{ "type": "URL", "indicator": "https://git.git.gitlab.thecafebythink.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://git.git.gitlab.thecafebythink.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3755772195, "indicator": "https://git.git.gitlab.thecafebythink.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 17, "pulses": [ { "id": "6570a989843b7acf6d0a79ac", "name": "Qakbot. Again. Today. Pulled from own device. Quasar RAT, Malvertizing", "description": "", "modified": "2023-12-06T17:04:09.133000", "created": "2023-12-06T17:04:09.133000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "domain": 290, "FileHash-SHA256": 1478, "hostname": 1047, "URL": 4055, "FileHash-MD5": 89, "FileHash-SHA1": 85, "email": 1, "FilePath": 2, "Mutex": 1, "CIDR": 1 }, "indicator_count": 7051, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a7fc464f9f56ac33a389", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-12-06T16:57:32.030000", "created": "2023-12-06T16:57:32.030000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "domain": 3202, "CVE": 5, "FileHash-SHA256": 1943, "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 114, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a7e7daf278491d9f9eb4", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-12-06T16:57:11.228000", "created": "2023-12-06T16:57:11.228000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "domain": 3202, "CVE": 5, "FileHash-SHA256": 1943, "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a567a62bb520508659a4", "name": "HoneyPot", "description": "", "modified": "2023-12-06T16:46:31.096000", "created": "2023-12-06T16:46:31.096000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1753, "hostname": 1193, "URL": 4223, "domain": 591, "FileHash-SHA1": 81, "FileHash-MD5": 81 }, "indicator_count": 7922, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65331eeded285a25c31d63a4", "name": "Tracking and Botnet campaign", "description": "US attackers making an exit by dumping to my devices & spreading to various other unsuspecting?\nRevenge for researching? Dumping to make it hard to implicate a single source. \nDump of Tsara Brashears and other adult content , malvertizing by a cyber stalker campaigners. As reported previously, entered my device and took control. Evidence pulled from a device while attack in progress. Device read Michigan, shopping, advertising, news, etc. Location not associated with any failed privacy controls on devices listing other locations.\nI listed a few IOC's Dumped to device in references. \nDump was continuous. Device modification for storage, new systems interface created upon device update. Moderete byte load per minute. Example 227 KB per minute. Prism command line tool\nChina foolish enough to implicate themselves for unclear crimes against American citizens? If an alleged crime against a target was allegedly committed in US someone is silencing her big time. There are a few other names as well. Targets?", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T00:44:29.344000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 46, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653323d24f9946946c804be4", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "Sounds crazy made up. This is an expensive campaign. Talented, lost individuals.\nI'm naming this campaign.\n'Canto XXVI' Bolgia 8 \u2013 Counsellors of Fraud\nThat's where they'll return.", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T01:05:22.903000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653323de61317f6ca7a3e875", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "Sounds crazy made up. This is an expensive campaign. Talented, lost individuals.\nI'm naming this campaign.\n'Canto XXVI' Bolgia 8 \u2013 Counsellors of Fraud\nThat's where they'll return.", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T01:05:34.166000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6533b20cf4ad384a0193c655", "name": "114.114.114.114 Tracking | Botnet | Malvertizing ", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T11:12:12.005000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323d24f9946946c804be4", "export_count": 53, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1ffb074d89724cb81371", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:16:11.181000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323de61317f6ca7a3e875", "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f200c20e12f03f749c403", "name": "114.114.114.114 Tracking | Botnet | Malvertizing", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:16:28.252000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "6533b20cf4ad384a0193c655", "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f205bac4b92f025125962", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:17:47.051000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323d24f9946946c804be4", "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65580ba704bae549b90948b5", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-11-18T00:56:07.651000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653f1ffb074d89724cb81371", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "652cc4de6aa3848c3722e9a6", "name": "Qakbot. Again. Today. Pulled from own device. Quasar RAT, Malvertizing", "description": "Serious concerns. Approached, threatened & told no cyber tool or literature would help me by a stranger in public place seconds after a male demanded to know if I had a SQL book or knowledge, asked for phone #, a date , to buy only 2 books and come with him? WHAT? He really wanted my number not me. he got so close to, I thought he had a wearable hacktool device. Ongoing. I realized dumping when I typed, the letter T only for another search term, results = Tsara Brashears dead? Clean search browser history. No Auto DL file titled: government Qbot Qakbot?! I couldn't open it. Last night I got a free unauthorized penetration test, apps, awful attack. Adult content dumping from listed in references. . I don't attack is China based despite server locations.. It's too easy to appear to be attacking from another country. Can't make it up. Ongoing long. Major disruption. Issue predates research.", "modified": "2023-11-15T01:03:46.666000", "created": "2023-10-16T05:06:38.412000", "tags": [ "whois record", "tsara brashears", "contacted", "threat roundup", "whois whois", "remcos", "iocs", "cyberstalking", "cry kill", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "malware", "awful", "open", "korplug", "execution", "pe resource", "referrer", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "quasar", "ursnif", "name verdict", "falcon sandbox", "sha256", "size", "sha1", "show process", "runtime process", "unicode", "crlf line", "ascii text", "mitre att", "type data", "hybrid", "general", "local", "path", "click", "strings", "nanjing xinfeng", "xiongmao group", "road descr", "district", "nanjing", "jiangsu", "china country", "apnic irt", "beijing", "china email", "copy md5", "copy sha1", "copy sha256", "AMERICA", "threat", "cyber criminal", "teams", "bounce", "Please Stop \u2205", "eminent threat", "Apple", "Android", "adversarial", "injection", "Tulach.cc malware", "scanning_host", "exploit_source", "ransomware" ], "references": [ "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e", "114.114.114.114", "http://login.live.com/oauth20_remoteconnect.srf", "a-poster.info", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.sweetheartvideo.com/tsara-brashears/", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian" ], "public": 1, "adversary": "[Unnamed Teams Hacking Group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Wanna Cry Kill Switch", "display_name": "Wanna Cry Kill Switch", "target": null }, { "id": "RansomEXX (Windows)", "display_name": "RansomEXX (Windows)", "target": null }, { "id": "Nanocore RAT", "display_name": "Nanocore RAT", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Dark Power", "display_name": "Dark Power", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4055, "FileHash-MD5": 89, "FileHash-SHA1": 85, "FileHash-SHA256": 1478, "domain": 290, "hostname": 1047, "FilePath": 2, "Mutex": 1, "CVE": 2, "CIDR": 1, "email": 1 }, "indicator_count": 7051, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "886 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1df9a7da086561b9897f", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-11-05T14:05:48.545000", "created": "2023-10-30T03:07:37.963000", "tags": [ "ssl certificate", "whois whois", "iocs", "milum botnet", "army", "isp stuff", "whois record", "travel stuff", "misp", "threat roundup", "july", "apple", "password", "apple ios", "whois", "emotet", "powershell", "hacktool", "crypto", "pornhub", "tulach", "tsara", "camera", "connect", "tsara brashears", "brashears", "scanning_host", "trojan", "phishing", "afro", "june", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "http traffic", "suricata alerts", "event category", "description sid", "websma", "webabo", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware", "alexa", "heur", "malicious site", "malicious url", "unsafe", "agent", "phishing", "riskware", "bank", "iframe", "downldr", "presenoker", "artemis", "genkryptik", "fuery", "wacatac", "azorult", "service", "runescape", "facebook", "download", "union", "team", "opencandy", "exploit", "mimikatz", "blacklist https", "a1mara" ], "references": [ "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "Research and Data Analysis", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8" ], "public": 1, "adversary": "Tulach", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1070.003", "name": "Clear Command History", "display_name": "T1070.003 - Clear Command History" } ], "industries": [], "TLP": "white", "cloned_from": "65204565ac1e8bce4de26df3", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56, "FileHash-SHA256": 1943, "domain": 3202, "hostname": 3487, "CVE": 5 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "896 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65204565ac1e8bce4de26df3", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears", "modified": "2023-11-05T14:05:48.545000", "created": "2023-10-06T17:35:33.618000", "tags": [ "ssl certificate", "whois whois", "iocs", "milum botnet", "army", "isp stuff", "whois record", "travel stuff", "misp", "threat roundup", "july", "apple", "password", "apple ios", "whois", "emotet", "powershell", "hacktool", "crypto", "pornhub", "tulach", "tsara", "camera", "connect", "tsara brashears", "brashears", "scanning_host", "trojan", "phishing", "afro", "june", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "http traffic", "suricata alerts", "event category", "description sid", "websma", "webabo", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware", "alexa", "heur", "malicious site", "malicious url", "unsafe", "agent", "phishing", "riskware", "bank", "iframe", "downldr", "presenoker", "artemis", "genkryptik", "fuery", "wacatac", "azorult", "service", "runescape", "facebook", "download", "union", "team", "opencandy", "exploit", "mimikatz", "blacklist https", "a1mara" ], "references": [ "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "Research and Data Analysis", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8" ], "public": 1, "adversary": "Tulach", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1070.003", "name": "Clear Command History", "display_name": "T1070.003 - Clear Command History" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56, "FileHash-SHA256": 1943, "domain": 3202, "hostname": 3487, "CVE": 5 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "896 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "652044fb2f28d46e91d29160", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears", "modified": "2023-11-05T14:05:48.545000", "created": "2023-10-06T17:33:47.403000", "tags": [ "ssl certificate", "whois whois", "iocs", "milum botnet", "army", "isp stuff", "whois record", "travel stuff", "misp", "threat roundup", "july", "apple", "password", "apple ios", "whois", "emotet", "powershell", "hacktool", "crypto", "pornhub", "tulach", "tsara", "camera", "connect", "tsara brashears", "brashears", "scanning_host", "trojan", "phishing", "afro", "june", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "http traffic", "suricata alerts", "event category", "description sid", "websma", "webabo", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware", "alexa", "heur", "malicious site", "malicious url", "unsafe", "agent", "phishing", "riskware", "bank", "iframe", "downldr", "presenoker", "artemis", "genkryptik", "fuery", "wacatac", "azorult", "service", "runescape", "facebook", "download", "union", "team", "opencandy", "exploit", "mimikatz", "blacklist https", "a1mara" ], "references": [ "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "Research and Data Analysis", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8" ], "public": 1, "adversary": "Tulach", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1070.003", "name": "Clear Command History", "display_name": "T1070.003 - Clear Command History" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56, "FileHash-SHA256": 1943, "domain": 3202, "hostname": 3487, "CVE": 5 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "896 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6508d5cb5a5d82e58b5aafec", "name": "HoneyPot", "description": "http://cloudbazaar.org\nHome of Malware Bazaar? VoiceBazaar?\nFound in: public domain registry.com\nI won't post all vulnerabilities. Hyper malicious.", "modified": "2023-10-18T20:01:29.292000", "created": "2023-09-18T22:57:15.765000", "tags": [ "ssl certificate", "referrer", "communicating", "threat roundup", "contacted", "historical ssl", "execution", "emotet", "trickbot", "honeypot", "telecommunications", "social engineering", "spear fishing", "Command and cintrol", "phishing", "trojan", "whois", "scanning host", "smishing", "MalwareBazzar" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Emotet - S0367", "display_name": "Emotet - S0367", "target": null }, { "id": "TrickBot", "display_name": "TrickBot", "target": null }, { "id": "Malware.", "display_name": "Malware.", "target": null }, { "id": "Trojan.Python", "display_name": "Trojan.Python", "target": null }, { "id": "Agent Tesla - S0331", "display_name": "Agent Tesla - S0331", "target": null }, { "id": "MalwareBazzar", "display_name": "MalwareBazzar", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1070.003", "name": "Clear Command History", "display_name": "T1070.003 - Clear Command History" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1017", "name": "Application Deployment Software", "display_name": "T1017 - Application Deployment Software" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1074.002", "name": "Remote Data Staging", "display_name": "T1074.002 - Remote Data Staging" } ], "industries": [ "Technology", "Media Sharing", "Financial Services Data", "Contaent Delivery" ], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4223, "FileHash-MD5": 81, "FileHash-SHA1": 81, "FileHash-SHA256": 1753, "domain": 591, "hostname": 1193 }, "indicator_count": 7922, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "914 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8", "a-poster.info [tagging tool]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "Research and Data Analysis", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "www.sweetheartvideo.com Tracking and Botnet campaign", "http://login.live.com/oauth20_remoteconnect.srf", "newrelic.se New Update Apple iPhone 199.59.243.222", "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "20.99.186.246 exploit_source", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "114.114.114.114", "110.249.196.101. malware_hosting", "64.190.63.136 Malicious. IP: Sedo GmbH", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "tv.apple.com Apple hacking", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "https://www.sweetheartvideo.com/tsara-brashears/", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "1.62.64.108 malware_hosting", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://tulach.cc/ phishing | Proxy | Skynet", "www.anyxxxtube.net prism.exe", "http://karnalketo.com/sound-found error code 432 server nginx", "itunes.apple.com. [https:///app/apple-store", "114.114.1114.114", "vmwarevmc.com", "wallpapers-nature.com", "a-poster.info", "nr-data.net Private Apple data collection", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "www.sweetheartvideo.com", "CVE-2022-26134", "https://gpt.ocloo.cn/auth", "199.249.230.74 traffic group 78", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "https://twitter.com/ catapult spider/spider", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Tulach", "[Unnamed Teams Hacking Group]", "[Unnamed US Teams and Hacker group]" ], "malware_families": [ "Qakbot - s0650", "Ransomexx", "Ransomexx (windows)", "Skynet", "Azorult - s0344", "Quasar rat", "Trickbot", "Dark power", "Ursnif - s0386", "Bitcoinaussie", "Trojan.python", "Colibri loader", "Daxin", "Virus:wm/look", "Cobalt strike", "Emotet", "Malware.", "Remcos", "Tulach", "Korplug", "Nokoyawa", "Malwarebazzar", "Colbalt strike", "Wanna cry kill switch", "Formbook", "Nanocore rat", "Chaos", "Njrat - s0385", "Emotet - s0367", "Ketogenic switch", "Virus:dos/nanjing", "Agent tesla - s0331", "Ransomware" ], "industries": [ "Media sharing", "Contaent delivery", "Financial services data", "Technology" ], "unique_indicators": 43457 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/thecafebythink.com", "whois": "http://whois.domaintools.com/thecafebythink.com", "domain": "thecafebythink.com", "hostname": "git.git.gitlab.thecafebythink.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 17, "pulses": [ { "id": "6570a989843b7acf6d0a79ac", "name": "Qakbot. Again. Today. Pulled from own device. Quasar RAT, Malvertizing", "description": "", "modified": "2023-12-06T17:04:09.133000", "created": "2023-12-06T17:04:09.133000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "domain": 290, "FileHash-SHA256": 1478, "hostname": 1047, "URL": 4055, "FileHash-MD5": 89, "FileHash-SHA1": 85, "email": 1, "FilePath": 2, "Mutex": 1, "CIDR": 1 }, "indicator_count": 7051, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a7fc464f9f56ac33a389", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-12-06T16:57:32.030000", "created": "2023-12-06T16:57:32.030000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "domain": 3202, "CVE": 5, "FileHash-SHA256": 1943, "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 114, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a7e7daf278491d9f9eb4", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-12-06T16:57:11.228000", "created": "2023-12-06T16:57:11.228000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "domain": 3202, "CVE": 5, "FileHash-SHA256": 1943, "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a567a62bb520508659a4", "name": "HoneyPot", "description": "", "modified": "2023-12-06T16:46:31.096000", "created": "2023-12-06T16:46:31.096000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1753, "hostname": 1193, "URL": 4223, "domain": 591, "FileHash-SHA1": 81, "FileHash-MD5": 81 }, "indicator_count": 7922, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65331eeded285a25c31d63a4", "name": "Tracking and Botnet campaign", "description": "US attackers making an exit by dumping to my devices & spreading to various other unsuspecting?\nRevenge for researching? Dumping to make it hard to implicate a single source. \nDump of Tsara Brashears and other adult content , malvertizing by a cyber stalker campaigners. As reported previously, entered my device and took control. Evidence pulled from a device while attack in progress. Device read Michigan, shopping, advertising, news, etc. Location not associated with any failed privacy controls on devices listing other locations.\nI listed a few IOC's Dumped to device in references. \nDump was continuous. Device modification for storage, new systems interface created upon device update. Moderete byte load per minute. Example 227 KB per minute. Prism command line tool\nChina foolish enough to implicate themselves for unclear crimes against American citizens? If an alleged crime against a target was allegedly committed in US someone is silencing her big time. There are a few other names as well. Targets?", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T00:44:29.344000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 46, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653323d24f9946946c804be4", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "Sounds crazy made up. This is an expensive campaign. Talented, lost individuals.\nI'm naming this campaign.\n'Canto XXVI' Bolgia 8 \u2013 Counsellors of Fraud\nThat's where they'll return.", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T01:05:22.903000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653323de61317f6ca7a3e875", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "Sounds crazy made up. This is an expensive campaign. Talented, lost individuals.\nI'm naming this campaign.\n'Canto XXVI' Bolgia 8 \u2013 Counsellors of Fraud\nThat's where they'll return.", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T01:05:34.166000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6533b20cf4ad384a0193c655", "name": "114.114.114.114 Tracking | Botnet | Malvertizing ", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T11:12:12.005000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323d24f9946946c804be4", "export_count": 53, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1ffb074d89724cb81371", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:16:11.181000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323de61317f6ca7a3e875", "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f200c20e12f03f749c403", "name": "114.114.114.114 Tracking | Botnet | Malvertizing", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:16:28.252000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "6533b20cf4ad384a0193c655", "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://git.git.gitlab.thecafebythink.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://git.git.gitlab.thecafebythink.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776638230.5099447 }