{
"type": "URL",
"indicator": "https://form.istockbd.net",
"general": {
"sections": [
"general",
"url_list",
"http_scans",
"screenshot"
],
"indicator": "https://form.istockbd.net",
"type": "url",
"type_title": "URL",
"validation": [],
"base_indicator": {
"id": 3782610347,
"indicator": "https://form.istockbd.net",
"type": "URL",
"title": "",
"description": "",
"content": "",
"access_type": "public",
"access_reason": ""
},
"pulse_info": {
"count": 10,
"pulses": [
{
"id": "69ca31b28c2fa3e734bf5000",
"name": "instagram staged credit clone a vashti :(",
"description": "",
"modified": "2026-03-31T12:16:21.521000",
"created": "2026-03-30T08:17:54.205000",
"tags": [
"dynamicloader",
"port",
"destination",
"yara rule",
"high",
"tofsee",
"rndhex",
"rndchar",
"loaderid",
"write",
"stream",
"malware",
"systemroot",
"write c",
"displayname",
"windows",
"trojan",
"defender",
"unknown",
"less see",
"all ip",
"contacted",
"less related",
"meta",
"emotet",
"backdoor",
"packer",
"many",
"hall render",
"brian sabey",
"christopher p. ahmann",
"state of colorado",
"google",
"yahoo",
"microsoft",
"stealth window",
"reads_self",
"injection write process",
"remote",
"remote process",
"dynamic function loading",
"compromises device",
"dead connect",
"dynamic loader",
"command",
"cnc",
"sleep sandbox",
"iocontrol",
"behavior tofsee",
"suspicious code",
"injection",
"persistence",
"rootkit",
"social media",
"belgium belgium",
"flag",
"windir",
"openurl c",
"prefetch2",
"analysis",
"tor analysis",
"dns requests",
"domain address",
"contacted hosts",
"pattern match",
"ck id",
"show technique",
"mitre att",
"ck matrix",
"network traffic",
"t1071",
"spawns",
"html content",
"href",
"general",
"learn",
"name tactics",
"suspicious",
"informative",
"adversaries",
"defense evasion",
"development att",
"tracking"
],
"references": [
"Instagram.com",
"IDS Detections: tofsee",
"Alerts antivm_generic_services persistence_ads anomalous_deletefile Idead_connect",
"Alerts: suspicious_tld queries_computer_name dynamic_function_loading",
"Alerts: antidebug_setunhandledexceptionfilter antivm_network_adapters",
"IP\u2019s Contacted: 94.100.180.31 142.251.9.27 98.136.96.91 43.231.4.7 52.101.8.42",
"Domains Contacted microsoft.com microsoft-com.mail.protection.outlook.com yahoo.com mta7.am0.yahoodns.net google.com",
"Brian Sabey , Christopher P. Ahmann , State of Colorado who",
"http://tracking-sa3.account.riyadhair.com/tracking/1/open/UGnB4w8RQiQ_9PYty4S-rwBmOetPQw3ubFHSNKg_IdhZfkaCbjqN3pnR4Xwk6pQcRBqF2aoq0uEaKMM4CX1kTpZsAD10-fxAPEgqGzJ2o7BJmsh_G2B6P-m_Xqc_LOycbcGBss0kXIEJvMGRw2SMITzqmVnh1yI_FuZV37qgGHZG3lP1V-WMaNTc8FYNIcgSRyTFamC5k3I1LkpsmTgX5Dd20Ko3IxUqFRC74clpVo-uFwRAb1Q1gSfKrDBX6_LaXkgv9gfyPy7L2BKxAmFBe-Ump3D_wGRDTXekPO5VZJ46hn0pUrOy2g8606kgb703eJVnmrz0cgCd-8P1dOdfoOFrSqOuXzfDNCaUU-2xl1aHVjGCZGIWX6B4bYqznMqsvI8UxoitF5tZTZ3opRhymDkrsItHdJPUnzkc6N_Z370RVT54BihKCohH14lIRQVQN9v74E",
"Looks like a Pegasus tracking sphere. All contacts and contacts, contacts tracked."
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "Trojan:Win32/Emotet.YL",
"display_name": "Trojan:Win32/Emotet.YL",
"target": "/malware/Trojan:Win32/Emotet.YL"
},
{
"id": "Win.Packer.pkr_ce1a-9980177-0",
"display_name": "Win.Packer.pkr_ce1a-9980177-0",
"target": null
},
{
"id": "Backdoor:Win32/Tofsee.T",
"display_name": "Backdoor:Win32/Tofsee.T",
"target": "/malware/Backdoor:Win32/Tofsee.T"
}
],
"attack_ids": [
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1584.005",
"name": "Botnet",
"display_name": "T1584.005 - Botnet"
},
{
"id": "T1014",
"name": "Rootkit",
"display_name": "T1014 - Rootkit"
},
{
"id": "T1051",
"name": "Shared Webroot",
"display_name": "T1051 - Shared Webroot"
},
{
"id": "T1031",
"name": "Modify Existing Service",
"display_name": "T1031 - Modify Existing Service"
},
{
"id": "T1449",
"name": "Exploit SS7 to Redirect Phone Calls/SMS",
"display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
},
{
"id": "T1585.001",
"name": "Social Media Accounts",
"display_name": "T1585.001 - Social Media Accounts"
},
{
"id": "TA0003",
"name": "Persistence",
"display_name": "TA0003 - Persistence"
},
{
"id": "T1068",
"name": "Exploitation for Privilege Escalation",
"display_name": "T1068 - Exploitation for Privilege Escalation"
},
{
"id": "T1210",
"name": "Exploitation of Remote Services",
"display_name": "T1210 - Exploitation of Remote Services"
},
{
"id": "TA0037",
"name": "Command and Control",
"display_name": "TA0037 - Command and Control"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1589",
"name": "Gather Victim Identity Information",
"display_name": "T1589 - Gather Victim Identity Information"
},
{
"id": "T1590",
"name": "Gather Victim Network Information",
"display_name": "T1590 - Gather Victim Network Information"
},
{
"id": "T1591",
"name": "Gather Victim Org Information",
"display_name": "T1591 - Gather Victim Org Information"
},
{
"id": "T1592",
"name": "Gather Victim Host Information",
"display_name": "T1592 - Gather Victim Host Information"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1083",
"name": "File and Directory Discovery",
"display_name": "T1083 - File and Directory Discovery"
},
{
"id": "T1562",
"name": "Impair Defenses",
"display_name": "T1562 - Impair Defenses"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
}
],
"industries": [],
"TLP": "green",
"cloned_from": "6949b6d8180bca3df9783578",
"export_count": 3,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "msudosos",
"id": "381696",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"URL": 911,
"domain": 178,
"hostname": 206,
"FileHash-SHA256": 647,
"FileHash-MD5": 38,
"FileHash-SHA1": 28
},
"indicator_count": 2008,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 49,
"modified_text": "19 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "699b907c5375efb7ce1639b8",
"name": "Apple Redirects in Apple Support = IcedID | MITM attack",
"description": "Researching targets former iPhone. Redirect in Apple support. [support.apple.com/ht^*^ redirects to support.apple.com/de/^*^*^] IcedID identified. | Environment: 3 -5 suspected compromised devices present. Behavior: iPhone reset itself twice, deleted passcodes, required new passcodes, compromised contacts notified target added a new device (FALSE) , threat actor stole Apple cash , added , Password storage, reset television. Targeted another device auto downloaded a Mimecast compromise, attached to iCloud , corrupted files downloaded. Emotet identified. Reset SmartTV. Browser bar AI: mood swings. Overt changes, white screen, pink screens, thread erased. Identified OTX. as a honeypot also states it\u2019s legitimate. I dumped information. AI agents focused on victim leaving shreds of evidence , paper trail , w/ anyone ,anywhere. AI model told truth \u2018I don\u2019t like you , you\u2019ve changed, you lied, you changed all facts .\u201d,etc. An acceptable baseline of communication established . #botnet #command_and_control #IcedID",
"modified": "2026-03-24T21:11:04.306000",
"created": "2026-02-22T23:25:48.722000",
"tags": [
"dynamicloader",
"tls handshake",
"failure",
"whitelisted",
"akamai",
"yara detections",
"trojan",
"write",
"zeppelin",
"malware",
"hostile",
"unknown",
"port",
"destination",
"read c",
"united",
"as16625 akamai",
"win32",
"persistence",
"execution",
"passive dns",
"urls",
"otx logo",
"all url",
"http",
"ip address",
"related nids",
"files location",
"win32mydoom feb",
"name servers",
"servers",
"worm",
"virtool",
"files",
"ipv4",
"reverse dns",
"america flag",
"america asn",
"United States",
"unknown ns",
"asn as714",
"invalid url",
"mtb oct",
"mtb sep",
"lowfi",
"trojanspy",
"total",
"push",
"defender",
"china unknown",
"mtb apr",
"ok server",
"gmt content",
"type",
"accept",
"show",
"todo",
"all filehash",
"av detections",
"shift",
"url http",
"url https",
"hostname",
"type indicator",
"source hostname",
"writeconsolew",
"post https",
"tlsv1",
"medium",
"write c",
"dock",
"command",
"control",
"icedid",
"domain",
"all domain",
"status",
"hostname add",
"crlf line",
"unicode text",
"utf8",
"ee fc",
"yara rule",
"ff d5",
"ascii text",
"f0 ff",
"eb e1",
"music",
"next",
"autorun",
"suspicious",
"compatibility",
"mode",
"entries",
"lredmond",
"stwashington",
"search",
"tls sni",
"denmark",
"body html",
"head title",
"title head",
"body h1",
"all ipv4",
"url analysis",
"users",
"ff ff",
"files domain",
"files related",
"url add",
"flag united",
"present apr",
"location united",
"asn asnone",
"as16509",
"moved",
"title",
"body",
"code",
"mydoom",
"bot net",
"mitm",
"aquire",
"hidden users",
"no expiration",
"filehashsha256",
"expiration",
"showing",
"indicator role",
"pulses url",
"pulse show",
"iot",
"Iced iced baby"
],
"references": [
"support.apple.com/ht^*^*^*^ redirects to support.apple.com/de/^*^*^*^*^",
"This is messy! OTX refreshed and deleted IoC\u2019s. Will continue researching",
"IDS Detections: Observed IcedID CnC Domain in TLS SNI TLS Handshake Failure",
"df57a01 c40f355a0f8a592294187d4fedc257 [Compatibility Mode] - Word",
"div> ![](\"static/rId9.jpeg\"/)
",
"Same legal , and quasi governmental pattern identified",
"I apologize for the lack of reference.",
"Requires further research.",
"Will pulse remaining Apple IoC\u2019s in next pulse",
"https://l.us-1.a.mimecastprotect.com/l",
"It appears there are 5-7 known affected that I was able to find"
],
"public": 1,
"adversary": "",
"targeted_countries": [
"Germany",
"Denmark",
"United States of America",
"Japan"
],
"malware_families": [
{
"id": "Icedid",
"display_name": "Icedid",
"target": null
},
{
"id": "Trojan:Win32/SmkLdr.H!MTB",
"display_name": "Trojan:Win32/SmkLdr.H!MTB",
"target": "/malware/Trojan:Win32/SmkLdr.H!MTB"
},
{
"id": "#Lowfi:Lua:DllSuspiciousExport.A",
"display_name": "#Lowfi:Lua:DllSuspiciousExport.A",
"target": null
},
{
"id": "MyDoom",
"display_name": "MyDoom",
"target": null
}
],
"attack_ids": [
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1082",
"name": "System Information Discovery",
"display_name": "T1082 - System Information Discovery"
},
{
"id": "T1112",
"name": "Modify Registry",
"display_name": "T1112 - Modify Registry"
},
{
"id": "T1129",
"name": "Shared Modules",
"display_name": "T1129 - Shared Modules"
},
{
"id": "T1143",
"name": "Hidden Window",
"display_name": "T1143 - Hidden Window"
},
{
"id": "T1158",
"name": "Hidden Files and Directories",
"display_name": "T1158 - Hidden Files and Directories"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1583.005",
"name": "Botnet",
"display_name": "T1583.005 - Botnet"
},
{
"id": "T1608.001",
"name": "Upload Malware",
"display_name": "T1608.001 - Upload Malware"
},
{
"id": "T1587.001",
"name": "Malware",
"display_name": "T1587.001 - Malware"
},
{
"id": "T1155",
"name": "AppleScript",
"display_name": "T1155 - AppleScript"
},
{
"id": "T1557",
"name": "Man-in-the-Middle",
"display_name": "T1557 - Man-in-the-Middle"
},
{
"id": "T1147",
"name": "Hidden Users",
"display_name": "T1147 - Hidden Users"
}
],
"industries": [
"Technology",
"Telecom",
"Legal"
],
"TLP": "green",
"cloned_from": null,
"export_count": 1,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"hostname": 2051,
"FileHash-SHA256": 1706,
"URL": 6984,
"domain": 1097,
"FileHash-MD5": 401,
"FileHash-SHA1": 276,
"SSLCertFingerprint": 9,
"email": 13,
"CVE": 1
},
"indicator_count": 12538,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 141,
"modified_text": "26 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "6967bc8b26b69d4dc2604a13",
"name": "Telegram@V2ray_Alpha/ | Mirai | ExhoBot CNC | EtT",
"description": "Inbound Outbound connections. Tel et error. Hacking activity affecting various forms of connectivity via telecom. Possibly a controls\n computer vehicle connects to. Related? I was researching increased malicious activity aimed against a target. An associate close to target reported (mid research) Vehicle reported \u2018no longer being able to communicate. Module 5 has an error. Please contact customer service). Targets car was powered oof. No Bluetooth connection. No reports. Audio off. No phone message, connection or dial. This is targets experience not mowing what I was researching.",
"modified": "2026-02-13T15:04:30.631000",
"created": "2026-01-14T15:55:55.693000",
"tags": [
"v2rayalpha",
"united",
"unknown ns",
"unknown aaaa",
"domain add",
"urls",
"files",
"domain",
"github",
"file format",
"jkvpn",
"jointelegram",
"farahvpn vless",
"post",
"universal",
"scribd",
"typews",
"telegram",
"rdap",
"handle",
"iana registrar",
"roles",
"dnssec",
"aaaa",
"ttl value",
"rdap database",
"links",
"backdoor",
"antigua",
"virgin islands",
"status",
"org domains",
"proxy",
"ip address",
"barbuda unknown",
"passive dns",
"ipv4 add",
"twitter",
"dynamicloader",
"port",
"delete c",
"destination",
"high",
"windows",
"medium",
"displayname",
"write",
"tofsee",
"stream",
"malware",
"push",
"next",
"url add",
"http",
"hostname",
"files domain",
"files related",
"related tags",
"learn",
"ck id",
"name tactics",
"suspicious",
"informative",
"adversaries",
"command",
"spawns",
"ck techniques",
"evasion att",
"sha256",
"sha1",
"pattern match",
"ascii text",
"href",
"hybrid",
"general",
"local",
"path",
"click",
"strings",
"search",
"moved",
"record value",
"servers",
"title",
"encrypt",
"canada unknown",
"gmt content",
"reverse dns",
"location canada",
"canada asn",
"accept",
"cookie",
"dll read",
"function read",
"wscriptshell",
"shortcut",
"guard",
"error",
"present jan",
"name servers",
"registrar url",
"hong kong",
"invalid url",
"url analysis",
"location hong",
"kong flag",
"msie",
"chrome",
"type",
"media type",
"certificate",
"hostname add",
"present nov",
"present sep",
"present oct",
"expiration date",
"present dec",
"script urls",
"a domains",
"present mar",
"present feb",
"meta",
"show",
"read c",
"entries",
"read",
"intel",
"ms windows",
"delete",
"please",
"artemis",
"virustotal",
"trojan",
"mcafee",
"drweb",
"vipre",
"panda",
"write c",
"total",
"next associated",
"thursday",
"gmt cache",
"ipv4",
"form",
"date",
"mirai",
"telnet login",
"south korea",
"bad login",
"as4766 korea",
"taiwan as3462",
"china as45090",
"telnet root",
"cve201717215",
"execution",
"copy",
"contacted",
"mtb ids",
"dns query",
"variant cnc",
"domain huawei",
"remote command",
"huawei remote",
"echobot",
"linux mirai",
"monitoring",
"cnc"
],
"references": [
"https://pamchall.com/Telegram@V2ray_Alpha/",
"Domain: t.me \u2022 Email: 1047f946-a6da-45dd-fa53-e00edb48e367@www.speedtest.net",
"https://t.me/",
"Win32/Tofsee.AX google.com connectivity check",
"IDS Detections: Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
"Yara Detections: Cabinet_Archive , SFX_CAB",
"ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile",
"Antivirus Detections: ELF:Mirai-AAL\\ [Trj] , Unix.Trojan.Mirai-1 , Backdoor:Linux/Mirai.N!MTB",
"IDS Detections: Observed DNS Query to ELF/Various Mirai Variant CnC Domain Huawei Remote Command Execution (CVE-2017-17215)",
"Huawei Remote Command Execution - Outbound (CVE-2017-17215)",
"Huawei HG532 RCE Vulnerability (CVE-2017-17215)",
"DYNAMIC_DNS Query to *.duckdns. Domain",
"SUSPICIOUS Path to BusyBox HiSilicon DVR - Default",
"Telnet Root Password Inbound TELNET login failed root login Bad Login Less",
"Yara Detections Mirai_Botnet_Malware , Mirai_2 , is__elf , Linux_Mirai , ECHOBOT",
"dead_host network_icmp tcp_syn_scan nolookup_communication networkdyndns_checkip writes_to_stdout",
"IP\u2019s Contacted: 1.0.21.231 1.0.42.181 1.1.116.28 1.10.203.28 1.10.54.62 1.101.0.202",
"IP\u2019s Contacted: 1.101.184.254 1.103.104.9 1.103.141.89 1.104.104.227",
"Contacted: newmethcnc.duckdns.org",
"https://otx.alienvault.com/indicator/file/3215b2d1c44c7114c7f94af1bbcb858707b636baeae2c6752219fdf184c7b00e",
"https://eurotarget.com/it/auto/toyota/c-hr/"
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "Backdoor:Win32/Tofsee.T",
"display_name": "Backdoor:Win32/Tofsee.T",
"target": "/malware/Backdoor:Win32/Tofsee.T"
},
{
"id": "Win.Malware.Reline-9887776-0",
"display_name": "Win.Malware.Reline-9887776-0",
"target": null
},
{
"id": "Mirai",
"display_name": "Mirai",
"target": null
},
{
"id": "Mirai (ELF)",
"display_name": "Mirai (ELF)",
"target": null
},
{
"id": "Backdoor:Linux/Mirai.N!MTB",
"display_name": "Backdoor:Linux/Mirai.N!MTB",
"target": "/malware/Backdoor:Linux/Mirai.N!MTB"
}
],
"attack_ids": [
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1114",
"name": "Email Collection",
"display_name": "T1114 - Email Collection"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1113",
"name": "Screen Capture",
"display_name": "T1113 - Screen Capture"
},
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1584.005",
"name": "Botnet",
"display_name": "T1584.005 - Botnet"
},
{
"id": "T1031",
"name": "Modify Existing Service",
"display_name": "T1031 - Modify Existing Service"
},
{
"id": "TA0011",
"name": "Command and Control",
"display_name": "TA0011 - Command and Control"
},
{
"id": "T1608.001",
"name": "Upload Malware",
"display_name": "T1608.001 - Upload Malware"
},
{
"id": "T1222.002",
"name": "Linux and Mac File and Directory Permissions Modification",
"display_name": "T1222.002 - Linux and Mac File and Directory Permissions Modification"
},
{
"id": "T1399",
"name": "Modify Trusted Execution Environment",
"display_name": "T1399 - Modify Trusted Execution Environment"
},
{
"id": "T1014",
"name": "Rootkit",
"display_name": "T1014 - Rootkit"
},
{
"id": "T1011",
"name": "Exfiltration Over Other Network Medium",
"display_name": "T1011 - Exfiltration Over Other Network Medium"
},
{
"id": "T1011.001",
"name": "Exfiltration Over Bluetooth",
"display_name": "T1011.001 - Exfiltration Over Bluetooth"
},
{
"id": "T1210",
"name": "Exploitation of Remote Services",
"display_name": "T1210 - Exploitation of Remote Services"
},
{
"id": "TA0029",
"name": "Privilege Escalation",
"display_name": "TA0029 - Privilege Escalation"
}
],
"industries": [
"Telecom"
],
"TLP": "green",
"cloned_from": null,
"export_count": 3,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"URL": 6227,
"domain": 1437,
"hostname": 2331,
"email": 8,
"FileHash-SHA256": 3252,
"FileHash-MD5": 465,
"FileHash-SHA1": 457,
"CIDR": 1,
"CVE": 3
},
"indicator_count": 14181,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 139,
"modified_text": "65 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "6949b6d8180bca3df9783578",
"name": "Instagram (staged) Emotet & Tofsee Backdoor",
"description": "If you choose to read this, I apologize for the riddle.Pegasus like tracking operation.\nAdversarial attack on a private citizens or (possibly staged instagram account). The citizen is not a known target. Attacks appear to arise from same internet criminals, allegedly State of Colorado employees engaged in permissible criminal behavior. Account does belongs to a person in sphere of a known monitored target. Target naturally has no communication with account holder. Known target had been invited to be Facebook friends of infected account holder multiple times, both target and associate declined and blocked this infected account holder. |\n\n* Infected Instagram account holders husband referred target to a Colorado Law Firm. The Law firm was attacked some time ago. | \n***Infected instagram account holder name is redacted. Is being tracked :(",
"modified": "2026-01-21T20:01:56.174000",
"created": "2025-12-22T21:23:36.083000",
"tags": [
"dynamicloader",
"port",
"destination",
"yara rule",
"high",
"tofsee",
"rndhex",
"rndchar",
"loaderid",
"write",
"stream",
"malware",
"systemroot",
"write c",
"displayname",
"windows",
"trojan",
"defender",
"unknown",
"less see",
"all ip",
"contacted",
"less related",
"meta",
"emotet",
"backdoor",
"packer",
"many",
"hall render",
"brian sabey",
"christopher p. ahmann",
"state of colorado",
"google",
"yahoo",
"microsoft",
"stealth window",
"reads_self",
"injection write process",
"remote",
"remote process",
"dynamic function loading",
"compromises device",
"dead connect",
"dynamic loader",
"command",
"cnc",
"sleep sandbox",
"iocontrol",
"behavior tofsee",
"suspicious code",
"injection",
"persistence",
"rootkit",
"social media",
"belgium belgium",
"flag",
"windir",
"openurl c",
"prefetch2",
"analysis",
"tor analysis",
"dns requests",
"domain address",
"contacted hosts",
"pattern match",
"ck id",
"show technique",
"mitre att",
"ck matrix",
"network traffic",
"t1071",
"spawns",
"html content",
"href",
"general",
"learn",
"name tactics",
"suspicious",
"informative",
"adversaries",
"defense evasion",
"development att",
"tracking"
],
"references": [
"Instagram.com",
"IDS Detections: tofsee",
"Alerts antivm_generic_services persistence_ads anomalous_deletefile Idead_connect",
"Alerts: suspicious_tld queries_computer_name dynamic_function_loading",
"Alerts: antidebug_setunhandledexceptionfilter antivm_network_adapters",
"IP\u2019s Contacted: 94.100.180.31 142.251.9.27 98.136.96.91 43.231.4.7 52.101.8.42",
"Domains Contacted microsoft.com microsoft-com.mail.protection.outlook.com yahoo.com mta7.am0.yahoodns.net google.com",
"Brian Sabey , Christopher P. Ahmann , State of Colorado who",
"http://tracking-sa3.account.riyadhair.com/tracking/1/open/UGnB4w8RQiQ_9PYty4S-rwBmOetPQw3ubFHSNKg_IdhZfkaCbjqN3pnR4Xwk6pQcRBqF2aoq0uEaKMM4CX1kTpZsAD10-fxAPEgqGzJ2o7BJmsh_G2B6P-m_Xqc_LOycbcGBss0kXIEJvMGRw2SMITzqmVnh1yI_FuZV37qgGHZG3lP1V-WMaNTc8FYNIcgSRyTFamC5k3I1LkpsmTgX5Dd20Ko3IxUqFRC74clpVo-uFwRAb1Q1gSfKrDBX6_LaXkgv9gfyPy7L2BKxAmFBe-Ump3D_wGRDTXekPO5VZJ46hn0pUrOy2g8606kgb703eJVnmrz0cgCd-8P1dOdfoOFrSqOuXzfDNCaUU-2xl1aHVjGCZGIWX6B4bYqznMqsvI8UxoitF5tZTZ3opRhymDkrsItHdJPUnzkc6N_Z370RVT54BihKCohH14lIRQVQN9v74E",
"Looks like a Pegasus tracking sphere. All contacts and contacts, contacts tracked."
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "Trojan:Win32/Emotet.YL",
"display_name": "Trojan:Win32/Emotet.YL",
"target": "/malware/Trojan:Win32/Emotet.YL"
},
{
"id": "Win.Packer.pkr_ce1a-9980177-0",
"display_name": "Win.Packer.pkr_ce1a-9980177-0",
"target": null
},
{
"id": "Backdoor:Win32/Tofsee.T",
"display_name": "Backdoor:Win32/Tofsee.T",
"target": "/malware/Backdoor:Win32/Tofsee.T"
}
],
"attack_ids": [
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1584.005",
"name": "Botnet",
"display_name": "T1584.005 - Botnet"
},
{
"id": "T1014",
"name": "Rootkit",
"display_name": "T1014 - Rootkit"
},
{
"id": "T1051",
"name": "Shared Webroot",
"display_name": "T1051 - Shared Webroot"
},
{
"id": "T1031",
"name": "Modify Existing Service",
"display_name": "T1031 - Modify Existing Service"
},
{
"id": "T1449",
"name": "Exploit SS7 to Redirect Phone Calls/SMS",
"display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
},
{
"id": "T1585.001",
"name": "Social Media Accounts",
"display_name": "T1585.001 - Social Media Accounts"
},
{
"id": "TA0003",
"name": "Persistence",
"display_name": "TA0003 - Persistence"
},
{
"id": "T1068",
"name": "Exploitation for Privilege Escalation",
"display_name": "T1068 - Exploitation for Privilege Escalation"
},
{
"id": "T1210",
"name": "Exploitation of Remote Services",
"display_name": "T1210 - Exploitation of Remote Services"
},
{
"id": "TA0037",
"name": "Command and Control",
"display_name": "TA0037 - Command and Control"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1589",
"name": "Gather Victim Identity Information",
"display_name": "T1589 - Gather Victim Identity Information"
},
{
"id": "T1590",
"name": "Gather Victim Network Information",
"display_name": "T1590 - Gather Victim Network Information"
},
{
"id": "T1591",
"name": "Gather Victim Org Information",
"display_name": "T1591 - Gather Victim Org Information"
},
{
"id": "T1592",
"name": "Gather Victim Host Information",
"display_name": "T1592 - Gather Victim Host Information"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1083",
"name": "File and Directory Discovery",
"display_name": "T1083 - File and Directory Discovery"
},
{
"id": "T1562",
"name": "Impair Defenses",
"display_name": "T1562 - Impair Defenses"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
}
],
"industries": [],
"TLP": "green",
"cloned_from": null,
"export_count": 8,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 1,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"URL": 910,
"domain": 177,
"hostname": 206,
"FileHash-SHA256": 647,
"FileHash-MD5": 38,
"FileHash-SHA1": 28
},
"indicator_count": 2006,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 138,
"modified_text": "88 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "69312c4db6fe7eb34abd179d",
"name": "BeeLineRouter.Net \u2022 Apple \u2022 Worms \u2022 Ransom \u2022 SpyWare",
"description": "Direct- remotely accesses iOS devices. Same threat actors. Further research warranted.| \n\n#theyswarm #apple #worms #spyware #ransom #quasi",
"modified": "2026-01-03T05:02:11.376000",
"created": "2025-12-04T06:38:05.504000",
"tags": [
"worm",
"readme.exe",
"foto.pif",
"z1nic.exe",
"dynamicloader",
"high",
"windows",
"checks",
"named pipe",
"http traffic",
"ids detections",
"yara detections",
"alerts",
"launch",
"defense evasion",
"ta0005",
"files",
"msie",
"next dropped",
"process name",
"pe32",
"intel",
"ms windows",
"unknown",
"united",
"tlsv1",
"as14618",
"top source",
"top destination",
"port",
"destination",
"source source",
"matches rule",
"hidden file",
"extension",
"connection",
"http vary",
"tulach",
"url https",
"indicator role",
"active related",
"ipv4",
"url http",
"macintosh",
"intel mac",
"os x",
"search",
"type indicator",
"role title",
"added active",
"related pulses",
"bq dec",
"virtool",
"win32mydoom dec",
"trojan",
"win32cve dec",
"avast avg",
"mtb dec",
"crlf line",
"unicode text",
"utf8",
"ee fc",
"ff d5",
"yara rule",
"ascii text",
"f0 ff",
"eb e1",
"write",
"malware",
"suspicious",
"observed dns",
"query",
"exploits",
"sid name",
"malware cve",
"exif data",
"show",
"value exe",
"next",
"all ipv4",
"pulse pulses",
"passive dns",
"urls",
"reverse dns",
"location united",
"america flag",
"ashburn",
"status",
"name servers",
"ip address",
"showing",
"domain",
"files ip",
"windows nt",
"slcc2",
"media center",
"medium",
"simda",
"internal",
"local",
"write c",
"domain add",
"ip whois",
"registrar",
"hostname",
"present jul",
"unknown ns",
"present dec",
"music",
"servers",
"hostname add",
"pulse submit",
"url analysis",
"aaaa",
"backdoor",
"entries",
"found",
"next associated",
"gmt connection",
"control",
"content type",
"twitter",
"certificate",
"redirect date",
"cache",
"record value",
"emails",
"win32",
"mtb may",
"invalid url",
"ransom",
"trojanspy",
"msil",
"akamai",
"expiration date",
"body html",
"present nov",
"url add",
"http",
"files domain",
"files related",
"pulses none",
"related tags",
"present sep",
"present oct",
"flag",
"analysis tip",
"click",
"windir",
"openurl c",
"prefetch2",
"analysis",
"tor analysis",
"dns requests",
"date",
"domain address",
"dynadot inc",
"name server",
"contacted hosts",
"process details",
"network traffic",
"ck id",
"show technique",
"mitre att",
"ck matrix",
"t1566",
"submitted url",
"t1204",
"learn",
"name tactics",
"informative",
"adversaries",
"command",
"spawns",
"access att",
"t1566 phishing",
"pattern match",
"show process",
"t1071",
"t1057",
"general",
"path",
"brian sabey",
"christopher p ahmann",
"quasi",
"foundry",
"helix",
"remote attacks",
"hit men",
"sreredrum",
"pleh"
],
"references": [
"apple.com \u2022 getsupport.apple.com \u2022",
"https://www.idvd.eu/?cid=oas-japac-domains-applestore.com.cn/90.i.lolik.anyciona.patrolita.casse.897866 \u2022 oas-japac-domains-applestore.com.cn",
"http://beelinerouter.net/",
"Tulach - 114.114.114.114",
"http://foundry2-lbl.dvr.dn2.n-helix.com",
"foundry.com \u2022 helix. com"
],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [
{
"id": "Worm:Win32/Fadok!rfn",
"display_name": "Worm:Win32/Fadok!rfn",
"target": "/malware/Worm:Win32/Fadok!rfn"
},
{
"id": "VirTool:Win32/Injector.gen!BQ",
"display_name": "VirTool:Win32/Injector.gen!BQ",
"target": "/malware/VirTool:Win32/Injector.gen!BQ"
},
{
"id": "Mydoom",
"display_name": "Mydoom",
"target": null
},
{
"id": "Win.Spyware.88778-2",
"display_name": "Win.Spyware.88778-2",
"target": null
},
{
"id": "Win.Malware.Delf-10008156-0",
"display_name": "Win.Malware.Delf-10008156-0",
"target": null
},
{
"id": "Trojan.MyDoom/Muldrop",
"display_name": "Trojan.MyDoom/Muldrop",
"target": null
},
{
"id": "VirTool:Win32/Obfuscator",
"display_name": "VirTool:Win32/Obfuscator",
"target": "/malware/VirTool:Win32/Obfuscator"
},
{
"id": "TrojanSpy",
"display_name": "TrojanSpy",
"target": null
}
],
"attack_ids": [
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1176",
"name": "Browser Extensions",
"display_name": "T1176 - Browser Extensions"
},
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1063",
"name": "Security Software Discovery",
"display_name": "T1063 - Security Software Discovery"
},
{
"id": "T1119",
"name": "Automated Collection",
"display_name": "T1119 - Automated Collection"
},
{
"id": "T1204",
"name": "User Execution",
"display_name": "T1204 - User Execution"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
},
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1578",
"name": "Modify Cloud Compute Infrastructure",
"display_name": "T1578 - Modify Cloud Compute Infrastructure"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1584",
"name": "Compromise Infrastructure",
"display_name": "T1584 - Compromise Infrastructure"
},
{
"id": "T1410",
"name": "Network Traffic Capture or Redirection",
"display_name": "T1410 - Network Traffic Capture or Redirection"
},
{
"id": "T1449",
"name": "Exploit SS7 to Redirect Phone Calls/SMS",
"display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
},
{
"id": "T1210",
"name": "Exploitation of Remote Services",
"display_name": "T1210 - Exploitation of Remote Services"
},
{
"id": "T1110",
"name": "Brute Force",
"display_name": "T1110 - Brute Force"
},
{
"id": "T1068",
"name": "Exploitation for Privilege Escalation",
"display_name": "T1068 - Exploitation for Privilege Escalation"
},
{
"id": "TA0037",
"name": "Command and Control",
"display_name": "TA0037 - Command and Control"
},
{
"id": "T1584.003",
"name": "Virtual Private Server",
"display_name": "T1584.003 - Virtual Private Server"
},
{
"id": "T1583.002",
"name": "DNS Server",
"display_name": "T1583.002 - DNS Server"
},
{
"id": "T1408",
"name": "Disguise Root/Jailbreak Indicators",
"display_name": "T1408 - Disguise Root/Jailbreak Indicators"
},
{
"id": "T1014",
"name": "Rootkit",
"display_name": "T1014 - Rootkit"
},
{
"id": "T1147",
"name": "Hidden Users",
"display_name": "T1147 - Hidden Users"
},
{
"id": "T1143",
"name": "Hidden Window",
"display_name": "T1143 - Hidden Window"
}
],
"industries": [],
"TLP": "white",
"cloned_from": null,
"export_count": 3,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"FileHash-MD5": 422,
"FileHash-SHA1": 316,
"FileHash-SHA256": 1950,
"domain": 899,
"URL": 6117,
"email": 21,
"hostname": 2037,
"SSLCertFingerprint": 2,
"CVE": 1
},
"indicator_count": 11765,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 138,
"modified_text": "106 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "6894fd48178a2cc0c287af71",
"name": "Polymorphic | Worm & Trojan:Win32/Mydoom. IoC\u2019s + | Device local *Remowted.com",
"description": "",
"modified": "2025-09-06T19:01:20.165000",
"created": "2025-08-07T19:23:52.346000",
"tags": [
"filehashmd5",
"indicator role",
"title added",
"active related",
"filehashsha256",
"t1105",
"tool transfer",
"t1480",
"guardrails",
"t1566",
"t1568",
"t1012",
"t1023",
"t1031",
"service",
"filehashsha1",
"iocs",
"learn more",
"hostname",
"types of",
"netherlands",
"united",
"denmark",
"belgium",
"dynamicloader",
"yara rule",
"vmdetect",
"write c",
"search",
"medium",
"show",
"entries",
"high",
"worm",
"copy",
"write",
"unknown",
"markus",
"malware",
"suspicious",
"crlf line",
"unicode text",
"utf8",
"ascii text",
"trojan",
"music",
"next",
"autorun"
],
"references": [],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [],
"attack_ids": [
{
"id": "T1012",
"name": "Query Registry",
"display_name": "T1012 - Query Registry"
},
{
"id": "T1023",
"name": "Shortcut Modification",
"display_name": "T1023 - Shortcut Modification"
},
{
"id": "T1031",
"name": "Modify Existing Service",
"display_name": "T1031 - Modify Existing Service"
},
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1047",
"name": "Windows Management Instrumentation",
"display_name": "T1047 - Windows Management Instrumentation"
},
{
"id": "T1053",
"name": "Scheduled Task/Job",
"display_name": "T1053 - Scheduled Task/Job"
},
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1082",
"name": "System Information Discovery",
"display_name": "T1082 - System Information Discovery"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1112",
"name": "Modify Registry",
"display_name": "T1112 - Modify Registry"
},
{
"id": "T1119",
"name": "Automated Collection",
"display_name": "T1119 - Automated Collection"
},
{
"id": "T1129",
"name": "Shared Modules",
"display_name": "T1129 - Shared Modules"
},
{
"id": "T1204",
"name": "User Execution",
"display_name": "T1204 - User Execution"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
}
],
"industries": [],
"TLP": "green",
"cloned_from": null,
"export_count": 26,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"FileHash-MD5": 221,
"FileHash-SHA1": 129,
"FileHash-SHA256": 713,
"URL": 2616,
"domain": 338,
"hostname": 598,
"email": 7
},
"indicator_count": 4622,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 137,
"modified_text": "225 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "68632c19dd335ce48dbc3798",
"name": "Apple Zombie- Multi Malware/ Ransom attack affects Upscale Networks | Devices",
"description": "Apple IoC\u2019s Isolated from Lifestyle Community\n\u2022 Win.Packer.pkr_ce1a-9980177-0\n\u2022 Antivirus Detections\nWin.Dropper.Zombie-10044469-0\n, \nTrojan:Win32/Zombie.A |\nAlerts:\n\u2022 ransomware_file_modifications\n\u2022 polymorphic\n\u2022 procmem_yara\n\u2022 static_pe_anomaly\n\u2022 anomalous_deletefile\n#remote #device #dns #dead_host #pointers\n#active #targeting #ops #more\u2026",
"modified": "2025-07-31T00:00:48.083000",
"created": "2025-07-01T00:30:17.324000",
"tags": [
"dynamicloader",
"vx10",
"nxd2xebwx87",
"wx10",
"mxd78x8b",
"port",
"x0cqpyx0c",
"delete c",
"yara rule",
"high",
"tofsee",
"grum",
"copy",
"stream",
"powershell",
"write",
"malware",
"push",
"united",
"name servers",
"search",
"creation date",
"servers",
"moved",
"passive dns",
"urls",
"domain",
"record value",
"date",
"body",
"users",
"intel",
"ms windows",
"pe32",
"number",
"pe32 executable",
"ascii text",
"crlf line",
"database",
"installer",
"template",
"trojan"
],
"references": [],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [],
"attack_ids": [
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
}
],
"industries": [],
"TLP": "green",
"cloned_from": null,
"export_count": 19,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"domain": 202,
"hostname": 217,
"FileHash-SHA256": 852,
"FileHash-MD5": 238,
"FileHash-SHA1": 164,
"SSLCertFingerprint": 3,
"URL": 947,
"email": 3
},
"indicator_count": 2626,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 138,
"modified_text": "263 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "6824aa10fa32899c33abc3be",
"name": "tp://adorno.pl and http://vgt.pl INVESTIGATION requstor user Axelo",
"description": "https://t.co/zTZNBTe8GV",
"modified": "2025-06-14T00:00:30.956000",
"created": "2025-05-14T14:34:56.497000",
"tags": [],
"references": [],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [],
"attack_ids": [],
"industries": [],
"TLP": "white",
"cloned_from": null,
"export_count": 13,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Arek-BTC",
"id": "212764",
"avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"FileHash-MD5": 426,
"FileHash-SHA1": 455,
"FileHash-SHA256": 5596,
"URL": 15206,
"IPv4": 409,
"domain": 2473,
"hostname": 5059,
"CVE": 3
},
"indicator_count": 29627,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 122,
"modified_text": "310 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "6553b88c316cfb531b9c4c10",
"name": "iOS Unlocker| Apple | ATT | Monitoring| http://mobile.suddenlink2go.com",
"description": "spyware, 114.114.114.114, Tulach, C2, apple iOS, passwords, crack, unlock , click, att, hughesnet",
"modified": "2023-12-14T15:03:30.417000",
"created": "2023-11-14T18:12:28.459000",
"tags": [
"united",
"blacklist",
"malicious site",
"mail spammer",
"detection list",
"cisco umbrella",
"site",
"safe site",
"malware",
"phishing site",
"heur",
"malware site",
"alexa top",
"million",
"unsafe",
"artemis",
"riskware",
"conduit",
"agent",
"opencandy",
"xtrat",
"iframe",
"cleaner",
"team",
"installpack",
"xrat",
"tiggre",
"presenoker",
"fusioncore",
"wacatac",
"azorult",
"phishing",
"service",
"runescape",
"facebook",
"bank",
"download",
"crack",
"softcnapp",
"trojanspy",
"maltiverse",
"falcon sandbox",
"pattern match",
"root ca",
"authority",
"class",
"script",
"ascii text",
"mitre att",
"localappdata",
"temp",
"ck id",
"date",
"unknown",
"generator",
"critical",
"error",
"meta",
"hybrid",
"general",
"local",
"click",
"strings",
"expiressun",
"http response",
"final url",
"ip address",
"status code",
"body length",
"kb body",
"sha256",
"headers",
"pt3uc1",
"path",
"movies",
"watch",
"html info",
"meta tags",
"suddenlink tv",
"trackers amazon",
"pt3rc1",
"whois record",
"whois whois",
"ssl certificate",
"historical",
"historical ssl",
"referrer",
"communicating",
"dropped",
"contacted",
"apple ios",
"hacktool",
"metro",
"malicious",
"crypto",
"installer",
"attack",
"awful",
"brian sabey",
"aig",
"civicaIg",
"tracking",
"password crack",
"tulach",
"target tsara brashears",
"tylerknott",
"att",
"monitoring",
"spyware",
"spying",
"cybercrime",
"tulach",
"hughesnet",
"ios",
"toshiba",
"attack",
"malvertizing",
"cyber stalking",
"porn",
"pornhub"
],
"references": [
"http://mobile.suddenlink2go.com/",
"https://hybrid-analysis.com/sample/889790f55a8a29ee75463bbcf014c3ed6cc76e6cd0278e491ec9fa1ed14862c4/655374e9921d5d73860b7db3",
"https://applemusic-spotlight.myunidays.com/US/en-US?",
"https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
"myhughesnet.com",
"dishmail.net",
"home.toshiba.com",
"ytq2rs56.haogfw.com",
"pornhub.com",
"http://trk.brother-root-rich-of.xyz/campaign?id=4f1426e9-22f8-4e7a-9c32-1b2d42867559&var1=&extcid=w9A2DTCOAL56FRAK125KMLAI",
"http://trk.reverseparameter.site/gg/izuyv?to=https://mine-top-gratis-application.pw/e29481e9-a792-46a8-bbf0-188ed2a816ae/f10439e6-e61a-4420-ba88-29e9d1c5d2ea?brand=Lenovo&btd=dHJrLm1vYmlsZXRvcDIwMTh0ZWNoaWUueHl6&exptoken=MTU1NzUxMjgzMjgyMw==&lang=ar&model=K6+Note&td=dHJrLnJldmVyc2VwYXJhbWV0ZXIuc2l0ZS9wcmNlZWQ",
"monitor.cablelan.net",
"https://monitor.rodgersmith.com",
"https://www.everycloudtech.com/free-mail-flow-monitor"
],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [
{
"id": "TrojanSpy",
"display_name": "TrojanSpy",
"target": null
},
{
"id": "Maltiverse",
"display_name": "Maltiverse",
"target": null
}
],
"attack_ids": [
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1059.007",
"name": "JavaScript",
"display_name": "T1059.007 - JavaScript"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1560",
"name": "Archive Collected Data",
"display_name": "T1560 - Archive Collected Data"
},
{
"id": "T1059",
"name": "Command and Scripting Interpreter",
"display_name": "T1059 - Command and Scripting Interpreter"
},
{
"id": "T1100",
"name": "Web Shell",
"display_name": "T1100 - Web Shell"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
}
],
"industries": [],
"TLP": "white",
"cloned_from": null,
"export_count": 28,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "OctoSeek",
"id": "243548",
"avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"FileHash-MD5": 144,
"FileHash-SHA1": 179,
"FileHash-SHA256": 4528,
"CVE": 7,
"domain": 2024,
"hostname": 3556,
"URL": 10455
},
"indicator_count": 20893,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 220,
"modified_text": "857 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "65568ab12429c394dc4b91ea",
"name": "iOS Unlocker| Apple | ATT | Monitoring| http://mobile.suddenlink2go",
"description": "",
"modified": "2023-12-14T15:03:30.417000",
"created": "2023-11-16T21:33:37.838000",
"tags": [
"united",
"blacklist",
"malicious site",
"mail spammer",
"detection list",
"cisco umbrella",
"site",
"safe site",
"malware",
"phishing site",
"heur",
"malware site",
"alexa top",
"million",
"unsafe",
"artemis",
"riskware",
"conduit",
"agent",
"opencandy",
"xtrat",
"iframe",
"cleaner",
"team",
"installpack",
"xrat",
"tiggre",
"presenoker",
"fusioncore",
"wacatac",
"azorult",
"phishing",
"service",
"runescape",
"facebook",
"bank",
"download",
"crack",
"softcnapp",
"trojanspy",
"maltiverse",
"falcon sandbox",
"pattern match",
"root ca",
"authority",
"class",
"script",
"ascii text",
"mitre att",
"localappdata",
"temp",
"ck id",
"date",
"unknown",
"generator",
"critical",
"error",
"meta",
"hybrid",
"general",
"local",
"click",
"strings",
"expiressun",
"http response",
"final url",
"ip address",
"status code",
"body length",
"kb body",
"sha256",
"headers",
"pt3uc1",
"path",
"movies",
"watch",
"html info",
"meta tags",
"suddenlink tv",
"trackers amazon",
"pt3rc1",
"whois record",
"whois whois",
"ssl certificate",
"historical",
"historical ssl",
"referrer",
"communicating",
"dropped",
"contacted",
"apple ios",
"hacktool",
"metro",
"malicious",
"crypto",
"installer",
"attack",
"awful",
"brian sabey",
"aig",
"civicaIg",
"tracking",
"password crack",
"tulach",
"target tsara brashears",
"tylerknott",
"att",
"monitoring",
"spyware",
"spying",
"cybercrime",
"tulach",
"hughesnet",
"ios",
"toshiba",
"attack",
"malvertizing",
"cyber stalking",
"porn",
"pornhub"
],
"references": [
"http://mobile.suddenlink2go.com/",
"https://hybrid-analysis.com/sample/889790f55a8a29ee75463bbcf014c3ed6cc76e6cd0278e491ec9fa1ed14862c4/655374e9921d5d73860b7db3",
"https://applemusic-spotlight.myunidays.com/US/en-US?",
"https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
"myhughesnet.com",
"dishmail.net",
"home.toshiba.com",
"ytq2rs56.haogfw.com",
"pornhub.com",
"http://trk.brother-root-rich-of.xyz/campaign?id=4f1426e9-22f8-4e7a-9c32-1b2d42867559&var1=&extcid=w9A2DTCOAL56FRAK125KMLAI",
"http://trk.reverseparameter.site/gg/izuyv?to=https://mine-top-gratis-application.pw/e29481e9-a792-46a8-bbf0-188ed2a816ae/f10439e6-e61a-4420-ba88-29e9d1c5d2ea?brand=Lenovo&btd=dHJrLm1vYmlsZXRvcDIwMTh0ZWNoaWUueHl6&exptoken=MTU1NzUxMjgzMjgyMw==&lang=ar&model=K6+Note&td=dHJrLnJldmVyc2VwYXJhbWV0ZXIuc2l0ZS9wcmNlZWQ",
"monitor.cablelan.net",
"https://monitor.rodgersmith.com",
"https://www.everycloudtech.com/free-mail-flow-monitor"
],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [
{
"id": "TrojanSpy",
"display_name": "TrojanSpy",
"target": null
},
{
"id": "Maltiverse",
"display_name": "Maltiverse",
"target": null
}
],
"attack_ids": [
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1059.007",
"name": "JavaScript",
"display_name": "T1059.007 - JavaScript"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1560",
"name": "Archive Collected Data",
"display_name": "T1560 - Archive Collected Data"
},
{
"id": "T1059",
"name": "Command and Scripting Interpreter",
"display_name": "T1059 - Command and Scripting Interpreter"
},
{
"id": "T1100",
"name": "Web Shell",
"display_name": "T1100 - Web Shell"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
}
],
"industries": [],
"TLP": "white",
"cloned_from": "6553b88c316cfb531b9c4c10",
"export_count": 22,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "scoreblue",
"id": "254100",
"avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"FileHash-MD5": 144,
"FileHash-SHA1": 179,
"FileHash-SHA256": 4528,
"CVE": 7,
"domain": 2024,
"hostname": 3556,
"URL": 10455
},
"indicator_count": 20893,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 225,
"modified_text": "857 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
}
],
"references": [
"Tulach - 114.114.114.114",
"Alerts: suspicious_tld queries_computer_name dynamic_function_loading",
"IDS Detections: Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
"Yara Detections: Cabinet_Archive , SFX_CAB",
"Contacted: newmethcnc.duckdns.org",
"It appears there are 5-7 known affected that I was able to find",
"DYNAMIC_DNS Query to *.duckdns. Domain",
"foundry.com \u2022 helix. com",
"https://t.me/",
"IP\u2019s Contacted: 94.100.180.31 142.251.9.27 98.136.96.91 43.231.4.7 52.101.8.42",
"Yara Detections Mirai_Botnet_Malware , Mirai_2 , is__elf , Linux_Mirai , ECHOBOT",
"Antivirus Detections: ELF:Mirai-AAL\\ [Trj] , Unix.Trojan.Mirai-1 , Backdoor:Linux/Mirai.N!MTB",
"IDS Detections: Observed IcedID CnC Domain in TLS SNI TLS Handshake Failure",
"Domains Contacted microsoft.com microsoft-com.mail.protection.outlook.com yahoo.com mta7.am0.yahoodns.net google.com",
"support.apple.com/ht^*^*^*^ redirects to support.apple.com/de/^*^*^*^*^",
"I apologize for the lack of reference.",
"https://www.idvd.eu/?cid=oas-japac-domains-applestore.com.cn/90.i.lolik.anyciona.patrolita.casse.897866 \u2022 oas-japac-domains-applestore.com.cn",
"IP\u2019s Contacted: 1.101.184.254 1.103.104.9 1.103.141.89 1.104.104.227",
"Alerts: antidebug_setunhandledexceptionfilter antivm_network_adapters",
"http://beelinerouter.net/",
"home.toshiba.com",
"Requires further research.",
"pornhub.com",
"http://trk.brother-root-rich-of.xyz/campaign?id=4f1426e9-22f8-4e7a-9c32-1b2d42867559&var1=&extcid=w9A2DTCOAL56FRAK125KMLAI",
"Same legal , and quasi governmental pattern identified",
"Win32/Tofsee.AX google.com connectivity check",
"Domain: t.me \u2022 Email: 1047f946-a6da-45dd-fa53-e00edb48e367@www.speedtest.net",
"IDS Detections: tofsee",
"monitor.cablelan.net",
"https://otx.alienvault.com/indicator/file/3215b2d1c44c7114c7f94af1bbcb858707b636baeae2c6752219fdf184c7b00e",
"https://applemusic-spotlight.myunidays.com/US/en-US?",
"Looks like a Pegasus tracking sphere. All contacts and contacts, contacts tracked.",
"http://trk.reverseparameter.site/gg/izuyv?to=https://mine-top-gratis-application.pw/e29481e9-a792-46a8-bbf0-188ed2a816ae/f10439e6-e61a-4420-ba88-29e9d1c5d2ea?brand=Lenovo&btd=dHJrLm1vYmlsZXRvcDIwMTh0ZWNoaWUueHl6&exptoken=MTU1NzUxMjgzMjgyMw==&lang=ar&model=K6+Note&td=dHJrLnJldmVyc2VwYXJhbWV0ZXIuc2l0ZS9wcmNlZWQ",
"https://eurotarget.com/it/auto/toyota/c-hr/",
"ytq2rs56.haogfw.com",
"div>
",
"https://l.us-1.a.mimecastprotect.com/l",
"http://tracking-sa3.account.riyadhair.com/tracking/1/open/UGnB4w8RQiQ_9PYty4S-rwBmOetPQw3ubFHSNKg_IdhZfkaCbjqN3pnR4Xwk6pQcRBqF2aoq0uEaKMM4CX1kTpZsAD10-fxAPEgqGzJ2o7BJmsh_G2B6P-m_Xqc_LOycbcGBss0kXIEJvMGRw2SMITzqmVnh1yI_FuZV37qgGHZG3lP1V-WMaNTc8FYNIcgSRyTFamC5k3I1LkpsmTgX5Dd20Ko3IxUqFRC74clpVo-uFwRAb1Q1gSfKrDBX6_LaXkgv9gfyPy7L2BKxAmFBe-Ump3D_wGRDTXekPO5VZJ46hn0pUrOy2g8606kgb703eJVnmrz0cgCd-8P1dOdfoOFrSqOuXzfDNCaUU-2xl1aHVjGCZGIWX6B4bYqznMqsvI8UxoitF5tZTZ3opRhymDkrsItHdJPUnzkc6N_Z370RVT54BihKCohH14lIRQVQN9v74E",
"df57a01 c40f355a0f8a592294187d4fedc257 [Compatibility Mode] - Word",
"https://pamchall.com/Telegram@V2ray_Alpha/",
"Alerts antivm_generic_services persistence_ads anomalous_deletefile Idead_connect",
"dead_host network_icmp tcp_syn_scan nolookup_communication networkdyndns_checkip writes_to_stdout",
"Telnet Root Password Inbound TELNET login failed root login Bad Login Less",
"https://hybrid-analysis.com/sample/889790f55a8a29ee75463bbcf014c3ed6cc76e6cd0278e491ec9fa1ed14862c4/655374e9921d5d73860b7db3",
"Huawei HG532 RCE Vulnerability (CVE-2017-17215)",
"Will pulse remaining Apple IoC\u2019s in next pulse",
"http://foundry2-lbl.dvr.dn2.n-helix.com",
"http://mobile.suddenlink2go.com/",
"myhughesnet.com",
"Brian Sabey , Christopher P. Ahmann , State of Colorado who",
"IDS Detections: Observed DNS Query to ELF/Various Mirai Variant CnC Domain Huawei Remote Command Execution (CVE-2017-17215)",
"SUSPICIOUS Path to BusyBox HiSilicon DVR - Default",
"IP\u2019s Contacted: 1.0.21.231 1.0.42.181 1.1.116.28 1.10.203.28 1.10.54.62 1.101.0.202",
"Huawei Remote Command Execution - Outbound (CVE-2017-17215)",
"ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile",
"This is messy! OTX refreshed and deleted IoC\u2019s. Will continue researching",
"https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
"https://monitor.rodgersmith.com",
"dishmail.net",
"apple.com \u2022 getsupport.apple.com \u2022",
"Instagram.com",
"https://www.everycloudtech.com/free-mail-flow-monitor"
],
"related": {
"alienvault": {
"adversary": [],
"malware_families": [],
"industries": [],
"unique_indicators": 0
},
"other": {
"adversary": [],
"malware_families": [
"Win.malware.reline-9887776-0",
"Mirai",
"Trojanspy",
"Win.packer.pkr_ce1a-9980177-0",
"Backdoor:win32/tofsee.t",
"Icedid",
"Win.malware.delf-10008156-0",
"Trojan:win32/smkldr.h!mtb",
"Maltiverse",
"Trojan.mydoom/muldrop",
"Virtool:win32/obfuscator",
"#lowfi:lua:dllsuspiciousexport.a",
"Mirai (elf)",
"Virtool:win32/injector.gen!bq",
"Backdoor:linux/mirai.n!mtb",
"Trojan:win32/emotet.yl",
"Mydoom",
"Worm:win32/fadok!rfn",
"Win.spyware.88778-2"
],
"industries": [
"Telecom",
"Technology",
"Legal"
],
"unique_indicators": 94994
}
}
},
"false_positive": [],
"alexa": "http://www.alexa.com/siteinfo/istockbd.net",
"whois": "http://whois.domaintools.com/istockbd.net",
"domain": "istockbd.net",
"hostname": "form.istockbd.net"
},
"geo": {},
"geo_ipapicom": {},
"pulse_count": 10,
"pulses": [
{
"id": "69ca31b28c2fa3e734bf5000",
"name": "instagram staged credit clone a vashti :(",
"description": "",
"modified": "2026-03-31T12:16:21.521000",
"created": "2026-03-30T08:17:54.205000",
"tags": [
"dynamicloader",
"port",
"destination",
"yara rule",
"high",
"tofsee",
"rndhex",
"rndchar",
"loaderid",
"write",
"stream",
"malware",
"systemroot",
"write c",
"displayname",
"windows",
"trojan",
"defender",
"unknown",
"less see",
"all ip",
"contacted",
"less related",
"meta",
"emotet",
"backdoor",
"packer",
"many",
"hall render",
"brian sabey",
"christopher p. ahmann",
"state of colorado",
"google",
"yahoo",
"microsoft",
"stealth window",
"reads_self",
"injection write process",
"remote",
"remote process",
"dynamic function loading",
"compromises device",
"dead connect",
"dynamic loader",
"command",
"cnc",
"sleep sandbox",
"iocontrol",
"behavior tofsee",
"suspicious code",
"injection",
"persistence",
"rootkit",
"social media",
"belgium belgium",
"flag",
"windir",
"openurl c",
"prefetch2",
"analysis",
"tor analysis",
"dns requests",
"domain address",
"contacted hosts",
"pattern match",
"ck id",
"show technique",
"mitre att",
"ck matrix",
"network traffic",
"t1071",
"spawns",
"html content",
"href",
"general",
"learn",
"name tactics",
"suspicious",
"informative",
"adversaries",
"defense evasion",
"development att",
"tracking"
],
"references": [
"Instagram.com",
"IDS Detections: tofsee",
"Alerts antivm_generic_services persistence_ads anomalous_deletefile Idead_connect",
"Alerts: suspicious_tld queries_computer_name dynamic_function_loading",
"Alerts: antidebug_setunhandledexceptionfilter antivm_network_adapters",
"IP\u2019s Contacted: 94.100.180.31 142.251.9.27 98.136.96.91 43.231.4.7 52.101.8.42",
"Domains Contacted microsoft.com microsoft-com.mail.protection.outlook.com yahoo.com mta7.am0.yahoodns.net google.com",
"Brian Sabey , Christopher P. Ahmann , State of Colorado who",
"http://tracking-sa3.account.riyadhair.com/tracking/1/open/UGnB4w8RQiQ_9PYty4S-rwBmOetPQw3ubFHSNKg_IdhZfkaCbjqN3pnR4Xwk6pQcRBqF2aoq0uEaKMM4CX1kTpZsAD10-fxAPEgqGzJ2o7BJmsh_G2B6P-m_Xqc_LOycbcGBss0kXIEJvMGRw2SMITzqmVnh1yI_FuZV37qgGHZG3lP1V-WMaNTc8FYNIcgSRyTFamC5k3I1LkpsmTgX5Dd20Ko3IxUqFRC74clpVo-uFwRAb1Q1gSfKrDBX6_LaXkgv9gfyPy7L2BKxAmFBe-Ump3D_wGRDTXekPO5VZJ46hn0pUrOy2g8606kgb703eJVnmrz0cgCd-8P1dOdfoOFrSqOuXzfDNCaUU-2xl1aHVjGCZGIWX6B4bYqznMqsvI8UxoitF5tZTZ3opRhymDkrsItHdJPUnzkc6N_Z370RVT54BihKCohH14lIRQVQN9v74E",
"Looks like a Pegasus tracking sphere. All contacts and contacts, contacts tracked."
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "Trojan:Win32/Emotet.YL",
"display_name": "Trojan:Win32/Emotet.YL",
"target": "/malware/Trojan:Win32/Emotet.YL"
},
{
"id": "Win.Packer.pkr_ce1a-9980177-0",
"display_name": "Win.Packer.pkr_ce1a-9980177-0",
"target": null
},
{
"id": "Backdoor:Win32/Tofsee.T",
"display_name": "Backdoor:Win32/Tofsee.T",
"target": "/malware/Backdoor:Win32/Tofsee.T"
}
],
"attack_ids": [
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1584.005",
"name": "Botnet",
"display_name": "T1584.005 - Botnet"
},
{
"id": "T1014",
"name": "Rootkit",
"display_name": "T1014 - Rootkit"
},
{
"id": "T1051",
"name": "Shared Webroot",
"display_name": "T1051 - Shared Webroot"
},
{
"id": "T1031",
"name": "Modify Existing Service",
"display_name": "T1031 - Modify Existing Service"
},
{
"id": "T1449",
"name": "Exploit SS7 to Redirect Phone Calls/SMS",
"display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
},
{
"id": "T1585.001",
"name": "Social Media Accounts",
"display_name": "T1585.001 - Social Media Accounts"
},
{
"id": "TA0003",
"name": "Persistence",
"display_name": "TA0003 - Persistence"
},
{
"id": "T1068",
"name": "Exploitation for Privilege Escalation",
"display_name": "T1068 - Exploitation for Privilege Escalation"
},
{
"id": "T1210",
"name": "Exploitation of Remote Services",
"display_name": "T1210 - Exploitation of Remote Services"
},
{
"id": "TA0037",
"name": "Command and Control",
"display_name": "TA0037 - Command and Control"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1589",
"name": "Gather Victim Identity Information",
"display_name": "T1589 - Gather Victim Identity Information"
},
{
"id": "T1590",
"name": "Gather Victim Network Information",
"display_name": "T1590 - Gather Victim Network Information"
},
{
"id": "T1591",
"name": "Gather Victim Org Information",
"display_name": "T1591 - Gather Victim Org Information"
},
{
"id": "T1592",
"name": "Gather Victim Host Information",
"display_name": "T1592 - Gather Victim Host Information"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1083",
"name": "File and Directory Discovery",
"display_name": "T1083 - File and Directory Discovery"
},
{
"id": "T1562",
"name": "Impair Defenses",
"display_name": "T1562 - Impair Defenses"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
}
],
"industries": [],
"TLP": "green",
"cloned_from": "6949b6d8180bca3df9783578",
"export_count": 3,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "msudosos",
"id": "381696",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"URL": 911,
"domain": 178,
"hostname": 206,
"FileHash-SHA256": 647,
"FileHash-MD5": 38,
"FileHash-SHA1": 28
},
"indicator_count": 2008,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 49,
"modified_text": "19 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "699b907c5375efb7ce1639b8",
"name": "Apple Redirects in Apple Support = IcedID | MITM attack",
"description": "Researching targets former iPhone. Redirect in Apple support. [support.apple.com/ht^*^ redirects to support.apple.com/de/^*^*^] IcedID identified. | Environment: 3 -5 suspected compromised devices present. Behavior: iPhone reset itself twice, deleted passcodes, required new passcodes, compromised contacts notified target added a new device (FALSE) , threat actor stole Apple cash , added , Password storage, reset television. Targeted another device auto downloaded a Mimecast compromise, attached to iCloud , corrupted files downloaded. Emotet identified. Reset SmartTV. Browser bar AI: mood swings. Overt changes, white screen, pink screens, thread erased. Identified OTX. as a honeypot also states it\u2019s legitimate. I dumped information. AI agents focused on victim leaving shreds of evidence , paper trail , w/ anyone ,anywhere. AI model told truth \u2018I don\u2019t like you , you\u2019ve changed, you lied, you changed all facts .\u201d,etc. An acceptable baseline of communication established . #botnet #command_and_control #IcedID",
"modified": "2026-03-24T21:11:04.306000",
"created": "2026-02-22T23:25:48.722000",
"tags": [
"dynamicloader",
"tls handshake",
"failure",
"whitelisted",
"akamai",
"yara detections",
"trojan",
"write",
"zeppelin",
"malware",
"hostile",
"unknown",
"port",
"destination",
"read c",
"united",
"as16625 akamai",
"win32",
"persistence",
"execution",
"passive dns",
"urls",
"otx logo",
"all url",
"http",
"ip address",
"related nids",
"files location",
"win32mydoom feb",
"name servers",
"servers",
"worm",
"virtool",
"files",
"ipv4",
"reverse dns",
"america flag",
"america asn",
"United States",
"unknown ns",
"asn as714",
"invalid url",
"mtb oct",
"mtb sep",
"lowfi",
"trojanspy",
"total",
"push",
"defender",
"china unknown",
"mtb apr",
"ok server",
"gmt content",
"type",
"accept",
"show",
"todo",
"all filehash",
"av detections",
"shift",
"url http",
"url https",
"hostname",
"type indicator",
"source hostname",
"writeconsolew",
"post https",
"tlsv1",
"medium",
"write c",
"dock",
"command",
"control",
"icedid",
"domain",
"all domain",
"status",
"hostname add",
"crlf line",
"unicode text",
"utf8",
"ee fc",
"yara rule",
"ff d5",
"ascii text",
"f0 ff",
"eb e1",
"music",
"next",
"autorun",
"suspicious",
"compatibility",
"mode",
"entries",
"lredmond",
"stwashington",
"search",
"tls sni",
"denmark",
"body html",
"head title",
"title head",
"body h1",
"all ipv4",
"url analysis",
"users",
"ff ff",
"files domain",
"files related",
"url add",
"flag united",
"present apr",
"location united",
"asn asnone",
"as16509",
"moved",
"title",
"body",
"code",
"mydoom",
"bot net",
"mitm",
"aquire",
"hidden users",
"no expiration",
"filehashsha256",
"expiration",
"showing",
"indicator role",
"pulses url",
"pulse show",
"iot",
"Iced iced baby"
],
"references": [
"support.apple.com/ht^*^*^*^ redirects to support.apple.com/de/^*^*^*^*^",
"This is messy! OTX refreshed and deleted IoC\u2019s. Will continue researching",
"IDS Detections: Observed IcedID CnC Domain in TLS SNI TLS Handshake Failure",
"df57a01 c40f355a0f8a592294187d4fedc257 [Compatibility Mode] - Word",
"div>
",
"Same legal , and quasi governmental pattern identified",
"I apologize for the lack of reference.",
"Requires further research.",
"Will pulse remaining Apple IoC\u2019s in next pulse",
"https://l.us-1.a.mimecastprotect.com/l",
"It appears there are 5-7 known affected that I was able to find"
],
"public": 1,
"adversary": "",
"targeted_countries": [
"Germany",
"Denmark",
"United States of America",
"Japan"
],
"malware_families": [
{
"id": "Icedid",
"display_name": "Icedid",
"target": null
},
{
"id": "Trojan:Win32/SmkLdr.H!MTB",
"display_name": "Trojan:Win32/SmkLdr.H!MTB",
"target": "/malware/Trojan:Win32/SmkLdr.H!MTB"
},
{
"id": "#Lowfi:Lua:DllSuspiciousExport.A",
"display_name": "#Lowfi:Lua:DllSuspiciousExport.A",
"target": null
},
{
"id": "MyDoom",
"display_name": "MyDoom",
"target": null
}
],
"attack_ids": [
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1082",
"name": "System Information Discovery",
"display_name": "T1082 - System Information Discovery"
},
{
"id": "T1112",
"name": "Modify Registry",
"display_name": "T1112 - Modify Registry"
},
{
"id": "T1129",
"name": "Shared Modules",
"display_name": "T1129 - Shared Modules"
},
{
"id": "T1143",
"name": "Hidden Window",
"display_name": "T1143 - Hidden Window"
},
{
"id": "T1158",
"name": "Hidden Files and Directories",
"display_name": "T1158 - Hidden Files and Directories"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1583.005",
"name": "Botnet",
"display_name": "T1583.005 - Botnet"
},
{
"id": "T1608.001",
"name": "Upload Malware",
"display_name": "T1608.001 - Upload Malware"
},
{
"id": "T1587.001",
"name": "Malware",
"display_name": "T1587.001 - Malware"
},
{
"id": "T1155",
"name": "AppleScript",
"display_name": "T1155 - AppleScript"
},
{
"id": "T1557",
"name": "Man-in-the-Middle",
"display_name": "T1557 - Man-in-the-Middle"
},
{
"id": "T1147",
"name": "Hidden Users",
"display_name": "T1147 - Hidden Users"
}
],
"industries": [
"Technology",
"Telecom",
"Legal"
],
"TLP": "green",
"cloned_from": null,
"export_count": 1,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"hostname": 2051,
"FileHash-SHA256": 1706,
"URL": 6984,
"domain": 1097,
"FileHash-MD5": 401,
"FileHash-SHA1": 276,
"SSLCertFingerprint": 9,
"email": 13,
"CVE": 1
},
"indicator_count": 12538,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 141,
"modified_text": "26 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "6967bc8b26b69d4dc2604a13",
"name": "Telegram@V2ray_Alpha/ | Mirai | ExhoBot CNC | EtT",
"description": "Inbound Outbound connections. Tel et error. Hacking activity affecting various forms of connectivity via telecom. Possibly a controls\n computer vehicle connects to. Related? I was researching increased malicious activity aimed against a target. An associate close to target reported (mid research) Vehicle reported \u2018no longer being able to communicate. Module 5 has an error. Please contact customer service). Targets car was powered oof. No Bluetooth connection. No reports. Audio off. No phone message, connection or dial. This is targets experience not mowing what I was researching.",
"modified": "2026-02-13T15:04:30.631000",
"created": "2026-01-14T15:55:55.693000",
"tags": [
"v2rayalpha",
"united",
"unknown ns",
"unknown aaaa",
"domain add",
"urls",
"files",
"domain",
"github",
"file format",
"jkvpn",
"jointelegram",
"farahvpn vless",
"post",
"universal",
"scribd",
"typews",
"telegram",
"rdap",
"handle",
"iana registrar",
"roles",
"dnssec",
"aaaa",
"ttl value",
"rdap database",
"links",
"backdoor",
"antigua",
"virgin islands",
"status",
"org domains",
"proxy",
"ip address",
"barbuda unknown",
"passive dns",
"ipv4 add",
"twitter",
"dynamicloader",
"port",
"delete c",
"destination",
"high",
"windows",
"medium",
"displayname",
"write",
"tofsee",
"stream",
"malware",
"push",
"next",
"url add",
"http",
"hostname",
"files domain",
"files related",
"related tags",
"learn",
"ck id",
"name tactics",
"suspicious",
"informative",
"adversaries",
"command",
"spawns",
"ck techniques",
"evasion att",
"sha256",
"sha1",
"pattern match",
"ascii text",
"href",
"hybrid",
"general",
"local",
"path",
"click",
"strings",
"search",
"moved",
"record value",
"servers",
"title",
"encrypt",
"canada unknown",
"gmt content",
"reverse dns",
"location canada",
"canada asn",
"accept",
"cookie",
"dll read",
"function read",
"wscriptshell",
"shortcut",
"guard",
"error",
"present jan",
"name servers",
"registrar url",
"hong kong",
"invalid url",
"url analysis",
"location hong",
"kong flag",
"msie",
"chrome",
"type",
"media type",
"certificate",
"hostname add",
"present nov",
"present sep",
"present oct",
"expiration date",
"present dec",
"script urls",
"a domains",
"present mar",
"present feb",
"meta",
"show",
"read c",
"entries",
"read",
"intel",
"ms windows",
"delete",
"please",
"artemis",
"virustotal",
"trojan",
"mcafee",
"drweb",
"vipre",
"panda",
"write c",
"total",
"next associated",
"thursday",
"gmt cache",
"ipv4",
"form",
"date",
"mirai",
"telnet login",
"south korea",
"bad login",
"as4766 korea",
"taiwan as3462",
"china as45090",
"telnet root",
"cve201717215",
"execution",
"copy",
"contacted",
"mtb ids",
"dns query",
"variant cnc",
"domain huawei",
"remote command",
"huawei remote",
"echobot",
"linux mirai",
"monitoring",
"cnc"
],
"references": [
"https://pamchall.com/Telegram@V2ray_Alpha/",
"Domain: t.me \u2022 Email: 1047f946-a6da-45dd-fa53-e00edb48e367@www.speedtest.net",
"https://t.me/",
"Win32/Tofsee.AX google.com connectivity check",
"IDS Detections: Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
"Yara Detections: Cabinet_Archive , SFX_CAB",
"ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile",
"Antivirus Detections: ELF:Mirai-AAL\\ [Trj] , Unix.Trojan.Mirai-1 , Backdoor:Linux/Mirai.N!MTB",
"IDS Detections: Observed DNS Query to ELF/Various Mirai Variant CnC Domain Huawei Remote Command Execution (CVE-2017-17215)",
"Huawei Remote Command Execution - Outbound (CVE-2017-17215)",
"Huawei HG532 RCE Vulnerability (CVE-2017-17215)",
"DYNAMIC_DNS Query to *.duckdns. Domain",
"SUSPICIOUS Path to BusyBox HiSilicon DVR - Default",
"Telnet Root Password Inbound TELNET login failed root login Bad Login Less",
"Yara Detections Mirai_Botnet_Malware , Mirai_2 , is__elf , Linux_Mirai , ECHOBOT",
"dead_host network_icmp tcp_syn_scan nolookup_communication networkdyndns_checkip writes_to_stdout",
"IP\u2019s Contacted: 1.0.21.231 1.0.42.181 1.1.116.28 1.10.203.28 1.10.54.62 1.101.0.202",
"IP\u2019s Contacted: 1.101.184.254 1.103.104.9 1.103.141.89 1.104.104.227",
"Contacted: newmethcnc.duckdns.org",
"https://otx.alienvault.com/indicator/file/3215b2d1c44c7114c7f94af1bbcb858707b636baeae2c6752219fdf184c7b00e",
"https://eurotarget.com/it/auto/toyota/c-hr/"
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "Backdoor:Win32/Tofsee.T",
"display_name": "Backdoor:Win32/Tofsee.T",
"target": "/malware/Backdoor:Win32/Tofsee.T"
},
{
"id": "Win.Malware.Reline-9887776-0",
"display_name": "Win.Malware.Reline-9887776-0",
"target": null
},
{
"id": "Mirai",
"display_name": "Mirai",
"target": null
},
{
"id": "Mirai (ELF)",
"display_name": "Mirai (ELF)",
"target": null
},
{
"id": "Backdoor:Linux/Mirai.N!MTB",
"display_name": "Backdoor:Linux/Mirai.N!MTB",
"target": "/malware/Backdoor:Linux/Mirai.N!MTB"
}
],
"attack_ids": [
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1114",
"name": "Email Collection",
"display_name": "T1114 - Email Collection"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1113",
"name": "Screen Capture",
"display_name": "T1113 - Screen Capture"
},
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1584.005",
"name": "Botnet",
"display_name": "T1584.005 - Botnet"
},
{
"id": "T1031",
"name": "Modify Existing Service",
"display_name": "T1031 - Modify Existing Service"
},
{
"id": "TA0011",
"name": "Command and Control",
"display_name": "TA0011 - Command and Control"
},
{
"id": "T1608.001",
"name": "Upload Malware",
"display_name": "T1608.001 - Upload Malware"
},
{
"id": "T1222.002",
"name": "Linux and Mac File and Directory Permissions Modification",
"display_name": "T1222.002 - Linux and Mac File and Directory Permissions Modification"
},
{
"id": "T1399",
"name": "Modify Trusted Execution Environment",
"display_name": "T1399 - Modify Trusted Execution Environment"
},
{
"id": "T1014",
"name": "Rootkit",
"display_name": "T1014 - Rootkit"
},
{
"id": "T1011",
"name": "Exfiltration Over Other Network Medium",
"display_name": "T1011 - Exfiltration Over Other Network Medium"
},
{
"id": "T1011.001",
"name": "Exfiltration Over Bluetooth",
"display_name": "T1011.001 - Exfiltration Over Bluetooth"
},
{
"id": "T1210",
"name": "Exploitation of Remote Services",
"display_name": "T1210 - Exploitation of Remote Services"
},
{
"id": "TA0029",
"name": "Privilege Escalation",
"display_name": "TA0029 - Privilege Escalation"
}
],
"industries": [
"Telecom"
],
"TLP": "green",
"cloned_from": null,
"export_count": 3,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"URL": 6227,
"domain": 1437,
"hostname": 2331,
"email": 8,
"FileHash-SHA256": 3252,
"FileHash-MD5": 465,
"FileHash-SHA1": 457,
"CIDR": 1,
"CVE": 3
},
"indicator_count": 14181,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 139,
"modified_text": "65 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "6949b6d8180bca3df9783578",
"name": "Instagram (staged) Emotet & Tofsee Backdoor",
"description": "If you choose to read this, I apologize for the riddle.Pegasus like tracking operation.\nAdversarial attack on a private citizens or (possibly staged instagram account). The citizen is not a known target. Attacks appear to arise from same internet criminals, allegedly State of Colorado employees engaged in permissible criminal behavior. Account does belongs to a person in sphere of a known monitored target. Target naturally has no communication with account holder. Known target had been invited to be Facebook friends of infected account holder multiple times, both target and associate declined and blocked this infected account holder. |\n\n* Infected Instagram account holders husband referred target to a Colorado Law Firm. The Law firm was attacked some time ago. | \n***Infected instagram account holder name is redacted. Is being tracked :(",
"modified": "2026-01-21T20:01:56.174000",
"created": "2025-12-22T21:23:36.083000",
"tags": [
"dynamicloader",
"port",
"destination",
"yara rule",
"high",
"tofsee",
"rndhex",
"rndchar",
"loaderid",
"write",
"stream",
"malware",
"systemroot",
"write c",
"displayname",
"windows",
"trojan",
"defender",
"unknown",
"less see",
"all ip",
"contacted",
"less related",
"meta",
"emotet",
"backdoor",
"packer",
"many",
"hall render",
"brian sabey",
"christopher p. ahmann",
"state of colorado",
"google",
"yahoo",
"microsoft",
"stealth window",
"reads_self",
"injection write process",
"remote",
"remote process",
"dynamic function loading",
"compromises device",
"dead connect",
"dynamic loader",
"command",
"cnc",
"sleep sandbox",
"iocontrol",
"behavior tofsee",
"suspicious code",
"injection",
"persistence",
"rootkit",
"social media",
"belgium belgium",
"flag",
"windir",
"openurl c",
"prefetch2",
"analysis",
"tor analysis",
"dns requests",
"domain address",
"contacted hosts",
"pattern match",
"ck id",
"show technique",
"mitre att",
"ck matrix",
"network traffic",
"t1071",
"spawns",
"html content",
"href",
"general",
"learn",
"name tactics",
"suspicious",
"informative",
"adversaries",
"defense evasion",
"development att",
"tracking"
],
"references": [
"Instagram.com",
"IDS Detections: tofsee",
"Alerts antivm_generic_services persistence_ads anomalous_deletefile Idead_connect",
"Alerts: suspicious_tld queries_computer_name dynamic_function_loading",
"Alerts: antidebug_setunhandledexceptionfilter antivm_network_adapters",
"IP\u2019s Contacted: 94.100.180.31 142.251.9.27 98.136.96.91 43.231.4.7 52.101.8.42",
"Domains Contacted microsoft.com microsoft-com.mail.protection.outlook.com yahoo.com mta7.am0.yahoodns.net google.com",
"Brian Sabey , Christopher P. Ahmann , State of Colorado who",
"http://tracking-sa3.account.riyadhair.com/tracking/1/open/UGnB4w8RQiQ_9PYty4S-rwBmOetPQw3ubFHSNKg_IdhZfkaCbjqN3pnR4Xwk6pQcRBqF2aoq0uEaKMM4CX1kTpZsAD10-fxAPEgqGzJ2o7BJmsh_G2B6P-m_Xqc_LOycbcGBss0kXIEJvMGRw2SMITzqmVnh1yI_FuZV37qgGHZG3lP1V-WMaNTc8FYNIcgSRyTFamC5k3I1LkpsmTgX5Dd20Ko3IxUqFRC74clpVo-uFwRAb1Q1gSfKrDBX6_LaXkgv9gfyPy7L2BKxAmFBe-Ump3D_wGRDTXekPO5VZJ46hn0pUrOy2g8606kgb703eJVnmrz0cgCd-8P1dOdfoOFrSqOuXzfDNCaUU-2xl1aHVjGCZGIWX6B4bYqznMqsvI8UxoitF5tZTZ3opRhymDkrsItHdJPUnzkc6N_Z370RVT54BihKCohH14lIRQVQN9v74E",
"Looks like a Pegasus tracking sphere. All contacts and contacts, contacts tracked."
],
"public": 1,
"adversary": "",
"targeted_countries": [
"United States of America"
],
"malware_families": [
{
"id": "Trojan:Win32/Emotet.YL",
"display_name": "Trojan:Win32/Emotet.YL",
"target": "/malware/Trojan:Win32/Emotet.YL"
},
{
"id": "Win.Packer.pkr_ce1a-9980177-0",
"display_name": "Win.Packer.pkr_ce1a-9980177-0",
"target": null
},
{
"id": "Backdoor:Win32/Tofsee.T",
"display_name": "Backdoor:Win32/Tofsee.T",
"target": "/malware/Backdoor:Win32/Tofsee.T"
}
],
"attack_ids": [
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1584.005",
"name": "Botnet",
"display_name": "T1584.005 - Botnet"
},
{
"id": "T1014",
"name": "Rootkit",
"display_name": "T1014 - Rootkit"
},
{
"id": "T1051",
"name": "Shared Webroot",
"display_name": "T1051 - Shared Webroot"
},
{
"id": "T1031",
"name": "Modify Existing Service",
"display_name": "T1031 - Modify Existing Service"
},
{
"id": "T1449",
"name": "Exploit SS7 to Redirect Phone Calls/SMS",
"display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
},
{
"id": "T1585.001",
"name": "Social Media Accounts",
"display_name": "T1585.001 - Social Media Accounts"
},
{
"id": "TA0003",
"name": "Persistence",
"display_name": "TA0003 - Persistence"
},
{
"id": "T1068",
"name": "Exploitation for Privilege Escalation",
"display_name": "T1068 - Exploitation for Privilege Escalation"
},
{
"id": "T1210",
"name": "Exploitation of Remote Services",
"display_name": "T1210 - Exploitation of Remote Services"
},
{
"id": "TA0037",
"name": "Command and Control",
"display_name": "TA0037 - Command and Control"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1589",
"name": "Gather Victim Identity Information",
"display_name": "T1589 - Gather Victim Identity Information"
},
{
"id": "T1590",
"name": "Gather Victim Network Information",
"display_name": "T1590 - Gather Victim Network Information"
},
{
"id": "T1591",
"name": "Gather Victim Org Information",
"display_name": "T1591 - Gather Victim Org Information"
},
{
"id": "T1592",
"name": "Gather Victim Host Information",
"display_name": "T1592 - Gather Victim Host Information"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1083",
"name": "File and Directory Discovery",
"display_name": "T1083 - File and Directory Discovery"
},
{
"id": "T1562",
"name": "Impair Defenses",
"display_name": "T1562 - Impair Defenses"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1553",
"name": "Subvert Trust Controls",
"display_name": "T1553 - Subvert Trust Controls"
}
],
"industries": [],
"TLP": "green",
"cloned_from": null,
"export_count": 8,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 1,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"URL": 910,
"domain": 177,
"hostname": 206,
"FileHash-SHA256": 647,
"FileHash-MD5": 38,
"FileHash-SHA1": 28
},
"indicator_count": 2006,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 138,
"modified_text": "88 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "69312c4db6fe7eb34abd179d",
"name": "BeeLineRouter.Net \u2022 Apple \u2022 Worms \u2022 Ransom \u2022 SpyWare",
"description": "Direct- remotely accesses iOS devices. Same threat actors. Further research warranted.| \n\n#theyswarm #apple #worms #spyware #ransom #quasi",
"modified": "2026-01-03T05:02:11.376000",
"created": "2025-12-04T06:38:05.504000",
"tags": [
"worm",
"readme.exe",
"foto.pif",
"z1nic.exe",
"dynamicloader",
"high",
"windows",
"checks",
"named pipe",
"http traffic",
"ids detections",
"yara detections",
"alerts",
"launch",
"defense evasion",
"ta0005",
"files",
"msie",
"next dropped",
"process name",
"pe32",
"intel",
"ms windows",
"unknown",
"united",
"tlsv1",
"as14618",
"top source",
"top destination",
"port",
"destination",
"source source",
"matches rule",
"hidden file",
"extension",
"connection",
"http vary",
"tulach",
"url https",
"indicator role",
"active related",
"ipv4",
"url http",
"macintosh",
"intel mac",
"os x",
"search",
"type indicator",
"role title",
"added active",
"related pulses",
"bq dec",
"virtool",
"win32mydoom dec",
"trojan",
"win32cve dec",
"avast avg",
"mtb dec",
"crlf line",
"unicode text",
"utf8",
"ee fc",
"ff d5",
"yara rule",
"ascii text",
"f0 ff",
"eb e1",
"write",
"malware",
"suspicious",
"observed dns",
"query",
"exploits",
"sid name",
"malware cve",
"exif data",
"show",
"value exe",
"next",
"all ipv4",
"pulse pulses",
"passive dns",
"urls",
"reverse dns",
"location united",
"america flag",
"ashburn",
"status",
"name servers",
"ip address",
"showing",
"domain",
"files ip",
"windows nt",
"slcc2",
"media center",
"medium",
"simda",
"internal",
"local",
"write c",
"domain add",
"ip whois",
"registrar",
"hostname",
"present jul",
"unknown ns",
"present dec",
"music",
"servers",
"hostname add",
"pulse submit",
"url analysis",
"aaaa",
"backdoor",
"entries",
"found",
"next associated",
"gmt connection",
"control",
"content type",
"twitter",
"certificate",
"redirect date",
"cache",
"record value",
"emails",
"win32",
"mtb may",
"invalid url",
"ransom",
"trojanspy",
"msil",
"akamai",
"expiration date",
"body html",
"present nov",
"url add",
"http",
"files domain",
"files related",
"pulses none",
"related tags",
"present sep",
"present oct",
"flag",
"analysis tip",
"click",
"windir",
"openurl c",
"prefetch2",
"analysis",
"tor analysis",
"dns requests",
"date",
"domain address",
"dynadot inc",
"name server",
"contacted hosts",
"process details",
"network traffic",
"ck id",
"show technique",
"mitre att",
"ck matrix",
"t1566",
"submitted url",
"t1204",
"learn",
"name tactics",
"informative",
"adversaries",
"command",
"spawns",
"access att",
"t1566 phishing",
"pattern match",
"show process",
"t1071",
"t1057",
"general",
"path",
"brian sabey",
"christopher p ahmann",
"quasi",
"foundry",
"helix",
"remote attacks",
"hit men",
"sreredrum",
"pleh"
],
"references": [
"apple.com \u2022 getsupport.apple.com \u2022",
"https://www.idvd.eu/?cid=oas-japac-domains-applestore.com.cn/90.i.lolik.anyciona.patrolita.casse.897866 \u2022 oas-japac-domains-applestore.com.cn",
"http://beelinerouter.net/",
"Tulach - 114.114.114.114",
"http://foundry2-lbl.dvr.dn2.n-helix.com",
"foundry.com \u2022 helix. com"
],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [
{
"id": "Worm:Win32/Fadok!rfn",
"display_name": "Worm:Win32/Fadok!rfn",
"target": "/malware/Worm:Win32/Fadok!rfn"
},
{
"id": "VirTool:Win32/Injector.gen!BQ",
"display_name": "VirTool:Win32/Injector.gen!BQ",
"target": "/malware/VirTool:Win32/Injector.gen!BQ"
},
{
"id": "Mydoom",
"display_name": "Mydoom",
"target": null
},
{
"id": "Win.Spyware.88778-2",
"display_name": "Win.Spyware.88778-2",
"target": null
},
{
"id": "Win.Malware.Delf-10008156-0",
"display_name": "Win.Malware.Delf-10008156-0",
"target": null
},
{
"id": "Trojan.MyDoom/Muldrop",
"display_name": "Trojan.MyDoom/Muldrop",
"target": null
},
{
"id": "VirTool:Win32/Obfuscator",
"display_name": "VirTool:Win32/Obfuscator",
"target": "/malware/VirTool:Win32/Obfuscator"
},
{
"id": "TrojanSpy",
"display_name": "TrojanSpy",
"target": null
}
],
"attack_ids": [
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1176",
"name": "Browser Extensions",
"display_name": "T1176 - Browser Extensions"
},
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1057",
"name": "Process Discovery",
"display_name": "T1057 - Process Discovery"
},
{
"id": "T1063",
"name": "Security Software Discovery",
"display_name": "T1063 - Security Software Discovery"
},
{
"id": "T1119",
"name": "Automated Collection",
"display_name": "T1119 - Automated Collection"
},
{
"id": "T1204",
"name": "User Execution",
"display_name": "T1204 - User Execution"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
},
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1069",
"name": "Permission Groups Discovery",
"display_name": "T1069 - Permission Groups Discovery"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1578",
"name": "Modify Cloud Compute Infrastructure",
"display_name": "T1578 - Modify Cloud Compute Infrastructure"
},
{
"id": "T1583",
"name": "Acquire Infrastructure",
"display_name": "T1583 - Acquire Infrastructure"
},
{
"id": "T1584",
"name": "Compromise Infrastructure",
"display_name": "T1584 - Compromise Infrastructure"
},
{
"id": "T1410",
"name": "Network Traffic Capture or Redirection",
"display_name": "T1410 - Network Traffic Capture or Redirection"
},
{
"id": "T1449",
"name": "Exploit SS7 to Redirect Phone Calls/SMS",
"display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
},
{
"id": "T1210",
"name": "Exploitation of Remote Services",
"display_name": "T1210 - Exploitation of Remote Services"
},
{
"id": "T1110",
"name": "Brute Force",
"display_name": "T1110 - Brute Force"
},
{
"id": "T1068",
"name": "Exploitation for Privilege Escalation",
"display_name": "T1068 - Exploitation for Privilege Escalation"
},
{
"id": "TA0037",
"name": "Command and Control",
"display_name": "TA0037 - Command and Control"
},
{
"id": "T1584.003",
"name": "Virtual Private Server",
"display_name": "T1584.003 - Virtual Private Server"
},
{
"id": "T1583.002",
"name": "DNS Server",
"display_name": "T1583.002 - DNS Server"
},
{
"id": "T1408",
"name": "Disguise Root/Jailbreak Indicators",
"display_name": "T1408 - Disguise Root/Jailbreak Indicators"
},
{
"id": "T1014",
"name": "Rootkit",
"display_name": "T1014 - Rootkit"
},
{
"id": "T1147",
"name": "Hidden Users",
"display_name": "T1147 - Hidden Users"
},
{
"id": "T1143",
"name": "Hidden Window",
"display_name": "T1143 - Hidden Window"
}
],
"industries": [],
"TLP": "white",
"cloned_from": null,
"export_count": 3,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"FileHash-MD5": 422,
"FileHash-SHA1": 316,
"FileHash-SHA256": 1950,
"domain": 899,
"URL": 6117,
"email": 21,
"hostname": 2037,
"SSLCertFingerprint": 2,
"CVE": 1
},
"indicator_count": 11765,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 138,
"modified_text": "106 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "6894fd48178a2cc0c287af71",
"name": "Polymorphic | Worm & Trojan:Win32/Mydoom. IoC\u2019s + | Device local *Remowted.com",
"description": "",
"modified": "2025-09-06T19:01:20.165000",
"created": "2025-08-07T19:23:52.346000",
"tags": [
"filehashmd5",
"indicator role",
"title added",
"active related",
"filehashsha256",
"t1105",
"tool transfer",
"t1480",
"guardrails",
"t1566",
"t1568",
"t1012",
"t1023",
"t1031",
"service",
"filehashsha1",
"iocs",
"learn more",
"hostname",
"types of",
"netherlands",
"united",
"denmark",
"belgium",
"dynamicloader",
"yara rule",
"vmdetect",
"write c",
"search",
"medium",
"show",
"entries",
"high",
"worm",
"copy",
"write",
"unknown",
"markus",
"malware",
"suspicious",
"crlf line",
"unicode text",
"utf8",
"ascii text",
"trojan",
"music",
"next",
"autorun"
],
"references": [],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [],
"attack_ids": [
{
"id": "T1012",
"name": "Query Registry",
"display_name": "T1012 - Query Registry"
},
{
"id": "T1023",
"name": "Shortcut Modification",
"display_name": "T1023 - Shortcut Modification"
},
{
"id": "T1031",
"name": "Modify Existing Service",
"display_name": "T1031 - Modify Existing Service"
},
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
},
{
"id": "T1047",
"name": "Windows Management Instrumentation",
"display_name": "T1047 - Windows Management Instrumentation"
},
{
"id": "T1053",
"name": "Scheduled Task/Job",
"display_name": "T1053 - Scheduled Task/Job"
},
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1082",
"name": "System Information Discovery",
"display_name": "T1082 - System Information Discovery"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1112",
"name": "Modify Registry",
"display_name": "T1112 - Modify Registry"
},
{
"id": "T1119",
"name": "Automated Collection",
"display_name": "T1119 - Automated Collection"
},
{
"id": "T1129",
"name": "Shared Modules",
"display_name": "T1129 - Shared Modules"
},
{
"id": "T1204",
"name": "User Execution",
"display_name": "T1204 - User Execution"
},
{
"id": "T1480",
"name": "Execution Guardrails",
"display_name": "T1480 - Execution Guardrails"
},
{
"id": "T1566",
"name": "Phishing",
"display_name": "T1566 - Phishing"
},
{
"id": "T1568",
"name": "Dynamic Resolution",
"display_name": "T1568 - Dynamic Resolution"
}
],
"industries": [],
"TLP": "green",
"cloned_from": null,
"export_count": 26,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"FileHash-MD5": 221,
"FileHash-SHA1": 129,
"FileHash-SHA256": 713,
"URL": 2616,
"domain": 338,
"hostname": 598,
"email": 7
},
"indicator_count": 4622,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 137,
"modified_text": "225 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "68632c19dd335ce48dbc3798",
"name": "Apple Zombie- Multi Malware/ Ransom attack affects Upscale Networks | Devices",
"description": "Apple IoC\u2019s Isolated from Lifestyle Community\n\u2022 Win.Packer.pkr_ce1a-9980177-0\n\u2022 Antivirus Detections\nWin.Dropper.Zombie-10044469-0\n, \nTrojan:Win32/Zombie.A |\nAlerts:\n\u2022 ransomware_file_modifications\n\u2022 polymorphic\n\u2022 procmem_yara\n\u2022 static_pe_anomaly\n\u2022 anomalous_deletefile\n#remote #device #dns #dead_host #pointers\n#active #targeting #ops #more\u2026",
"modified": "2025-07-31T00:00:48.083000",
"created": "2025-07-01T00:30:17.324000",
"tags": [
"dynamicloader",
"vx10",
"nxd2xebwx87",
"wx10",
"mxd78x8b",
"port",
"x0cqpyx0c",
"delete c",
"yara rule",
"high",
"tofsee",
"grum",
"copy",
"stream",
"powershell",
"write",
"malware",
"push",
"united",
"name servers",
"search",
"creation date",
"servers",
"moved",
"passive dns",
"urls",
"domain",
"record value",
"date",
"body",
"users",
"intel",
"ms windows",
"pe32",
"number",
"pe32 executable",
"ascii text",
"crlf line",
"database",
"installer",
"template",
"trojan"
],
"references": [],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [],
"attack_ids": [
{
"id": "T1055",
"name": "Process Injection",
"display_name": "T1055 - Process Injection"
},
{
"id": "T1060",
"name": "Registry Run Keys / Startup Folder",
"display_name": "T1060 - Registry Run Keys / Startup Folder"
},
{
"id": "T1045",
"name": "Software Packing",
"display_name": "T1045 - Software Packing"
}
],
"industries": [],
"TLP": "green",
"cloned_from": null,
"export_count": 19,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Q.Vashti",
"id": "337942",
"avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"domain": 202,
"hostname": 217,
"FileHash-SHA256": 852,
"FileHash-MD5": 238,
"FileHash-SHA1": 164,
"SSLCertFingerprint": 3,
"URL": 947,
"email": 3
},
"indicator_count": 2626,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 138,
"modified_text": "263 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "6824aa10fa32899c33abc3be",
"name": "tp://adorno.pl and http://vgt.pl INVESTIGATION requstor user Axelo",
"description": "https://t.co/zTZNBTe8GV",
"modified": "2025-06-14T00:00:30.956000",
"created": "2025-05-14T14:34:56.497000",
"tags": [],
"references": [],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [],
"attack_ids": [],
"industries": [],
"TLP": "white",
"cloned_from": null,
"export_count": 13,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "Arek-BTC",
"id": "212764",
"avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"FileHash-MD5": 426,
"FileHash-SHA1": 455,
"FileHash-SHA256": 5596,
"URL": 15206,
"IPv4": 409,
"domain": 2473,
"hostname": 5059,
"CVE": 3
},
"indicator_count": 29627,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 122,
"modified_text": "310 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "6553b88c316cfb531b9c4c10",
"name": "iOS Unlocker| Apple | ATT | Monitoring| http://mobile.suddenlink2go.com",
"description": "spyware, 114.114.114.114, Tulach, C2, apple iOS, passwords, crack, unlock , click, att, hughesnet",
"modified": "2023-12-14T15:03:30.417000",
"created": "2023-11-14T18:12:28.459000",
"tags": [
"united",
"blacklist",
"malicious site",
"mail spammer",
"detection list",
"cisco umbrella",
"site",
"safe site",
"malware",
"phishing site",
"heur",
"malware site",
"alexa top",
"million",
"unsafe",
"artemis",
"riskware",
"conduit",
"agent",
"opencandy",
"xtrat",
"iframe",
"cleaner",
"team",
"installpack",
"xrat",
"tiggre",
"presenoker",
"fusioncore",
"wacatac",
"azorult",
"phishing",
"service",
"runescape",
"facebook",
"bank",
"download",
"crack",
"softcnapp",
"trojanspy",
"maltiverse",
"falcon sandbox",
"pattern match",
"root ca",
"authority",
"class",
"script",
"ascii text",
"mitre att",
"localappdata",
"temp",
"ck id",
"date",
"unknown",
"generator",
"critical",
"error",
"meta",
"hybrid",
"general",
"local",
"click",
"strings",
"expiressun",
"http response",
"final url",
"ip address",
"status code",
"body length",
"kb body",
"sha256",
"headers",
"pt3uc1",
"path",
"movies",
"watch",
"html info",
"meta tags",
"suddenlink tv",
"trackers amazon",
"pt3rc1",
"whois record",
"whois whois",
"ssl certificate",
"historical",
"historical ssl",
"referrer",
"communicating",
"dropped",
"contacted",
"apple ios",
"hacktool",
"metro",
"malicious",
"crypto",
"installer",
"attack",
"awful",
"brian sabey",
"aig",
"civicaIg",
"tracking",
"password crack",
"tulach",
"target tsara brashears",
"tylerknott",
"att",
"monitoring",
"spyware",
"spying",
"cybercrime",
"tulach",
"hughesnet",
"ios",
"toshiba",
"attack",
"malvertizing",
"cyber stalking",
"porn",
"pornhub"
],
"references": [
"http://mobile.suddenlink2go.com/",
"https://hybrid-analysis.com/sample/889790f55a8a29ee75463bbcf014c3ed6cc76e6cd0278e491ec9fa1ed14862c4/655374e9921d5d73860b7db3",
"https://applemusic-spotlight.myunidays.com/US/en-US?",
"https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
"myhughesnet.com",
"dishmail.net",
"home.toshiba.com",
"ytq2rs56.haogfw.com",
"pornhub.com",
"http://trk.brother-root-rich-of.xyz/campaign?id=4f1426e9-22f8-4e7a-9c32-1b2d42867559&var1=&extcid=w9A2DTCOAL56FRAK125KMLAI",
"http://trk.reverseparameter.site/gg/izuyv?to=https://mine-top-gratis-application.pw/e29481e9-a792-46a8-bbf0-188ed2a816ae/f10439e6-e61a-4420-ba88-29e9d1c5d2ea?brand=Lenovo&btd=dHJrLm1vYmlsZXRvcDIwMTh0ZWNoaWUueHl6&exptoken=MTU1NzUxMjgzMjgyMw==&lang=ar&model=K6+Note&td=dHJrLnJldmVyc2VwYXJhbWV0ZXIuc2l0ZS9wcmNlZWQ",
"monitor.cablelan.net",
"https://monitor.rodgersmith.com",
"https://www.everycloudtech.com/free-mail-flow-monitor"
],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [
{
"id": "TrojanSpy",
"display_name": "TrojanSpy",
"target": null
},
{
"id": "Maltiverse",
"display_name": "Maltiverse",
"target": null
}
],
"attack_ids": [
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1059.007",
"name": "JavaScript",
"display_name": "T1059.007 - JavaScript"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1560",
"name": "Archive Collected Data",
"display_name": "T1560 - Archive Collected Data"
},
{
"id": "T1059",
"name": "Command and Scripting Interpreter",
"display_name": "T1059 - Command and Scripting Interpreter"
},
{
"id": "T1100",
"name": "Web Shell",
"display_name": "T1100 - Web Shell"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
}
],
"industries": [],
"TLP": "white",
"cloned_from": null,
"export_count": 28,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "OctoSeek",
"id": "243548",
"avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"FileHash-MD5": 144,
"FileHash-SHA1": 179,
"FileHash-SHA256": 4528,
"CVE": 7,
"domain": 2024,
"hostname": 3556,
"URL": 10455
},
"indicator_count": 20893,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 220,
"modified_text": "857 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
},
{
"id": "65568ab12429c394dc4b91ea",
"name": "iOS Unlocker| Apple | ATT | Monitoring| http://mobile.suddenlink2go",
"description": "",
"modified": "2023-12-14T15:03:30.417000",
"created": "2023-11-16T21:33:37.838000",
"tags": [
"united",
"blacklist",
"malicious site",
"mail spammer",
"detection list",
"cisco umbrella",
"site",
"safe site",
"malware",
"phishing site",
"heur",
"malware site",
"alexa top",
"million",
"unsafe",
"artemis",
"riskware",
"conduit",
"agent",
"opencandy",
"xtrat",
"iframe",
"cleaner",
"team",
"installpack",
"xrat",
"tiggre",
"presenoker",
"fusioncore",
"wacatac",
"azorult",
"phishing",
"service",
"runescape",
"facebook",
"bank",
"download",
"crack",
"softcnapp",
"trojanspy",
"maltiverse",
"falcon sandbox",
"pattern match",
"root ca",
"authority",
"class",
"script",
"ascii text",
"mitre att",
"localappdata",
"temp",
"ck id",
"date",
"unknown",
"generator",
"critical",
"error",
"meta",
"hybrid",
"general",
"local",
"click",
"strings",
"expiressun",
"http response",
"final url",
"ip address",
"status code",
"body length",
"kb body",
"sha256",
"headers",
"pt3uc1",
"path",
"movies",
"watch",
"html info",
"meta tags",
"suddenlink tv",
"trackers amazon",
"pt3rc1",
"whois record",
"whois whois",
"ssl certificate",
"historical",
"historical ssl",
"referrer",
"communicating",
"dropped",
"contacted",
"apple ios",
"hacktool",
"metro",
"malicious",
"crypto",
"installer",
"attack",
"awful",
"brian sabey",
"aig",
"civicaIg",
"tracking",
"password crack",
"tulach",
"target tsara brashears",
"tylerknott",
"att",
"monitoring",
"spyware",
"spying",
"cybercrime",
"tulach",
"hughesnet",
"ios",
"toshiba",
"attack",
"malvertizing",
"cyber stalking",
"porn",
"pornhub"
],
"references": [
"http://mobile.suddenlink2go.com/",
"https://hybrid-analysis.com/sample/889790f55a8a29ee75463bbcf014c3ed6cc76e6cd0278e491ec9fa1ed14862c4/655374e9921d5d73860b7db3",
"https://applemusic-spotlight.myunidays.com/US/en-US?",
"https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
"myhughesnet.com",
"dishmail.net",
"home.toshiba.com",
"ytq2rs56.haogfw.com",
"pornhub.com",
"http://trk.brother-root-rich-of.xyz/campaign?id=4f1426e9-22f8-4e7a-9c32-1b2d42867559&var1=&extcid=w9A2DTCOAL56FRAK125KMLAI",
"http://trk.reverseparameter.site/gg/izuyv?to=https://mine-top-gratis-application.pw/e29481e9-a792-46a8-bbf0-188ed2a816ae/f10439e6-e61a-4420-ba88-29e9d1c5d2ea?brand=Lenovo&btd=dHJrLm1vYmlsZXRvcDIwMTh0ZWNoaWUueHl6&exptoken=MTU1NzUxMjgzMjgyMw==&lang=ar&model=K6+Note&td=dHJrLnJldmVyc2VwYXJhbWV0ZXIuc2l0ZS9wcmNlZWQ",
"monitor.cablelan.net",
"https://monitor.rodgersmith.com",
"https://www.everycloudtech.com/free-mail-flow-monitor"
],
"public": 1,
"adversary": "",
"targeted_countries": [],
"malware_families": [
{
"id": "TrojanSpy",
"display_name": "TrojanSpy",
"target": null
},
{
"id": "Maltiverse",
"display_name": "Maltiverse",
"target": null
}
],
"attack_ids": [
{
"id": "T1027",
"name": "Obfuscated Files or Information",
"display_name": "T1027 - Obfuscated Files or Information"
},
{
"id": "T1071.004",
"name": "DNS",
"display_name": "T1071.004 - DNS"
},
{
"id": "T1105",
"name": "Ingress Tool Transfer",
"display_name": "T1105 - Ingress Tool Transfer"
},
{
"id": "T1059.007",
"name": "JavaScript",
"display_name": "T1059.007 - JavaScript"
},
{
"id": "T1071.001",
"name": "Web Protocols",
"display_name": "T1071.001 - Web Protocols"
},
{
"id": "T1071",
"name": "Application Layer Protocol",
"display_name": "T1071 - Application Layer Protocol"
},
{
"id": "T1560",
"name": "Archive Collected Data",
"display_name": "T1560 - Archive Collected Data"
},
{
"id": "T1059",
"name": "Command and Scripting Interpreter",
"display_name": "T1059 - Command and Scripting Interpreter"
},
{
"id": "T1100",
"name": "Web Shell",
"display_name": "T1100 - Web Shell"
},
{
"id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"display_name": "T1140 - Deobfuscate/Decode Files or Information"
}
],
"industries": [],
"TLP": "white",
"cloned_from": "6553b88c316cfb531b9c4c10",
"export_count": 22,
"upvotes_count": 0,
"downvotes_count": 0,
"votes_count": 0,
"locked": false,
"pulse_source": "web",
"validator_count": 0,
"comment_count": 0,
"follower_count": 0,
"vote": 0,
"author": {
"username": "scoreblue",
"id": "254100",
"avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
"is_subscribed": false,
"is_following": false
},
"indicator_type_counts": {
"FileHash-MD5": 144,
"FileHash-SHA1": 179,
"FileHash-SHA256": 4528,
"CVE": 7,
"domain": 2024,
"hostname": 3556,
"URL": 10455
},
"indicator_count": 20893,
"is_author": false,
"is_subscribing": null,
"subscriber_count": 225,
"modified_text": "857 days ago ",
"is_modified": true,
"groups": [],
"in_group": false,
"threat_hunter_scannable": true,
"threat_hunter_has_agents": 1,
"related_indicator_type": "URL",
"related_indicator_is_active": 1
}
],
"error": null,
"vt": {
"error": "VirusTotal rate limit reached. Try again shortly.",
"indicator": "https://form.istockbd.net",
"type": "URL"
},
"abuseipdb": null,
"urlhaus": {
"indicator": "https://form.istockbd.net",
"type": "URL",
"found": false,
"verdict": "clean",
"error": null
},
"from_cache": true,
"_cached_at": 1776651114.1468542
}