{ "type": "URL", "indicator": "https://fb.me/react-polyfills", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://fb.me/react-polyfills", "type": "url", "type_title": "URL", "validation": [ { "source": "akamai", "message": "Akamai rank: #5703", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain fb.me", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain fb.me", "name": "Whitelisted domain" }, { "source": "newssite", "message": "Whitelisted news domain fb.com", "name": "Whitelisted newssite network domain" } ], "base_indicator": { "id": 2811781597, "indicator": "https://fb.me/react-polyfills", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 13, "pulses": [ { "id": "65c0333a4bab9053ba0e22d7", "name": "TrickBot| Miscellaneous Attack of a Medical Practice | Mitre", "description": "Targets a medical facility. Could only be accessed via IExplorer. \nFacility did experience full shutdown and reboot of system, lights, in January. \n\n\u2022TrickBot is a banking Trojan that can steal financial details, account credentials, and personally identifiable information (PII), as well as spread within a network and drop ransomware, particularly Ryuk", "modified": "2024-03-06T00:01:49.984000", "created": "2024-02-05T01:00:42.017000", "tags": [ "pattern match", "et tor", "known tor", "relayrouter", "exit", "node traffic", "misc attack", "ascii text", "script", "united", "date", "error", "unknown", "span", "meta", "hybrid", "null", "general", "local", "click", "strings", "this", "legacy", "false", "window", "suricata", "mitre", "command scripting", "status", "moved", "search", "record value", "cname", "scan endpoints", "all octoseek", "body", "network", "exploit", "shellcode", "name verdict", "u4e0b", "falcon sandbox", "falcon", "malware", "no data", "tag count", "threat report", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "count blacklist", "passive dns", "urls", "domain", "all search", "otx octoseek", "hostname", "pulse pulses", "files", "files ip", "a nxdomain", "ip address", "ip related", "remote cnc", "contacted", "pe resource", "threat roundup", "whois record", "execution", "communicating", "copy", "whois whois", "november", "august", "february", "banker", "keylogger", "lockbit", "probe", "remcos", "core", "trickbot", "threat analyzer", "threat", "paste", "iocs", "hostnames", "urls https", "phone call", "trigger" ], "references": [ "https://www.crccolorado.com/", "https://www.hybrid-analysis.com/sample/6e6e4b61b6c658dafe9b59b235d13d12eaa955c719720529b44d530c83032a8a/65bff4553336954b380dbba5", "https://www.malwarebytes.com/trickbot", "Potential E-Mail address found in binary/memory", "\"focus-within-polyfill@5.0.9\" | \"core-js-bundle@3.2.1\" | \"lodash@4.17.21\"| \"react@16.14.0\" | \"react-dom@16.14.0\"", "https://static.wixstatic.com/media/fe5868_7bec5131ba084565b6999f47dafd9737.png/v1/fill/w_180%2Ch_180%2Clg_1%2Cusm_0.66_1.00_0.01/fe5868_7bec5131ba084565b6999f47dafd9737.png [\"apple touch icon\"]", "slice.call", "object.prototype.hasownproperty.call", "rock.mit-license.org [pattern match]", "https://www.google.com/intl/en/chrome/\" Pattern match: \"https://static.parastorage.com/services/wix-thunderbolt/dist/originTrials.41d7301a.bundle.min.js.map [network]", "https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[VerticalLine_ClassicVerticalSolidLine].67fb182e.min.css", "https://static.parastorage.com/services/wix-thunderbolt/dist/main.c1956e3f.min.css [device-mo]", "camsadultsgetwet.com", "firecams.com", "window.fedops.data" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic.Malware", "display_name": "Generic.Malware", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "TrickBot", "display_name": "TrickBot", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1156", "name": "Malicious Shell Modification", "display_name": "T1156 - Malicious Shell Modification" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" } ], "industries": [ "Healthcare" ], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 171, "FileHash-SHA1": 151, "URL": 179, "domain": 159, "email": 2, "hostname": 150, "FileHash-SHA256": 599, "CVE": 1 }, "indicator_count": 1412, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "816 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65c0333c1ff113786c4610d0", "name": "TrickBot| Miscellaneous Attack of a Medical Practice | Mitre", "description": "Targets a medical facility. Could only be accessed via IExplorer. \nFacility did experience full shutdown and reboot of system, lights, in January. \n\n\u2022TrickBot is a banking Trojan that can steal financial details, account credentials, and personally identifiable information (PII), as well as spread within a network and drop ransomware, particularly Ryuk", "modified": "2024-03-06T00:01:49.984000", "created": "2024-02-05T01:00:44.679000", "tags": [ "pattern match", "et tor", "known tor", "relayrouter", "exit", "node traffic", "misc attack", "ascii text", "script", "united", "date", "error", "unknown", "span", "meta", "hybrid", "null", "general", "local", "click", "strings", "this", "legacy", "false", "window", "suricata", "mitre", "command scripting", "status", "moved", "search", "record value", "cname", "scan endpoints", "all octoseek", "body", "network", "exploit", "shellcode", "name verdict", "u4e0b", "falcon sandbox", "falcon", "malware", "no data", "tag count", "threat report", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "count blacklist", "passive dns", "urls", "domain", "all search", "otx octoseek", "hostname", "pulse pulses", "files", "files ip", "a nxdomain", "ip address", "ip related", "remote cnc", "contacted", "pe resource", "threat roundup", "whois record", "execution", "communicating", "copy", "whois whois", "november", "august", "february", "banker", "keylogger", "lockbit", "probe", "remcos", "core", "trickbot", "threat analyzer", "threat", "paste", "iocs", "hostnames", "urls https", "phone call", "trigger" ], "references": [ "https://www.crccolorado.com/", "https://www.hybrid-analysis.com/sample/6e6e4b61b6c658dafe9b59b235d13d12eaa955c719720529b44d530c83032a8a/65bff4553336954b380dbba5", "https://www.malwarebytes.com/trickbot", "Potential E-Mail address found in binary/memory", "\"focus-within-polyfill@5.0.9\" | \"core-js-bundle@3.2.1\" | \"lodash@4.17.21\"| \"react@16.14.0\" | \"react-dom@16.14.0\"", "https://static.wixstatic.com/media/fe5868_7bec5131ba084565b6999f47dafd9737.png/v1/fill/w_180%2Ch_180%2Clg_1%2Cusm_0.66_1.00_0.01/fe5868_7bec5131ba084565b6999f47dafd9737.png [\"apple touch icon\"]", "slice.call", "object.prototype.hasownproperty.call", "rock.mit-license.org [pattern match]", "https://www.google.com/intl/en/chrome/\" Pattern match: \"https://static.parastorage.com/services/wix-thunderbolt/dist/originTrials.41d7301a.bundle.min.js.map [network]", "https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[VerticalLine_ClassicVerticalSolidLine].67fb182e.min.css", "https://static.parastorage.com/services/wix-thunderbolt/dist/main.c1956e3f.min.css [device-mo]", "camsadultsgetwet.com", "firecams.com", "window.fedops.data" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic.Malware", "display_name": "Generic.Malware", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "TrickBot", "display_name": "TrickBot", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1156", "name": "Malicious Shell Modification", "display_name": "T1156 - Malicious Shell Modification" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" } ], "industries": [ "Healthcare" ], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 171, "FileHash-SHA1": 151, "URL": 179, "domain": 159, "email": 2, "hostname": 150, "FileHash-SHA256": 599, "CVE": 1 }, "indicator_count": 1412, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "816 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65c09e0a6f1a6c10a715a6f2", "name": "TrickBot| Miscellaneous Attack of a Medical Practice | Mitre", "description": "", "modified": "2024-03-06T00:01:49.984000", "created": "2024-02-05T08:36:26.703000", "tags": [ "pattern match", "et tor", "known tor", "relayrouter", "exit", "node traffic", "misc attack", "ascii text", "script", "united", "date", "error", "unknown", "span", "meta", "hybrid", "null", "general", "local", "click", "strings", "this", "legacy", "false", "window", "suricata", "mitre", "command scripting", "status", "moved", "search", "record value", "cname", "scan endpoints", "all octoseek", "body", "network", "exploit", "shellcode", "name verdict", "u4e0b", "falcon sandbox", "falcon", "malware", "no data", "tag count", "threat report", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "count blacklist", "passive dns", "urls", "domain", "all search", "otx octoseek", "hostname", "pulse pulses", "files", "files ip", "a nxdomain", "ip address", "ip related", "remote cnc", "contacted", "pe resource", "threat roundup", "whois record", "execution", "communicating", "copy", "whois whois", "november", "august", "february", "banker", "keylogger", "lockbit", "probe", "remcos", "core", "trickbot", "threat analyzer", "threat", "paste", "iocs", "hostnames", "urls https", "phone call", "trigger" ], "references": [ "https://www.crccolorado.com/", "https://www.hybrid-analysis.com/sample/6e6e4b61b6c658dafe9b59b235d13d12eaa955c719720529b44d530c83032a8a/65bff4553336954b380dbba5", "https://www.malwarebytes.com/trickbot", "Potential E-Mail address found in binary/memory", "\"focus-within-polyfill@5.0.9\" | \"core-js-bundle@3.2.1\" | \"lodash@4.17.21\"| \"react@16.14.0\" | \"react-dom@16.14.0\"", "https://static.wixstatic.com/media/fe5868_7bec5131ba084565b6999f47dafd9737.png/v1/fill/w_180%2Ch_180%2Clg_1%2Cusm_0.66_1.00_0.01/fe5868_7bec5131ba084565b6999f47dafd9737.png [\"apple touch icon\"]", "slice.call", "object.prototype.hasownproperty.call", "rock.mit-license.org [pattern match]", "https://www.google.com/intl/en/chrome/\" Pattern match: \"https://static.parastorage.com/services/wix-thunderbolt/dist/originTrials.41d7301a.bundle.min.js.map [network]", "https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[VerticalLine_ClassicVerticalSolidLine].67fb182e.min.css", "https://static.parastorage.com/services/wix-thunderbolt/dist/main.c1956e3f.min.css [device-mo]", "camsadultsgetwet.com", "firecams.com", "window.fedops.data" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic.Malware", "display_name": "Generic.Malware", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "TrickBot", "display_name": "TrickBot", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1156", "name": "Malicious Shell Modification", "display_name": "T1156 - Malicious Shell Modification" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" } ], "industries": [ "Healthcare" ], "TLP": "white", "cloned_from": "65c0333c1ff113786c4610d0", "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 171, "FileHash-SHA1": 151, "URL": 179, "domain": 159, "email": 2, "hostname": 150, "FileHash-SHA256": 599, "CVE": 1 }, "indicator_count": 1412, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "816 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a819664c2499fc2adc79", "name": "BLOG | cloak-and-dagger | Page 4 of 8", "description": "", "modified": "2023-12-06T16:58:01.198000", "created": "2023-12-06T16:58:01.198000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 4, "FileHash-SHA256": 1664, "FileHash-MD5": 367, "FileHash-SHA1": 237, "domain": 1950, "URL": 6466, "hostname": 2346, "email": 1 }, "indicator_count": 13035, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a60cd4985a30bf050572", "name": "Search Engines \u2022 Portals \u2022 Search Engines \u2022 Mobile Communications \u2022 searchengines", "description": "", "modified": "2023-12-06T16:49:16.153000", "created": "2023-12-06T16:49:16.153000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-SHA256": 930, "domain": 74, "hostname": 340, "URL": 567, "FileHash-MD5": 360, "FileHash-SHA1": 185 }, "indicator_count": 2458, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708dff34f37412488dda2a", "name": "Digital Ocean", "description": "", "modified": "2023-12-06T15:06:38.991000", "created": "2023-12-06T15:06:38.991000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 703, "domain": 734, "URL": 5116, "hostname": 1266, "email": 3 }, "indicator_count": 7823, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "652214c652025febf66cde33", "name": "BLOG | cloak-and-dagger | Page 4 of 8", "description": "C2 | scanning_host | Malicious|", "modified": "2023-11-07T01:01:57.592000", "created": "2023-10-08T02:32:38.609000", "tags": [ "ssl certificate", "whois record", "historical ssl", "threat roundup", "whois whois", "october", "referrer", "resolutions", "december", "september", "hacktool", "united", "anonymizer", "firehol", "microsoft", "phishing site", "malware site", "paypal", "latam", "phishing", "malicious site", "myetherwallet", "heur", "malware", "zeus", "zbot", "facebook", "artemis", "bank", "bradesco", "riskware", "download", "telecom", "dropper", "emotet", "formbook", "cisco umbrella", "site", "safe site", "blacklist https", "generic malware", "detection list", "blacklist", "generic", "pe resource", "contacted", "red team", "whois", "execution", "skynet", "u4e0b", "falcon sandbox", "flag", "date", "server", "name server", "markmonitor", "domain address", "gandi sas", "mesh digital", "vimeo", "static engine", "alexa top", "million", "adwarex", "alexa", "xrat", "downldr", "presenoker", "maltiverse", "ocidmy01rz", "runtime process", "copy md5", "sha1", "copy sha1", "copy sha256" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 367, "FileHash-SHA1": 237, "FileHash-SHA256": 1664, "URL": 6466, "domain": 1950, "hostname": 2346, "CVE": 4, "email": 1 }, "indicator_count": 13035, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f15cbb17119f3334c0c57", "name": "BLOG | cloak-and-dagger | Page 4 of 8", "description": "", "modified": "2023-11-07T01:01:57.592000", "created": "2023-10-30T02:32:43.922000", "tags": [ "ssl certificate", "whois record", "historical ssl", "threat roundup", "whois whois", "october", "referrer", "resolutions", "december", "september", "hacktool", "united", "anonymizer", "firehol", "microsoft", "phishing site", "malware site", "paypal", "latam", "phishing", "malicious site", "myetherwallet", "heur", "malware", "zeus", "zbot", "facebook", "artemis", "bank", "bradesco", "riskware", "download", "telecom", "dropper", "emotet", "formbook", "cisco umbrella", "site", "safe site", "blacklist https", "generic malware", "detection list", "blacklist", "generic", "pe resource", "contacted", "red team", "whois", "execution", "skynet", "u4e0b", "falcon sandbox", "flag", "date", "server", "name server", "markmonitor", "domain address", "gandi sas", "mesh digital", "vimeo", "static engine", "alexa top", "million", "adwarex", "alexa", "xrat", "downldr", "presenoker", "maltiverse", "ocidmy01rz", "runtime process", "copy md5", "sha1", "copy sha1", "copy sha256" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" } ], "industries": [], "TLP": "green", "cloned_from": "652214c652025febf66cde33", "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 367, "FileHash-SHA1": 237, "FileHash-SHA256": 1664, "URL": 6466, "domain": 1950, "hostname": 2346, "CVE": 4, "email": 1 }, "indicator_count": 13035, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "650f714b099ee92d73840f63", "name": "Search Engines \u2022 Portals \u2022 Search Engines \u2022 Mobile Communications \u2022 searchengines", "description": "Scanning Host \u2022 Malware Site \u2022 Phishing \u2022 Malicious site", "modified": "2023-10-23T21:01:17.695000", "created": "2023-09-23T23:14:18.638000", "tags": [ "united", "anonymizer", "detection list", "ip address", "blacklist", "firehol proxy", "firehol south", "credit union", "team", "proxy", "cisco umbrella", "site", "safe site", "malware site", "malicious site", "alexa top", "million", "malware", "phishing site", "suspected", "unruy", "riskware", "artemis", "phishing", "bank", "alexa", "union", "pony", "catalina", "opencandy", "cleaner", "service", "runescape", "facebook", "download", "iframe", "downldr", "agent", "presenoker", "unsafe", "blacklist https", "noname057", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "malicious url" ], "references": [ "https://www.bing.com/images/search?view=detailV2&id=11DBB9C6633FBE863EC959A64A0934887FA7C481&thid=OIP.1ZMj0U28ecIgZMtxvGo2FAHaEK&exph=450&expw=800&q=Tsara+Brashears+Defeats+Jeffrey+Reimer&selectedindex=2&adt=1&vt=4&eim=0,3,4,6/CAR-BOMB-DEATH-THREAT-AFTER-TSARA-BRASHEARS-PREVAILS-AGAINST-JEFFREY-REIMER-DPT-SEXUAL-MISCONDUCT", "Hybrid Analysis", "Online Research", "WebTools" ], "public": 1, "adversary": "NoName057", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "ALF:PUA:Win32/Catalina", "display_name": "ALF:PUA:Win32/Catalina", "target": null }, { "id": "Backdoor:PHP/Artemis", "display_name": "Backdoor:PHP/Artemis", "target": "/malware/Backdoor:PHP/Artemis" }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "target": null }, { "id": "Pony - S0453", "display_name": "Pony - S0453", "target": null }, { "id": "ALF:Program:OpenCandy:Remnant", "display_name": "ALF:Program:OpenCandy:Remnant", "target": null } ], "attack_ids": [ { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 567, "FileHash-SHA256": 930, "domain": 74, "hostname": 340, "CVE": 2, "FileHash-SHA1": 185, "FileHash-MD5": 360 }, "indicator_count": 2458, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "950 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64766c6ffe0d936205c28197", "name": "miniwallet.bundle.js", "description": "confused cause hybrid scsn is clean", "modified": "2023-06-29T21:05:11.335000", "created": "2023-05-30T21:36:47.160000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "memoryfile scan", "ansi", "error", "runtime data", "highlight", "typeof e", "highlighttext", "windir", "graytext", "typeof symbol", "null", "date", "unknown", "path", "suspicious", "roboto", "meta", "4096", "span", "local", "scroll", "backspace", "insert", "this", "april", "hybrid", "model", "close", "click", "general", "strings", "team", "qakbot", "cookie" ], "references": [ "https://hybrid-analysis.com/sample/78a7e765ffd6dff7af3b92b6234271fd0dddf5945f38e70d0e22324c1ec06eca/64414afe0ebb5831a20ce8f0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 25, "domain": 131, "URL": 23, "CVE": 1, "FileHash-MD5": 5, "FileHash-SHA1": 2, "FileHash-SHA256": 5 }, "indicator_count": 192, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1066 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64766c71a5f740aaa9c915aa", "name": "miniwallet.bundle.js", "description": "confused cause hybrid scsn is clean", "modified": "2023-06-29T21:05:11.335000", "created": "2023-05-30T21:36:49.562000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "memoryfile scan", "ansi", "error", "runtime data", "highlight", "typeof e", "highlighttext", "windir", "graytext", "typeof symbol", "null", "date", "unknown", "path", "suspicious", "roboto", "meta", "4096", "span", "local", "scroll", "backspace", "insert", "this", "april", "hybrid", "model", "close", "click", "general", "strings", "team", "qakbot", "cookie" ], "references": [ "https://hybrid-analysis.com/sample/78a7e765ffd6dff7af3b92b6234271fd0dddf5945f38e70d0e22324c1ec06eca/64414afe0ebb5831a20ce8f0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 25, "domain": 131, "URL": 23, "CVE": 1, "FileHash-MD5": 5, "FileHash-SHA1": 2, "FileHash-SHA256": 5 }, "indicator_count": 192, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "1066 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63b580a925bb698985fa83ea", "name": "vendor.bundle.js", "description": "", "modified": "2023-02-03T13:00:02.804000", "created": "2023-01-04T13:35:37.535000", "tags": [ "vxstream", "trojan", "apt", "memoryfile scan", "error", "progresstype", "graytext", "typeof e", "highlight", "bg96gwp", "typeof", "window", "null", "date", "span", "path", "meta", "push", "unknown", "roboto", "scroll", "suspicious", "close", "light", "template", "abcd", "android", "trident", "backspace", "insert", "4096", "void", "legend", "iframe", "webview", "infinity", "ransomware", "malicious", "accept toggle", "voice", "upgrade" ], "references": [ "https://hybrid-analysis.com/sample/f90162e65235185a24e9f20d855371b8ad7462d50d7a57851d000cfd5116f76d", "This website contains the details of an anti-virus scan conducted by the MetaDefender, which aims to identify and remove malware from websites, websites and social media sites, including Facebook, Twitter and YouTube.", "original dropped file discovery url", "http://lifehacker.com/assets/stylesheets/app-a873b056f0ea955e4ff0abebb210e5a6.css", "Making HTTPS connections using insecure TLS/SSL version details Connection was make using TLSv1.1 [tls.handshake.version: 0x00000302] source Network Traffic relevance 10/10 ATT&CK ID T1573 (Show technique in the MITRE ATT&CK\u2122 matrix)", "https://hybrid-analysis.com/sample/f90162e65235185a24e9f20d855371b8ad7462d50d7a57851d000cfd5116f76d/63aef1a83e3bb16765527bb8" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 205, "URL": 1340, "FileHash-SHA256": 407, "hostname": 491, "FileHash-MD5": 8, "email": 1, "FileHash-SHA1": 1 }, "indicator_count": 2453, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1213 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "627fe16ae54614d3d59de881", "name": "Digital Ocean", "description": "\u2026", "modified": "2022-06-13T00:00:32.864000", "created": "2022-05-14T17:05:46.360000", "tags": [ "min", "qe", "photostatus", "hero stripe", "object", "boolean", "license", "urlsearchparams", "typeof t", "events", "pattrick hper", "bsd3clause", "typeerror", "react", "date", "error", "this", "flex", "open", "facebook", "close", "february", "april", "june", "august", "dead", "frozen", "blank", "null", "mutation", "roboto", "4096", "unknown", "clock", "period", "footer", "android", "service", "invisible", "sphinx", "checkbox", "click", "typeof e", "referenceerror", "typeof symbol", "router", "function", "intl", "push", "body", "meta", "string", "url path", "url object", "full", "url api", "nativeurl", "searchparams", "copyright", "closure library", "includes code", "regexp", "html", "plugindetect", "jeff mott", "quicktime", "flash shockwave", "vlc adobereader", "span", "or conditions", "post", "array", "apache license", "version", "this code", "is provided", "on an", "ud83d", "ud83e", "u2695u2696u2708", "udc66udc67", "udc68udc69", "ud83c", "dfunction", "typeof u", "u2640u2642", "9000", "typeof r", "weakmap", "asyncfunction", "proxy", "customevent", "uint8array", "09af", "ver0", "tag0", "extdata0", "ua ch", "window", "documentcookie", "typeof self", "blob", "promise", "reduceright", "number", "l420", "gnp82xmkw0p", "json", "void", "public", "github", "meetup", "swarm", "jump", "sign", "releases", "packages", "contributors", "topics", "star", "contact", "code", "stars" ], "references": [ "xfe-URL-Meetup.com_pro_digitalocean_-stix2-2.1-export.json", "https://github.com/meetup/swarm-ui", "https://www.googletagmanager.com/gtag/js?id=G-NP82XMKW0P&l=dataLayer&cx=c", "https://www.meetup.com/proxydirectory/tags/239562121304/tag.js", "https://www.meetup.com/pro_static/en-US/0.f2cf4c3f.js", "https://dna8twue3dlxq.cloudfront.net/js/profitwell.js", "https://cdn.sift.com/s.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/922061185/?random=1652546907471&cv=9&fst=1652546907471&num=1&label=BaPJCIf2_WYQgZPWtwM&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=2&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg5b0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.meetup.com%2FDigitalOceanMoscow%2F&ref=https%3A%2F%2Fwww.meetup.com%2Fpro%2Fdigitalocean%2F&tiba=DigitalOcean%20Moscow%20(Moscow%2C%20Russia)%20%7C%20Meetup&hn=www.googleadser", "https://cdn.polyfill.io/v2/polyfill.min.js?features=default-3.6,fetch,Intl,Intl.~locale.en-US,Array.prototype.find,Array.prototype.includes,Object.values&flags=gated", "https://www.meetup.com/mu_static/react.ddd38c26.js", "https://www.meetup.com/mu_static/en-US/app.0ff22766.js", "xfe-URL-Sift.com-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "MIN", "display_name": "MIN", "target": null }, { "id": "PhotoStatus", "display_name": "PhotoStatus", "target": null }, { "id": "Qe", "display_name": "Qe", "target": null }, { "id": "Hero Stripe", "display_name": "Hero Stripe", "target": null }, { "id": "DocumentCookie", "display_name": "DocumentCookie", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1110", "name": "Brute Force", "display_name": "T1110 - Brute Force" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1266, "URL": 5116, "domain": 734, "FileHash-SHA256": 703, "CVE": 1, "email": 3 }, "indicator_count": 7823, "is_author": false, "is_subscribing": null, "subscriber_count": 72, "modified_text": "1448 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "\"focus-within-polyfill@5.0.9\" | \"core-js-bundle@3.2.1\" | \"lodash@4.17.21\"| \"react@16.14.0\" | \"react-dom@16.14.0\"", "Hybrid Analysis", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/922061185/?random=1652546907471&cv=9&fst=1652546907471&num=1&label=BaPJCIf2_WYQgZPWtwM&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=2&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg5b0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.meetup.com%2FDigitalOceanMoscow%2F&ref=https%3A%2F%2Fwww.meetup.com%2Fpro%2Fdigitalocean%2F&tiba=DigitalOcean%20Moscow%20(Moscow%2C%20Russia)%20%7C%20Meetup&hn=www.googleadser", "http://lifehacker.com/assets/stylesheets/app-a873b056f0ea955e4ff0abebb210e5a6.css", "rock.mit-license.org [pattern match]", "https://cdn.polyfill.io/v2/polyfill.min.js?features=default-3.6,fetch,Intl,Intl.~locale.en-US,Array.prototype.find,Array.prototype.includes,Object.values&flags=gated", "camsadultsgetwet.com", "https://hybrid-analysis.com/sample/f90162e65235185a24e9f20d855371b8ad7462d50d7a57851d000cfd5116f76d/63aef1a83e3bb16765527bb8", "https://www.meetup.com/mu_static/react.ddd38c26.js", "https://www.meetup.com/proxydirectory/tags/239562121304/tag.js", "https://www.bing.com/images/search?view=detailV2&id=11DBB9C6633FBE863EC959A64A0934887FA7C481&thid=OIP.1ZMj0U28ecIgZMtxvGo2FAHaEK&exph=450&expw=800&q=Tsara+Brashears+Defeats+Jeffrey+Reimer&selectedindex=2&adt=1&vt=4&eim=0,3,4,6/CAR-BOMB-DEATH-THREAT-AFTER-TSARA-BRASHEARS-PREVAILS-AGAINST-JEFFREY-REIMER-DPT-SEXUAL-MISCONDUCT", "https://dna8twue3dlxq.cloudfront.net/js/profitwell.js", "https://www.malwarebytes.com/trickbot", "This website contains the details of an anti-virus scan conducted by the MetaDefender, which aims to identify and remove malware from websites, websites and social media sites, including Facebook, Twitter and YouTube.", "https://static.parastorage.com/services/wix-thunderbolt/dist/main.c1956e3f.min.css [device-mo]", "https://cdn.sift.com/s.js", "window.fedops.data", "xfe-URL-Sift.com-stix2-2.1-export.json", "WebTools", "https://hybrid-analysis.com/sample/78a7e765ffd6dff7af3b92b6234271fd0dddf5945f38e70d0e22324c1ec06eca/64414afe0ebb5831a20ce8f0", "Potential E-Mail address found in binary/memory", "https://www.hybrid-analysis.com/sample/6e6e4b61b6c658dafe9b59b235d13d12eaa955c719720529b44d530c83032a8a/65bff4553336954b380dbba5", "Making HTTPS connections using insecure TLS/SSL version details Connection was make using TLSv1.1 [tls.handshake.version: 0x00000302] source Network Traffic relevance 10/10 ATT&CK ID T1573 (Show technique in the MITRE ATT&CK\u2122 matrix)", "https://www.google.com/intl/en/chrome/\" Pattern match: \"https://static.parastorage.com/services/wix-thunderbolt/dist/originTrials.41d7301a.bundle.min.js.map [network]", "https://github.com/meetup/swarm-ui", "firecams.com", "https://hybrid-analysis.com/sample/f90162e65235185a24e9f20d855371b8ad7462d50d7a57851d000cfd5116f76d", "xfe-URL-Meetup.com_pro_digitalocean_-stix2-2.1-export.json", "original dropped file discovery url", "https://www.crccolorado.com/", "Online Research", "https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[VerticalLine_ClassicVerticalSolidLine].67fb182e.min.css", "object.prototype.hasownproperty.call", "https://www.meetup.com/pro_static/en-US/0.f2cf4c3f.js", "https://www.googletagmanager.com/gtag/js?id=G-NP82XMKW0P&l=dataLayer&cx=c", "slice.call", "https://www.meetup.com/mu_static/en-US/app.0ff22766.js", "https://static.wixstatic.com/media/fe5868_7bec5131ba084565b6999f47dafd9737.png/v1/fill/w_180%2Ch_180%2Clg_1%2Cusm_0.66_1.00_0.01/fe5868_7bec5131ba084565b6999f47dafd9737.png [\"apple touch icon\"]" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "NoName057" ], "malware_families": [ "Alf:heraklezeval:trojandownloader:win32/unruy", "Min", "Hero stripe", "Backdoor:php/artemis", "Maltiverse", "Photostatus", "Pony - s0453", "Documentcookie", "Reduceright", "Generic.malware", "Generic", "Emotet", "Trickbot", "Qe", "Alf:program:opencandy:remnant", "Alf:pua:win32/catalina" ], "industries": [ "Healthcare" ], "unique_indicators": 27506 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/fb.me", "whois": "http://whois.domaintools.com/fb.me", "domain": "fb.me", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 13, "pulses": [ { "id": "65c0333a4bab9053ba0e22d7", "name": "TrickBot| Miscellaneous Attack of a Medical Practice | Mitre", "description": "Targets a medical facility. Could only be accessed via IExplorer. \nFacility did experience full shutdown and reboot of system, lights, in January. \n\n\u2022TrickBot is a banking Trojan that can steal financial details, account credentials, and personally identifiable information (PII), as well as spread within a network and drop ransomware, particularly Ryuk", "modified": "2024-03-06T00:01:49.984000", "created": "2024-02-05T01:00:42.017000", "tags": [ "pattern match", "et tor", "known tor", "relayrouter", "exit", "node traffic", "misc attack", "ascii text", "script", "united", "date", "error", "unknown", "span", "meta", "hybrid", "null", "general", "local", "click", "strings", "this", "legacy", "false", "window", "suricata", "mitre", "command scripting", "status", "moved", "search", "record value", "cname", "scan endpoints", "all octoseek", "body", "network", "exploit", "shellcode", "name verdict", "u4e0b", "falcon sandbox", "falcon", "malware", "no data", "tag count", "threat report", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "count blacklist", "passive dns", "urls", "domain", "all search", "otx octoseek", "hostname", "pulse pulses", "files", "files ip", "a nxdomain", "ip address", "ip related", "remote cnc", "contacted", "pe resource", "threat roundup", "whois record", "execution", "communicating", "copy", "whois whois", "november", "august", "february", "banker", "keylogger", "lockbit", "probe", "remcos", "core", "trickbot", "threat analyzer", "threat", "paste", "iocs", "hostnames", "urls https", "phone call", "trigger" ], "references": [ "https://www.crccolorado.com/", "https://www.hybrid-analysis.com/sample/6e6e4b61b6c658dafe9b59b235d13d12eaa955c719720529b44d530c83032a8a/65bff4553336954b380dbba5", "https://www.malwarebytes.com/trickbot", "Potential E-Mail address found in binary/memory", "\"focus-within-polyfill@5.0.9\" | \"core-js-bundle@3.2.1\" | \"lodash@4.17.21\"| \"react@16.14.0\" | \"react-dom@16.14.0\"", "https://static.wixstatic.com/media/fe5868_7bec5131ba084565b6999f47dafd9737.png/v1/fill/w_180%2Ch_180%2Clg_1%2Cusm_0.66_1.00_0.01/fe5868_7bec5131ba084565b6999f47dafd9737.png [\"apple touch icon\"]", "slice.call", "object.prototype.hasownproperty.call", "rock.mit-license.org [pattern match]", "https://www.google.com/intl/en/chrome/\" Pattern match: \"https://static.parastorage.com/services/wix-thunderbolt/dist/originTrials.41d7301a.bundle.min.js.map [network]", "https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[VerticalLine_ClassicVerticalSolidLine].67fb182e.min.css", "https://static.parastorage.com/services/wix-thunderbolt/dist/main.c1956e3f.min.css [device-mo]", "camsadultsgetwet.com", "firecams.com", "window.fedops.data" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic.Malware", "display_name": "Generic.Malware", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "TrickBot", "display_name": "TrickBot", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1156", "name": "Malicious Shell Modification", "display_name": "T1156 - Malicious Shell Modification" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" } ], "industries": [ "Healthcare" ], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 171, "FileHash-SHA1": 151, "URL": 179, "domain": 159, "email": 2, "hostname": 150, "FileHash-SHA256": 599, "CVE": 1 }, "indicator_count": 1412, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "816 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65c0333c1ff113786c4610d0", "name": "TrickBot| Miscellaneous Attack of a Medical Practice | Mitre", "description": "Targets a medical facility. Could only be accessed via IExplorer. \nFacility did experience full shutdown and reboot of system, lights, in January. \n\n\u2022TrickBot is a banking Trojan that can steal financial details, account credentials, and personally identifiable information (PII), as well as spread within a network and drop ransomware, particularly Ryuk", "modified": "2024-03-06T00:01:49.984000", "created": "2024-02-05T01:00:44.679000", "tags": [ "pattern match", "et tor", "known tor", "relayrouter", "exit", "node traffic", "misc attack", "ascii text", "script", "united", "date", "error", "unknown", "span", "meta", "hybrid", "null", "general", "local", "click", "strings", "this", "legacy", "false", "window", "suricata", "mitre", "command scripting", "status", "moved", "search", "record value", "cname", "scan endpoints", "all octoseek", "body", "network", "exploit", "shellcode", "name verdict", "u4e0b", "falcon sandbox", "falcon", "malware", "no data", "tag count", "threat report", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "count blacklist", "passive dns", "urls", "domain", "all search", "otx octoseek", "hostname", "pulse pulses", "files", "files ip", "a nxdomain", "ip address", "ip related", "remote cnc", "contacted", "pe resource", "threat roundup", "whois record", "execution", "communicating", "copy", "whois whois", "november", "august", "february", "banker", "keylogger", "lockbit", "probe", "remcos", "core", "trickbot", "threat analyzer", "threat", "paste", "iocs", "hostnames", "urls https", "phone call", "trigger" ], "references": [ "https://www.crccolorado.com/", "https://www.hybrid-analysis.com/sample/6e6e4b61b6c658dafe9b59b235d13d12eaa955c719720529b44d530c83032a8a/65bff4553336954b380dbba5", "https://www.malwarebytes.com/trickbot", "Potential E-Mail address found in binary/memory", "\"focus-within-polyfill@5.0.9\" | \"core-js-bundle@3.2.1\" | \"lodash@4.17.21\"| \"react@16.14.0\" | \"react-dom@16.14.0\"", "https://static.wixstatic.com/media/fe5868_7bec5131ba084565b6999f47dafd9737.png/v1/fill/w_180%2Ch_180%2Clg_1%2Cusm_0.66_1.00_0.01/fe5868_7bec5131ba084565b6999f47dafd9737.png [\"apple touch icon\"]", "slice.call", "object.prototype.hasownproperty.call", "rock.mit-license.org [pattern match]", "https://www.google.com/intl/en/chrome/\" Pattern match: \"https://static.parastorage.com/services/wix-thunderbolt/dist/originTrials.41d7301a.bundle.min.js.map [network]", "https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[VerticalLine_ClassicVerticalSolidLine].67fb182e.min.css", "https://static.parastorage.com/services/wix-thunderbolt/dist/main.c1956e3f.min.css [device-mo]", "camsadultsgetwet.com", "firecams.com", "window.fedops.data" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic.Malware", "display_name": "Generic.Malware", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "TrickBot", "display_name": "TrickBot", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1156", "name": "Malicious Shell Modification", "display_name": "T1156 - Malicious Shell Modification" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" } ], "industries": [ "Healthcare" ], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 171, "FileHash-SHA1": 151, "URL": 179, "domain": 159, "email": 2, "hostname": 150, "FileHash-SHA256": 599, "CVE": 1 }, "indicator_count": 1412, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "816 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65c09e0a6f1a6c10a715a6f2", "name": "TrickBot| Miscellaneous Attack of a Medical Practice | Mitre", "description": "", "modified": "2024-03-06T00:01:49.984000", "created": "2024-02-05T08:36:26.703000", "tags": [ "pattern match", "et tor", "known tor", "relayrouter", "exit", "node traffic", "misc attack", "ascii text", "script", "united", "date", "error", "unknown", "span", "meta", "hybrid", "null", "general", "local", "click", "strings", "this", "legacy", "false", "window", "suricata", "mitre", "command scripting", "status", "moved", "search", "record value", "cname", "scan endpoints", "all octoseek", "body", "network", "exploit", "shellcode", "name verdict", "u4e0b", "falcon sandbox", "falcon", "malware", "no data", "tag count", "threat report", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "count blacklist", "passive dns", "urls", "domain", "all search", "otx octoseek", "hostname", "pulse pulses", "files", "files ip", "a nxdomain", "ip address", "ip related", "remote cnc", "contacted", "pe resource", "threat roundup", "whois record", "execution", "communicating", "copy", "whois whois", "november", "august", "february", "banker", "keylogger", "lockbit", "probe", "remcos", "core", "trickbot", "threat analyzer", "threat", "paste", "iocs", "hostnames", "urls https", "phone call", "trigger" ], "references": [ "https://www.crccolorado.com/", "https://www.hybrid-analysis.com/sample/6e6e4b61b6c658dafe9b59b235d13d12eaa955c719720529b44d530c83032a8a/65bff4553336954b380dbba5", "https://www.malwarebytes.com/trickbot", "Potential E-Mail address found in binary/memory", "\"focus-within-polyfill@5.0.9\" | \"core-js-bundle@3.2.1\" | \"lodash@4.17.21\"| \"react@16.14.0\" | \"react-dom@16.14.0\"", "https://static.wixstatic.com/media/fe5868_7bec5131ba084565b6999f47dafd9737.png/v1/fill/w_180%2Ch_180%2Clg_1%2Cusm_0.66_1.00_0.01/fe5868_7bec5131ba084565b6999f47dafd9737.png [\"apple touch icon\"]", "slice.call", "object.prototype.hasownproperty.call", "rock.mit-license.org [pattern match]", "https://www.google.com/intl/en/chrome/\" Pattern match: \"https://static.parastorage.com/services/wix-thunderbolt/dist/originTrials.41d7301a.bundle.min.js.map [network]", "https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[VerticalLine_ClassicVerticalSolidLine].67fb182e.min.css", "https://static.parastorage.com/services/wix-thunderbolt/dist/main.c1956e3f.min.css [device-mo]", "camsadultsgetwet.com", "firecams.com", "window.fedops.data" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic.Malware", "display_name": "Generic.Malware", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "TrickBot", "display_name": "TrickBot", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1156", "name": "Malicious Shell Modification", "display_name": "T1156 - Malicious Shell Modification" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" } ], "industries": [ "Healthcare" ], "TLP": "white", "cloned_from": "65c0333c1ff113786c4610d0", "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 171, "FileHash-SHA1": 151, "URL": 179, "domain": 159, "email": 2, "hostname": 150, "FileHash-SHA256": 599, "CVE": 1 }, "indicator_count": 1412, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "816 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a819664c2499fc2adc79", "name": "BLOG | cloak-and-dagger | Page 4 of 8", "description": "", "modified": "2023-12-06T16:58:01.198000", "created": "2023-12-06T16:58:01.198000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 4, "FileHash-SHA256": 1664, "FileHash-MD5": 367, "FileHash-SHA1": 237, "domain": 1950, "URL": 6466, "hostname": 2346, "email": 1 }, "indicator_count": 13035, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a60cd4985a30bf050572", "name": "Search Engines \u2022 Portals \u2022 Search Engines \u2022 Mobile Communications \u2022 searchengines", "description": "", "modified": "2023-12-06T16:49:16.153000", "created": "2023-12-06T16:49:16.153000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-SHA256": 930, "domain": 74, "hostname": 340, "URL": 567, "FileHash-MD5": 360, "FileHash-SHA1": 185 }, "indicator_count": 2458, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708dff34f37412488dda2a", "name": "Digital Ocean", "description": "", "modified": "2023-12-06T15:06:38.991000", "created": "2023-12-06T15:06:38.991000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 703, "domain": 734, "URL": 5116, "hostname": 1266, "email": 3 }, "indicator_count": 7823, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "652214c652025febf66cde33", "name": "BLOG | cloak-and-dagger | Page 4 of 8", "description": "C2 | scanning_host | Malicious|", "modified": "2023-11-07T01:01:57.592000", "created": "2023-10-08T02:32:38.609000", "tags": [ "ssl certificate", "whois record", "historical ssl", "threat roundup", "whois whois", "october", "referrer", "resolutions", "december", "september", "hacktool", "united", "anonymizer", "firehol", "microsoft", "phishing site", "malware site", "paypal", "latam", "phishing", "malicious site", "myetherwallet", "heur", "malware", "zeus", "zbot", "facebook", "artemis", "bank", "bradesco", "riskware", "download", "telecom", "dropper", "emotet", "formbook", "cisco umbrella", "site", "safe site", "blacklist https", "generic malware", "detection list", "blacklist", "generic", "pe resource", "contacted", "red team", "whois", "execution", "skynet", "u4e0b", "falcon sandbox", "flag", "date", "server", "name server", "markmonitor", "domain address", "gandi sas", "mesh digital", "vimeo", "static engine", "alexa top", "million", "adwarex", "alexa", "xrat", "downldr", "presenoker", "maltiverse", "ocidmy01rz", "runtime process", "copy md5", "sha1", "copy sha1", "copy sha256" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 367, "FileHash-SHA1": 237, "FileHash-SHA256": 1664, "URL": 6466, "domain": 1950, "hostname": 2346, "CVE": 4, "email": 1 }, "indicator_count": 13035, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f15cbb17119f3334c0c57", "name": "BLOG | cloak-and-dagger | Page 4 of 8", "description": "", "modified": "2023-11-07T01:01:57.592000", "created": "2023-10-30T02:32:43.922000", "tags": [ "ssl certificate", "whois record", "historical ssl", "threat roundup", "whois whois", "october", "referrer", "resolutions", "december", "september", "hacktool", "united", "anonymizer", "firehol", "microsoft", "phishing site", "malware site", "paypal", "latam", "phishing", "malicious site", "myetherwallet", "heur", "malware", "zeus", "zbot", "facebook", "artemis", "bank", "bradesco", "riskware", "download", "telecom", "dropper", "emotet", "formbook", "cisco umbrella", "site", "safe site", "blacklist https", "generic malware", "detection list", "blacklist", "generic", "pe resource", "contacted", "red team", "whois", "execution", "skynet", "u4e0b", "falcon sandbox", "flag", "date", "server", "name server", "markmonitor", "domain address", "gandi sas", "mesh digital", "vimeo", "static engine", "alexa top", "million", "adwarex", "alexa", "xrat", "downldr", "presenoker", "maltiverse", "ocidmy01rz", "runtime process", "copy md5", "sha1", "copy sha1", "copy sha256" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" } ], "industries": [], "TLP": "green", "cloned_from": "652214c652025febf66cde33", "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 367, "FileHash-SHA1": 237, "FileHash-SHA256": 1664, "URL": 6466, "domain": 1950, "hostname": 2346, "CVE": 4, "email": 1 }, "indicator_count": 13035, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "936 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "650f714b099ee92d73840f63", "name": "Search Engines \u2022 Portals \u2022 Search Engines \u2022 Mobile Communications \u2022 searchengines", "description": "Scanning Host \u2022 Malware Site \u2022 Phishing \u2022 Malicious site", "modified": "2023-10-23T21:01:17.695000", "created": "2023-09-23T23:14:18.638000", "tags": [ "united", "anonymizer", "detection list", "ip address", "blacklist", "firehol proxy", "firehol south", "credit union", "team", "proxy", "cisco umbrella", "site", "safe site", "malware site", "malicious site", "alexa top", "million", "malware", "phishing site", "suspected", "unruy", "riskware", "artemis", "phishing", "bank", "alexa", "union", "pony", "catalina", "opencandy", "cleaner", "service", "runescape", "facebook", "download", "iframe", "downldr", "agent", "presenoker", "unsafe", "blacklist https", "noname057", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "malicious url" ], "references": [ "https://www.bing.com/images/search?view=detailV2&id=11DBB9C6633FBE863EC959A64A0934887FA7C481&thid=OIP.1ZMj0U28ecIgZMtxvGo2FAHaEK&exph=450&expw=800&q=Tsara+Brashears+Defeats+Jeffrey+Reimer&selectedindex=2&adt=1&vt=4&eim=0,3,4,6/CAR-BOMB-DEATH-THREAT-AFTER-TSARA-BRASHEARS-PREVAILS-AGAINST-JEFFREY-REIMER-DPT-SEXUAL-MISCONDUCT", "Hybrid Analysis", "Online Research", "WebTools" ], "public": 1, "adversary": "NoName057", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "ALF:PUA:Win32/Catalina", "display_name": "ALF:PUA:Win32/Catalina", "target": null }, { "id": "Backdoor:PHP/Artemis", "display_name": "Backdoor:PHP/Artemis", "target": "/malware/Backdoor:PHP/Artemis" }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy", "target": null }, { "id": "Pony - S0453", "display_name": "Pony - S0453", "target": null }, { "id": "ALF:Program:OpenCandy:Remnant", "display_name": "ALF:Program:OpenCandy:Remnant", "target": null } ], "attack_ids": [ { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 567, "FileHash-SHA256": 930, "domain": 74, "hostname": 340, "CVE": 2, "FileHash-SHA1": 185, "FileHash-MD5": 360 }, "indicator_count": 2458, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "950 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64766c6ffe0d936205c28197", "name": "miniwallet.bundle.js", "description": "confused cause hybrid scsn is clean", "modified": "2023-06-29T21:05:11.335000", "created": "2023-05-30T21:36:47.160000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "memoryfile scan", "ansi", "error", "runtime data", "highlight", "typeof e", "highlighttext", "windir", "graytext", "typeof symbol", "null", "date", "unknown", "path", "suspicious", "roboto", "meta", "4096", "span", "local", "scroll", "backspace", "insert", "this", "april", "hybrid", "model", "close", "click", "general", "strings", "team", "qakbot", "cookie" ], "references": [ "https://hybrid-analysis.com/sample/78a7e765ffd6dff7af3b92b6234271fd0dddf5945f38e70d0e22324c1ec06eca/64414afe0ebb5831a20ce8f0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 25, "domain": 131, "URL": 23, "CVE": 1, "FileHash-MD5": 5, "FileHash-SHA1": 2, "FileHash-SHA256": 5 }, "indicator_count": 192, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1066 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://fb.me/react-polyfills", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://fb.me/react-polyfills", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780256830.7650654 }