Mofksys.RND!MTB", "display_name": "wormWin32/Mofksys.RND!MTB", "target": null }, { "id": "TrojanDropper:Win32/VB.IL", "display_name": "TrojanDropper:Win32/VB.IL", "target": "/malware/TrojanDropper:Win32/VB.IL" }, { "id": "CVE 2007695", "display_name": "CVE 2007695", "target": null } ], "attack_ids": [ { "id": "T1008", "name": "Fallback Channels", "display_name": "T1008 - Fallback Channels" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 927, "hostname": 2093, "FileHash-SHA256": 1474, "URL": 5935, "FileHash-MD5": 351, "FileHash-SHA1": 252, "email": 5, "CVE": 1, "SSLCertFingerprint": 2 }, "indicator_count": 11040, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "137 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e2bb5d9ee8577ab5519f2c", "name": "Meritshealth with DoD links? ", "description": "", "modified": "2026-01-13T00:05:56.401000", "created": "2025-10-05T18:39:25.286000", "tags": [ "gtmk5nxqc6", "utc amazon", "utc na", "acceptencoding", "gmt contenttype", "connection", "true pragma", "gmt setcookie", "httponly", "gmt vary", "nc000000 up", "html document", "unicode text", "utf8 text", "oc0006 http", "http traffic", "https http", "mitre att", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "number", "ja3s", "algorithm", "azure rsa", "tls issuing", "cus subject", "stwa lredmond", "cnmicrosoft ecc", "update secure", "server ca", "omicrosoft cus", "get http", "dns resolutions", "registrar", "markmonitor inc", "country", "resolver domain", "type name", "html", "apnic", "apnic whois", "please", "rirs", "cidr", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "development att", "name tactics", "binary file", "ck matrix", "wheelchair", "iamrobert", "pattern match", "ascii text", "href", "united", "general", "local", "path", "encrypt", "click", "passive dns", "urls", "files", "reverse dns", "netherlands", "present aug", "a domains", "moved", "first pqc", "ip address", "unknown ns", "unknown aaaa", "title", "body", "meta", "window", "accept", "body doctype", "welcome", "ok server", "gmt content", "present jul", "present sep", "aaaa", "hostname", "error", "defense evasion", "windows nt", "response", "vary", "strings", "core", "t1027.013 encrypted/encoded", "michelin lazy k", "prefetch8", "flag", "date", "starfield", "hybrid", "mobility cr", "extraction", "data upload", "include", "o url", "url url", "included i0", "review ioc", "excluded ic", "suggested", "find sugi", "failed", "cre pul", "enter", "enter sc", "type", "enric", "extra", "type opaste", "data u", "included", "copy md5", "copy sha1", "copy sha256", "null", "refresh", "tools", "look", "verify", "restart", "t1480 execution", "expiration", "url https", "no expiration", "iocs", "ipv4", "text drag", "drop or", "browse to", "select file", "redacted for", "server", "privacy tech", "privacy admin", "postal code", "stateprovince", "organization", "email", "code", "quantum rooms", "sam somalia", "emp", "porn", "media defense", "gov porn", "suck my nips", "reimer suspect", "jeffrey reimer", "dod", "department of defense", "show", "date checked", "url hostname", "server response", "google safe", "results may", "entries http", "scans record", "value status", "sabey type", "merits fake", "y.a.s.", "pornography", "ramsom" ], "references": [ "https://www.meritshealth.com/ Defense.Gov Mobility Co? ", "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67", "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf", "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf", "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html", "https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com", "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/", "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp", "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg", "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)", "https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members", "https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210", "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex", "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf", "https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo", "https://meumundogay-com.sexogratis.page/locker", "https://es.pornhat.com/models/the-sex-creator/", "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA", "Can the DoD no questions asked target a SA victim", "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.", "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise", "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov", "There is fear in silence or speaking out", "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.", "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?", "If someone is believed to be a threat they have right to due process.", "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.", "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.", "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.", "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.", "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot", "iamrobert.com Y.A.S.", "1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam", "Target agreed and complied with all lie detector measures.", "Is the family allowed to have a funeral for Tsara or print an obituary", "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.", "I am very upset. Whoever is doing this is sick." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "TA0042", "name": "Resource Development", "display_name": "TA0042 - Resource Development" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1591", "name": "Gather Victim Org Information", "display_name": "T1591 - Gather Victim Org Information" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "display_name": "T1562.004 - Disable or Modify System Firewall" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1562.008", "name": "Disable Cloud Logs", "display_name": "T1562.008 - Disable Cloud Logs" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1056.003", "name": "Web Portal Capture", "display_name": "T1056.003 - Web Portal Capture" }, { "id": "T1512", "name": "Capture Camera", "display_name": "T1512 - Capture Camera" }, { "id": "T1180", "name": "Screensaver", "display_name": "T1180 - Screensaver" } ], "industries": [], "TLP": "white", "cloned_from": "68e2b14d83bb63502feac65e", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1365, "URL": 11172, "hostname": 2780, "FileHash-MD5": 381, "FileHash-SHA256": 4420, "FileHash-SHA1": 338, "CIDR": 4, "SSLCertFingerprint": 24, "CVE": 1, "email": 1 }, "indicator_count": 20486, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "139 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68e2b14d83bb63502feac65e", "name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.", "description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech needed. Later denies ever being a mobility technician. They killed a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?", "modified": "2026-01-07T00:00:30.717000", "created": "2025-10-05T17:56:29.109000", "tags": [ "gtmk5nxqc6", "utc amazon", "utc na", "acceptencoding", "gmt contenttype", "connection", "true pragma", "gmt setcookie", "httponly", "gmt vary", "nc000000 up", "html document", "unicode text", "utf8 text", "oc0006 http", "http traffic", "https http", "mitre att", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "number", "ja3s", "algorithm", "azure rsa", "tls issuing", "cus subject", "stwa lredmond", "cnmicrosoft ecc", "update secure", "server ca", "omicrosoft cus", "get http", "dns resolutions", "registrar", "markmonitor inc", "country", "resolver domain", "type name", "html", "apnic", "apnic whois", "please", "rirs", "cidr", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "development att", "name tactics", "binary file", "ck matrix", "wheelchair", "iamrobert", "pattern match", "ascii text", "href", "united", "general", "local", "path", "encrypt", "click", "passive dns", "urls", "files", "reverse dns", "netherlands", "present aug", "a domains", "moved", "first pqc", "ip address", "unknown ns", "unknown aaaa", "title", "body", "meta", "window", "accept", "body doctype", "welcome", "ok server", "gmt content", "present jul", "present sep", "aaaa", "hostname", "error", "defense evasion", "windows nt", "response", "vary", "strings", "core", "t1027.013 encrypted/encoded", "michelin lazy k", "prefetch8", "flag", "date", "starfield", "hybrid", "mobility cr", "extraction", "data upload", "include", "o url", "url url", "included i0", "review ioc", "excluded ic", "suggested", "find sugi", "failed", "cre pul", "enter", "enter sc", "type", "enric", "extra", "type opaste", "data u", "included", "copy md5", "copy sha1", "copy sha256", "null", "refresh", "tools", "look", "verify", "restart", "t1480 execution", "expiration", "url https", "no expiration", "iocs", "ipv4", "text drag", "drop or", "browse to", "select file", "redacted for", "server", "privacy tech", "privacy admin", "postal code", "stateprovince", "organization", "email", "code", "quantum rooms", "sam somalia", "emp", "porn", "media defense", "gov porn", "suck my nips", "reimer suspect", "jeffrey reimer", "dod", "department of defense", "show", "date checked", "url hostname", "server response", "google safe", "results may", "entries http", "scans record", "value status", "sabey type", "merits fake", "y.a.s.", "pornography", "ramsom" ], "references": [ "https://www.meritshealth.com/ Defense.Gov Mobility Co? ", "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67", "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf", "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf", "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html", "https://pornokind.vgt.pl \u2022 https://cdn2.video.itsyourporn.com", "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/", "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp", "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg", "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)", "https://www2.itsyourporn.com/license.php \u2022 https://www.lovephoto.tw/members", "https://members.engine.com/login \u2022 https://members.engine.com/payment-details/220210", "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex", "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf", "https://maisexo-com.putaria.info/casting \u2022 https://contosadultos-club.sexogratis.page/tudo", "https://meumundogay-com.sexogratis.page/locker", "https://es.pornhat.com/models/the-sex-creator/", "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA", "Can the DoD no questions asked target a SA victim", "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.", "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise", "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov", "There is fear in silence or speaking out", "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.", "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?", "If someone is believed to be a threat they have right to due process.", "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.", "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.", "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.", "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.", "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot", "iamrobert.com Y.A.S.", "1.2016 M.Brian Sabey filed a complaint about? Jeffrey Reimer refused Lie detector test and False memory exam", "Target agreed and complied with all lie detector measures.", "Is the family allowed to have a funeral for Tsara or print an obituary", "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.", "I am very upset. Whoever is doing this is sick." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "TA0042", "name": "Resource Development", "display_name": "TA0042 - Resource Development" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1591", "name": "Gather Victim Org Information", "display_name": "T1591 - Gather Victim Org Information" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "display_name": "T1562.004 - Disable or Modify System Firewall" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1562.008", "name": "Disable Cloud Logs", "display_name": "T1562.008 - Disable Cloud Logs" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1056.003", "name": "Web Portal Capture", "display_name": "T1056.003 - Web Portal Capture" }, { "id": "T1512", "name": "Capture Camera", "display_name": "T1512 - Capture Camera" }, { "id": "T1180", "name": "Screensaver", "display_name": "T1180 - Screensaver" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1328, "URL": 9931, "hostname": 2621, "FileHash-MD5": 381, "FileHash-SHA256": 4360, "FileHash-SHA1": 338, "CIDR": 4, "SSLCertFingerprint": 24, "CVE": 1, "email": 1 }, "indicator_count": 18989, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "145 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "692e068ff95076bb8e75bd9f", "name": "Telehealth Exploit", "description": "", "modified": "2025-12-31T21:02:25", "created": "2025-12-01T21:20:15.043000", "tags": [ "passive dns", "urls", "http", "hostname", "files domain", "files related", "pulses none", "related tags", "none google", "safe browsing", "present dec", "status", "date", "united", "name servers", "netherlands", "unknown ns", "ip address", "search", "showing", "local", "data upload", "extraction", "flag", "bad traffic", "et hunting", "domain m2", "suspicious tls", "sni request", "windir", "openurl c", "dns requests", "et info", "tls handshake", "prefetch2", "analysis", "tor analysis", "domain address", "tlsv1", "jfif", "jpeg image", "ascii text", "entries", "as15169", "show", "read c", "write", "next", "persistence", "execution", "crash", "copy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 260, "hostname": 555, "URL": 1803, "FileHash-SHA256": 1437, "FileHash-MD5": 113, "FileHash-SHA1": 13, "email": 4, "SSLCertFingerprint": 18, "CVE": 1 }, "indicator_count": 4204, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "151 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68de7a48636c1d113e6069ff", "name": "911 Call during Remote phone reconfiguration | 3rd Party YouTube | Ransomware", "description": "Tested address. Link based on a 911 call on a known targeted device. Address incorrect but malicious activity found. Hacked device was under an unauthorized reconfiguration over several days. Russian conversion set up, Yandex and a 3rd party YouTube on a device that has never had a YouTube account or any other 3rd party apps.", "modified": "2025-11-01T12:01:18.197000", "created": "2025-10-02T13:12:40.466000", "tags": [ "passive dns", "emails", "servers", "code", "united", "aaaa", "found", "email", "port", "destination", "msie", "windows nt", "wow64", "slcc2", "dock", "write", "execution", "memcommit", "write c", "create c", "delete c", "delete", "april", "trojan", "mtb apr", "ransom", "united states", "hostname", "read c", "users", "win32", "malware", "title", "installer", "america", "password", "injection", "crypt", "zombie", "network", "remote" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Inject.BRDV", "display_name": "Inject.BRDV", "target": null }, { "id": "PSW.Generic11", "display_name": "PSW.Generic11", "target": null }, { "id": "Crypt2.AZDI", "display_name": "Crypt2.AZDI", "target": null }, { "id": "win32:Androp", "display_name": "win32:Androp", "target": null }, { "id": "Trojan:Win32/Zombie", "display_name": "Trojan:Win32/Zombie", "target": "/malware/Trojan:Win32/Zombie" } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1562.003", "name": "Impair Command History Logging", "display_name": "T1562.003 - Impair Command History Logging" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1156", "name": "Malicious Shell Modification", "display_name": "T1156 - Malicious Shell Modification" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "display_name": "T1036.004 - Masquerade Task or Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1122", "name": "Component Object Model Hijacking", "display_name": "T1122 - Component Object Model Hijacking" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1011", "name": "Exfiltration Over Other Network Medium", "display_name": "T1011 - Exfiltration Over Other Network Medium" }, { "id": "T1037.003", "name": "Network Logon Script", "display_name": "T1037.003 - Network Logon Script" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 52, "email": 1, "URL": 172, "hostname": 70, "FileHash-MD5": 155, "FileHash-SHA1": 133, "FileHash-SHA256": 258 }, "indicator_count": 841, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "212 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68d3caa9524bb6b5460615f3", "name": "Legacy.Trojan affects threat researchers networks & portals and/or platforms", "description": "Legacy.Trojan affects threat researchers networks & portals and/or platforms or via platforms as a medium.\n[otx auto populated: Adversaries may be able to gain access to a victim's network through a range of techniques, as well as using a variety of other techniques to evade detection and detection.]\n#honeypot #capture #advesaries #fireeye #github", "modified": "2025-10-24T10:01:25.310000", "created": "2025-09-24T10:40:40.987000", "tags": [ "text drag", "browse to", "select file", "or drop", "yara detections", "runlevel", "av detections", "ids detections", "alerts", "analysis date", "inject", "stncphpphp more", "virustotal api", "comments", "related tags", "passive dns", "republic", "ipv4 add", "location korea", "korea", "asn as9318", "dns resolutions", "pulses otx", "close", "dynamicloader", "backdoor", "tgt session", "reads", "dynamic", "write", "chopper", "pho exploit", "backdoor", "fireeye", "low risk", "drop", "create snapshot", "hangover_appinbot", "kns dropper", "self", "md5 sha256", "google safe", "browsing", "server response", "response code", "vary", "mimikatz", "silence malware", "trojanagent", "legacy", "password", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "initial access", "defense evasion", "spawns", "copy md5", "copy sha1", "copy sha256", "selection", "ascii text", "crlf line", "windir", "openurl c", "appearance code", "password", "urlhttps", "username", "flag", "united", "markmonitor", "github", "server", "date", "click", "apt 1", "high", "read c", "search", "medium", "show", "windows", "cmd c", "ms windows", "next", "copy", "ver", "businesseconomy" ], "references": [ "Files", "Yara : KINS_dropper , apt_win_mutex_apt1 , Hangover_Fuddol , Hangover_Tymtin_Degrab", "Yara: Hangover_Smackdown_various , Hangover_Foler , Hangover_UpdateEx ,", "Yara: Hangover_Smackdown_Downloader , Hangover_Vacrhan_Downloader", "Yara: HKTL_NATBypass_Dec22_1 , power_pe_injection , Mimikatz_Logfile", "Yara: Mimikatz_Strings , Silence_malware_2 , EquationGroup_elgingamble , EquationGroup_cmsd", "Yara: EquationGroup_ebbshave , EquationGroup_eggbasket , EquationGroup_sambal", "Yara: Mimikatz_Logfile SID : * NTLM : Authentication Id : wdigest : Mimikatz_Strings sekurlsa::logonpasswords" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Ireland" ], "malware_families": [ { "id": "Php.Exploit.C99-27", "display_name": "Php.Exploit.C99-27", "target": null }, { "id": "Backdoor:ASP/Chopper.F!dha", "display_name": "Backdoor:ASP/Chopper.F!dha", "target": "/malware/Backdoor:ASP/Chopper.F!dha" }, { "id": "Legacy.Trojan.Agent-37025", "display_name": "Legacy.Trojan.Agent-37025", "target": null }, { "id": "Ver", "display_name": "Ver", "target": null } ], "attack_ids": [ { "id": "T1110.001", "name": "Password Guessing", "display_name": "T1110.001 - Password Guessing" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1110", "name": "Brute Force", "display_name": "T1110 - Brute Force" }, { "id": "T1459", "name": "Device Unlock Code Guessing or Brute Force", "display_name": "T1459 - Device Unlock Code Guessing or Brute Force" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 87, "FileHash-SHA1": 84, "FileHash-SHA256": 1049, "URL": 1688, "hostname": 544, "email": 5, "domain": 292, "CVE": 2 }, "indicator_count": 3751, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "220 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68c5743593a4bcc81dd94b0b", "name": "Fed.PayPal.com - Ransom | Attacks via redirect", "description": "A monitored target, active on various payment platforms for business documented a malicious redirect event 1st seen in 2020. Follows pattern of multiple, critical and ongoing attacks beginning in 2013. In this instance target lost access to PayPal payments. If this is legal, it\u2019s been a grotesque grift. Target was financially and otherwise robbed.\n\n\n#trulymissed #paypal #advesaries #apple #twitter #backdoor #ransom #botnet #reptutationattack", "modified": "2025-10-13T13:27:11.277000", "created": "2025-09-13T13:40:05.671000", "tags": [ "present sep", "virtool", "cryp", "win32", "ip address", "trojan", "ransom", "asn as54113", "passive dns", "msil", "united states", "dynamicloader", "qaeaav12", "high", "qbeipbdii", "write", "paypal", "medium", "search", "vmware", "floodfix", "malware", "united", "mtb apr", "hostname add", "write c", "read c", "yara detections", "upxoepplace", "next", "markus", "april", "ping", "meta http", "content", "gmt server", "th th", "443 ma2592000", "ipv4 add", "url analysis", "urls", "body", "title", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "t1590 gather", "victim network", "status", "name servers", "set cookie", "script urls", "present feb", "cookie", "template", "present oct", "present jul", "present dec", "present jun", "next associated", "urls show", "date checked", "present apr", "url hostname", "united kingdom", "unknown ns", "servers", "great britain", "msr aug", "msr apr", "msr nov", "ite o", "server response", "script script", "files show", "date hash", "avast avg", "creation date", "lcid1033", "sminnotek", "spnvirtualbox", "bvvirtualbox", "present mar", "present nov", "exploit", "error", "server response", "google safe", "results sep", "backdoor", "certificate", "mtb sep", "next http", "scans show", "present may", "results jun", "results jan", "worm", "echo request", "sweep", "payload hello", "world", "ids detections", "cape", "viking", "philis", "et", "torop", "des moines", "contacted hosts", "content reputation", "sabey type", "tulach type", "rexx type", "foundry type", "fred scherr", "twitter", "apple", "monitored target", "financial theft", "psalms 27: 1 - 14" ], "references": [ "fed.paypal.com [redirect for monitored target \u2022 1st documented 2020- still active]", "nr-data.net \u2022 init.ess.apple.com\t\u2022 apple-id-ifind.com \u2022 https://apple-id-ifind.com/\t\u2022 apple-lostandfound.com", "https://www.speakup.it/magazines/places/new-york-city-on-a-budget-big-apple-little-money_2368", "https://login.apple-mac.banugoker.com/cgi-sys/defaultwebpage.cgi \u2022 lsupport-apple.com", "login.apple-mac.banugoker.com \u2022 www.apple-mac.banugoker.com \u2022 http://apple-mac.banugoker.com/", "https://apple-mac.banugoker.com/ \u2022 https://login.apple-mac.banugoker.com/", "http://45.159.189.105/bot/regex \u2022 https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net", "wallpapers-nature.com \u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://wallpapers-nature.com/ tsara-brashears/urlscan-io\t \u2022 https://wallpapers-nature.com/%20tsara-brashears/urlscan-io", "http://www.mof.gov.cn.lxcvc.com/ \u2022 http://www.mohurd.gov.cn.lxcvc.\u2022 com/ \u2022 https://www.csrc.gov.cn.lxcvc.com/", "https://lk-prod-webcol.laika.com.co/category/bog/cat/farmacia/collares-isabelinos/todos/todo-para-mascota/1", "https://twitter.com/PORNO_SEXYBABES \u2022 https://megapornfreehd.com/2025/04/360", "https://57d5.zhanyu66.com/com.slamyugllp.strangerrun.xc.apk/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win32:MalOb-BX\\ [Cryp]", "display_name": "Win32:MalOb-BX\\ [Cryp]", "target": null }, { "id": "Win.Trojan.Fraudpack", "display_name": "Win.Trojan.Fraudpack", "target": null }, { "id": "Fakeav", "display_name": "Fakeav", "target": null }, { "id": "Ransom:MSIL/Genasom.I", "display_name": "Ransom:MSIL/Genasom.I", "target": "/malware/Ransom:MSIL/Genasom.I" }, { "id": "Virtool:Win32/Obfuscator.KI", "display_name": "Virtool:Win32/Obfuscator.KI", "target": "/malware/Virtool:Win32/Obfuscator.KI" }, { "id": "Toga!rfn", "display_name": "Toga!rfn", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Trojan:Win32/Floxif.E", "display_name": "Trojan:Win32/Floxif.E", "target": "/malware/Trojan:Win32/Floxif.E" }, { "id": "Win.Malware.Remoteadmin-7056666-0", "display_name": "Win.Malware.Remoteadmin-7056666-0", "target": null }, { "id": "Floxif", "display_name": "Floxif", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win.Dropper.Unruy-9994363-0", "display_name": "Win.Dropper.Unruy-9994363-0", "target": null }, { "id": "Win.Trojan.Cycler-47", "display_name": "Win.Trojan.Cycler-47", "target": null }, { "id": "Win.Trojan.Clicker-3506", "display_name": "Win.Trojan.Clicker-3506", "target": null }, { "id": "Win.Downloader.Unruy-10026469-0", "display_name": "Win.Downloader.Unruy-10026469-0", "target": null }, { "id": "Trojan:Win32/Floxif.E", "display_name": "Trojan:Win32/Floxif.E", "target": "/malware/Trojan:Win32/Floxif.E" }, { "id": "Win.Malware.Urelas", "display_name": "Win.Malware.Urelas", "target": null }, { "id": "Win.Malware.Zusy", "display_name": "Win.Malware.Zusy", "target": null }, { "id": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn", "display_name": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn", "target": null }, { "id": "Win.Malware.Eclz-9953021-0", "display_name": "Win.Malware.Eclz-9953021-0", "target": null }, { "id": "#Lowfi:SuspiciousSectionName", "display_name": "#Lowfi:SuspiciousSectionName", "target": null }, { "id": "Worm:Win32/Autorun", "display_name": "Worm:Win32/Autorun", "target": "/malware/Worm:Win32/Autorun" }, { "id": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit", "display_name": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit", "target": null }, { "id": "Win.Dropper.Tiggre-9845940-0", "display_name": "Win.Dropper.Tiggre-9845940-0", "target": null }, { "id": "PWS:Win32/QQpass.B!MTB", "display_name": "PWS:Win32/QQpass.B!MTB", "target": "/malware/PWS:Win32/QQpass.B!MTB" }, { "id": "Win.Malware.Sfwx-9853337-0", "display_name": "Win.Malware.Sfwx-9853337-0", "target": null }, { "id": "Backdoor:Win32/Tofsee.T", "display_name": "Backdoor:Win32/Tofsee.T", "target": "/malware/Backdoor:Win32/Tofsee.T" }, { "id": "Trojan:Win32/Kaicorn!rf", "display_name": "Trojan:Win32/Kaicorn!rf", "target": "/malware/Trojan:Win32/Kaicorn!rf" }, { "id": "Win32:Banker", "display_name": "Win32:Banker", "target": null }, { "id": "Worm:Win32/Cambot!rfn", "display_name": "Worm:Win32/Cambot!rfn", "target": "/malware/Worm:Win32/Cambot!rfn" }, { "id": "Win32:Malware", "display_name": "Win32:Malware", "target": null }, { "id": "Win.Malware.Midie-6847892-0", "display_name": "Win.Malware.Midie-6847892-0", "target": null }, { "id": "ET", "display_name": "ET", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1450", "name": "Exploit SS7 to Track Device Location", "display_name": "T1450 - Exploit SS7 to Track Device Location" }, { "id": "T1459", "name": "Device Unlock Code Guessing or Brute Force", "display_name": "T1459 - Device Unlock Code Guessing or Brute Force" }, { "id": "T1401", "name": "Device Administrator Permissions", "display_name": "T1401 - Device Administrator Permissions" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1595", "name": "Active Scanning", "display_name": "T1595 - Active Scanning" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1595.002", "name": "Vulnerability Scanning", "display_name": "T1595.002 - Vulnerability Scanning" }, { "id": "T1464", "name": "Jamming or Denial of Service", "display_name": "T1464 - Jamming or Denial of Service" }, { "id": "T1588.001", "name": "Malware", "display_name": "T1588.001 - Malware" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1321, "URL": 4356, "FileHash-MD5": 759, "FileHash-SHA1": 748, "FileHash-SHA256": 5148, "domain": 1076, "email": 7 }, "indicator_count": 13415, "is_author": false, "is_subscribing": null, "subscriber_count": 146, "modified_text": "231 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://ep2.adtrafficquality.google/sodar/sodar2.js5x", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://ep2.adtrafficquality.google/sodar/sodar2.js5x", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780347707.4491026 }