{ "type": "URL", "indicator": "https://gy.aogg.top", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://gy.aogg.top", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3775549953, "indicator": "https://gy.aogg.top", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 33, "pulses": [ { "id": "692d02f096f3ec8b5b507496", "name": "Google Drive: Share Files Online with Secure Cloud Storage | Google Workspace", "description": "nJRAT | Corrupted Google Drive sent to targets former device. Years long social engineering may have been involved. All\nIoC\u2019s Appears to involve years of social engineering. Google\ndrive service in question is a storage service based in Vietnam. | \n\nBotnet / Check-ins / Spyware / Cams. [Anon Sec Botnet subdomain name pulsed. Close directly related to zalo.me\nand tbtteams.com]\nRequires further research.\n\nThis pulse is a bit confusing due where and who it originated from.", "modified": "2025-12-31T02:01:50.101000", "created": "2025-12-01T02:52:32.483000", "tags": [ "business", "enterprise", "drive", "english", "google drive", "try drive", "business small", "workspace", "sign", "strong", "find", "life", "tools", "protect", "cloud", "simple", "android", "indonesia", "video", "mb download", "shared may", "shared", "learn", "drive drive", "name date", "javascript", "dynamicloader", "medium", "minimal headers", "high", "observed get", "get http", "united", "yara rule", "http", "write", "guard", "malware", "read c", "ms windows", "intel", "png image", "rgba", "pe32", "get na", "explorer", "music", "virlock", "media", "ho chi", "minh city", "viet nam", "storage company", "limited", "google", "address as", "luutruso", "cloudflar", "domain", "asn15169", "asn56153", "asn13335", "cisco", "umbrella rank", "apex domain", "url https", "kb stylesheet", "kb font", "kb image", "image", "kb script", "november", "resource path", "size", "type mimetype", "primary request", "redirect chain", "kb document", "urls", "ck id", "name tactics", "suspicious", "informative", "adversaries", "command", "defense evasion", "spawns", "t1590 gather", "windir", "openurl c", "prefetch2", "tor analysis", "dns requests", "domain address", "rsdsq jfu", "ollydbg ollydbg", "wireshark", "external", "binary file", "mitre att", "ck matrix", "aaaa", "cong ty", "co phan", "code", "province hcm", "files", "ip address", "request", "flag", "country", "contacted hosts", "process details", "link initial", "t1480 execution", "domains", "moved", "gmt content", "all ipv4", "url analysis", "location viet", "title", "error", "problem", "url add", "related nids", "files location", "flag united", "development att", "name server", "markmonitor", "localappdata", "programfiles", "edge", "hyundai", "social engineering", ".mil", "hackers", "phishing eml", "summary", "cisco umbrella", "google safe", "browsing", "current dns", "a record", "ip information", "ipasns ip", "detail domain", "domain tree", "links apex", "transfer", "b script", "b stylesheet", "frame b830", "b document", "value", "december", "degurafregistry", "gat object", "jsl object", "gapijstiming", "iframe function", "domainpath name", "nid value", "source level", "files domain", "files related", "tags", "related tags", "virustotal", "foundry", "pulse otx", "dark", "vietnam", "present aug", "present nov", "present jul", "present sep", "unknown aaaa", "search", "name servers", "present oct", "trojan", "data upload", "extraction", "se https", "include review", "exclude sugges", "find s", "failed", "typ don", "faith", "study", "romeo\u2019s", "juliettes", "femme fatales", "strategy", "honey pot", "honey traps", "spy", "helix", "anons", "passive dns", "pulse pulses", "files ip", "address", "location united", "asn as400519", "whois registrar", "ms defender", "files matching", "number", "sample analysis", "hide samples", "date hash", "cameras", "cams", "spycam", "botnet", "vietnam", "company limited", "dnssec", "status", "india unknown", "present may", "espionage", "hostname add", "generic", "cnc activity", "backdoor", "ipv4", "anonsecbotnet", "iptv" ], "references": [ "drive.google.com/", "https://foundry2-lbl.dvr.dn2.n-helix.com/", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7aa2b182b17cfb5efb3367e0bc7b36e7088ab43a8fb21a772a0f8f90b7329d9", "zalo.me | href | Binary File | ATT&CK ID T1566.002", "https://account.helix.com/activate/start", "anonsecbotnet.cameraddns.net \u2022 cameraddns.net \u2022 http://iptv.cameraddns.net/cotich/ \u2022 http://iptv.cameraddns.net/cotichC \u2022", "https://iptv.cameraddns.net/kodi/zips/plugin.video.iptvjson]", "Terse Unencrypted Request for Google - Likely Connectivity Check", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7aa2b182b17cfb5efb3367e0bc7b36e7088ab43a8fb21a772a0f8f90b7329d9", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/d334c3220573f98da1a0eef13be9c8b0053447519b3a6ace3728bcffa10b99b6", "cpcalendars.hyundaibariavungtau3s.com \u2022 cpcontacts.hyundaibariavungtau3s.com", "https://hyundaibariavungtau3s.com/vehicle/stargazer", "https://hyundaibariavungtau3s.com/vehicle/ioniq-5", "https://hyundaibariavungtau3s.com/vehicle/new-hyundai-venue", "https://hyundaibariavungtau3s.com/vehicle/new-hyundai-palisade", "https://hyundaibariavungtau3s.com/vehicle/hyundai-custin", "https://hyundaibariavungtau3s.com/wp-content/themes/flatsome/inc/extensions/flatsome-live-search/", "https://delivery-mp-microsoft.dvrx.dn3.n-helix.com \u2022 https://dnsplay.dn2.n-helix.com", "https://dnss2.dn2.n-helix.com \u2022 https://dnssounib.dn2.n-helix.com/", "https://foundry2-lbl.dvr.dn2.n-helix.com/ \u2022 https://node8-serve.dvrx.dn3.n-helix.com \u2022 https://sfbambi-tel.dn2.n-helix.com \u2022 https://softlayer3.dn2.n-helix.com", "http://bjdclub.ru/out.phtml?www.skyxxxgals.info/feet-licking-porn/", "http://www.yayabay.com/forum/adclick.php?url=http%3a%2f%2fhkprice.info%2fpornstars%2f22466", "https://asianleak.com/videos/8120/sg-cousin-showering-spy-cam", "feedback-pa.clients6.google.com/v1/survey/trigger/", "https://feedback-pa.clients6.google.com/v1/survey/trigger/trigger_anonymous?key=AIzaSyD3LJeW4Q6gtdgJlyeFZUp-GhpIoc6EUeg", "anonsecbotnet.cameraddns.net \u2022 http://anonsecbotnet.cameraddns.net \u2022 https://anonsecbotnet.cameraddns.net" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Virus.Virlock-6804475-0", "display_name": "Win.Virus.Virlock-6804475-0", "target": null }, { "id": "Win.Malware.Bzub-6727003-0", "display_name": "Win.Malware.Bzub-6727003-0", "target": null }, { "id": "Win.Trojan.Generic-9801687-0", "display_name": "Win.Trojan.Generic-9801687-0", "target": null }, { "id": "NID", "display_name": "NID", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null }, { "id": "Trojan:Win32/Floxif.E", "display_name": "Trojan:Win32/Floxif.E", "target": "/malware/Trojan:Win32/Floxif.E" }, { "id": "Win.Dropper.njRAT-10015886-0", "display_name": "Win.Dropper.njRAT-10015886-0", "target": null }, { "id": "Win.Packed.Generic-9795615-0", "display_name": "Win.Packed.Generic-9795615-0", "target": null }, { "id": "Backdoor:MSIL/Bladabindi.AJ GC!", "display_name": "Backdoor:MSIL/Bladabindi.AJ GC!", "target": "/malware/Backdoor:MSIL/Bladabindi.AJ GC!" }, { "id": "Win.Packed.Generic-9795615-0\t.", "display_name": "Win.Packed.Generic-9795615-0\t.", "target": null }, { "id": "Backdoor:MSIL/Bladabindi.AJ", "display_name": "Backdoor:MSIL/Bladabindi.AJ", "target": "/malware/Backdoor:MSIL/Bladabindi.AJ" }, { "id": "Win.Packed.Fecn-7077459-0", "display_name": "Win.Packed.Fecn-7077459-0", "target": null }, { "id": "Trojan:MSIL/Ranos.A", "display_name": "Trojan:MSIL/Ranos.A", "target": "/malware/Trojan:MSIL/Ranos.A" }, { "id": "Win.Trojan.Generic-6417450-0", "display_name": "Win.Trojan.Generic-6417450-0", "target": null }, { "id": "ALF:Backdoor:MSIL/Noancooe.KA", "display_name": "ALF:Backdoor:MSIL/Noancooe.KA", "target": null }, { "id": "Win.Packed.Msilperseus-9956592-0", "display_name": "Win.Packed.Msilperseus-9956592-0", "target": null }, { "id": "Trojan:MSIL/ClipBanker", "display_name": "Trojan:MSIL/ClipBanker", "target": "/malware/Trojan:MSIL/ClipBanker" } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1194", "name": "Spearphishing via Service", "display_name": "T1194 - Spearphishing via Service" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1039", "name": "Data from Network Shared Drive", "display_name": "T1039 - Data from Network Shared Drive" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "display_name": "T1036.004 - Masquerade Task or Service" }, { "id": "T1444", "name": "Masquerade as Legitimate Application", "display_name": "T1444 - Masquerade as Legitimate Application" }, { "id": "T1567.002", "name": "Exfiltration to Cloud Storage", "display_name": "T1567.002 - Exfiltration to Cloud Storage" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1911, "hostname": 714, "FileHash-SHA256": 1304, "FileHash-MD5": 159, "FileHash-SHA1": 71, "SSLCertFingerprint": 2, "domain": 421, "CVE": 1, "email": 4 }, "indicator_count": 4587, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "109 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67fe9f3c682800301b89c556", "name": "Sitemap This page shows the most recent scans (manual, API, automatic) to be picked up by spiders.", "description": "https://urlscan.io/sitemap/", "modified": "2025-09-01T08:05:18.611000", "created": "2025-04-15T18:02:36.693000", "tags": [ "new run", "key pointing", "run key", "roth", "nextron", "markus neis", "sander wiebing", "public", "imagestartswith", "delnoderundll32", "vhash", "imphash", "rich pe", "ssdeep", "data sheetfinal", "wbn1", "mobil ip", "hsotu tin", "firmar", "statement", "ebook", "uwaaj moesz" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 168, "FileHash-MD5": 106, "FileHash-SHA1": 101, "FileHash-SHA256": 415, "hostname": 63, "domain": 61, "CVE": 1 }, "indicator_count": 915, "is_author": false, "is_subscribing": null, "subscriber_count": 122, "modified_text": "230 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68629f622fe936e3141a1ed0", "name": "APT33 (by ilyailya)", "description": "", "modified": "2025-06-30T14:29:54.892000", "created": "2025-06-30T14:29:54.892000", "tags": [ "apfs encryption", "adguard extra", "jumpcloud go", "chrome web", "store", "privacy badger", "safety checker", "stay", "mywot", "flowcrypt", "encrypt gmail", "simple", "facebook", "apollo", "future", "assistant", "excbreakpoint", "sigtrap", "excguard", "renderer", "vallumes", "excbadaccess", "sigsegv", "helper", "chrome helper", "exccrash", "rave scout", "cookies", "public folder", "browsersignin", "denyactivation", "disableoverride", "loginwindowtext", "jumpcloud", "disableairdrop", "enablefirewall", "macos14action", "macos13action", "showfullname", "arm64e", "apple m2", "mac142", "kjqqtw7pqt", "yubico", "daemon", "service", "server", "open directory", "account", "kerberos admin", "kerberos change", "io daemon", "device daemon", "network", "bridge", "desktop", "installer", "calendar", "screensaver", "agent", "adaptive", "interactive", "background", "standard", "launchd sandbox", "s mdworker", "command line", "cloud", "remote assist", "aesxtsarm", "aesecbarm", "darwin kernel", "version", "fri apr", "sha512vngarmhw", "sha384vngarmhw", "sha256vngarm", "sha1vngarm", "user", "coregraphics", "quartzcore", "dock", "corefoundation", "cgimage", "cgcolorspace", "load address", "identifier", "build info", "code type" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6816697e166bba8972d8d4a3", "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 125, "hostname": 402, "FileHash-SHA256": 38, "URL": 582, "CVE": 1 }, "indicator_count": 1148, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "293 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6816697e166bba8972d8d4a3", "name": "APT33", "description": "APT33", "modified": "2025-06-02T18:02:26.651000", "created": "2025-05-03T19:07:42.325000", "tags": [ "apfs encryption", "adguard extra", "jumpcloud go", "chrome web", "store", "privacy badger", "safety checker", "stay", "mywot", "flowcrypt", "encrypt gmail", "simple", "facebook", "apollo", "future", "assistant", "excbreakpoint", "sigtrap", "excguard", "renderer", "vallumes", "excbadaccess", "sigsegv", "helper", "chrome helper", "exccrash", "rave scout", "cookies", "public folder", "browsersignin", "denyactivation", "disableoverride", "loginwindowtext", "jumpcloud", "disableairdrop", "enablefirewall", "macos14action", "macos13action", "showfullname", "arm64e", "apple m2", "mac142", "kjqqtw7pqt", "yubico", "daemon", "service", "server", "open directory", "account", "kerberos admin", "kerberos change", "io daemon", "device daemon", "network", "bridge", "desktop", "installer", "calendar", "screensaver", "agent", "adaptive", "interactive", "background", "standard", "launchd sandbox", "s mdworker", "command line", "cloud", "remote assist", "aesxtsarm", "aesecbarm", "darwin kernel", "version", "fri apr", "sha512vngarmhw", "sha384vngarmhw", "sha256vngarm", "sha1vngarm", "user", "coregraphics", "quartzcore", "dock", "corefoundation", "cgimage", "cgcolorspace", "load address", "identifier", "build info", "code type" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 125, "hostname": 402, "FileHash-SHA256": 38, "URL": 582, "CVE": 1 }, "indicator_count": 1148, "is_author": false, "is_subscribing": null, "subscriber_count": 31, "modified_text": "320 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67f5555b6ce863d998e83e26", "name": "macOS Threat Infrastructure Leveraging Remote Agents via remotewd.com and rtmsprod.net", "description": "This pulse identifies an actively observed macOS-focused remote access infrastructure abusing trusted native Apple agents (ARDAgent.app, SSMenuAgent.app) and communicating with a distributed network of C2-like endpoints under domains such as remotewd.com, idsremoteurlconnectionagent.app, and rtmsprod.net.\n\nThe infrastructure is composed of dynamically generated subdomains \u2014 many in the form of device-.remotewd.com \u2014 indicative of automated deployment, system tracking, or per-host remote access configurations.\n\nAdditional indicators include HTTP/S URLs pointing directly to embedded binary paths within macOS agents, suggesting possible delivery vectors, staging, or persistence techniques.\n\nThis campaign shows signs of structured, programmatic targeting and is highly likely to be pre-operational infrastructure for wide-scale surveillance or access operations. All listed indicators should be considered high-risk. If observed in your environment, initiate a full forensic and IR process immediately.", "modified": "2025-05-11T19:03:59.885000", "created": "2025-04-08T16:56:59.641000", "tags": [ "generated from", "do not", "edit uri", "urls", "edit", "rewriteengine", "rewritecond", "rewriterule", "r301", "xml2encalias", "beralloct", "berbvarrayadd", "berbvarrayfree", "berbvdup", "berbvecadd", "berbvecfree", "berbvfree", "berdump", "berdup", "berdupbv", "laerrordomain", "laerrornoncekey", "lamechanismtree", "lacontext", "ladomainstate", "laenvironment", "lanotification", "laprivatekey", "lapublickey", "laright", "apple swift", "o librarylevel", "combine import", "foundation", "swift import", "mcpeerid", "mcsession", "property", "copyright", "protocol", "class", "bonjour", "ascii lowercase", "abc company", "section", "bonjour txt", "note", "ui element", "utf8 encoding", "nscopying", "nsdictionary", "nsstring", "mcextern", "attribute", "mcextern extern", "mcexternweak", "nsenum", "nsinteger", "mcerrorcode", "mcerrorunknown", "mcerrortimedout", "peer", "example", "bonjour apis", "stop", "tags", "session", "nsprogress", "nserror", "nsurl", "nsarray", "create", "nsuinteger", "notifies", "mcsession api", "interface", "dbictrace", "dbivporth", "dbictracelevel", "dbdtffoo", "dbihseterrchar", "dbicstate", "dbictraceflags", "provides macros", "dbi release", "only", "sqlsuccess", "odbc", "sqlok", "tim bunce", "england", "sql cli", "sql datatype", "sqlguid", "sqlwlongvarchar", "main", "beware", "sv sth", "sv dbh", "impsth", "impdbh", "sv keysv", "sv params", "sv attr", "sv attribs", "sv drh", "void", "fri jul", "mixed", "dbixsrevision", "plsvundef", "license", "spagain", "perlioprintf", "dbiclogpio", "putback", "ireland", "gnu general", "super", "magic", "dbicflags", "dbis", "svrv", "null", "imp2com", "dbicactivekids", "dbicfiadestroy", "sv h", "dbicdbistate", "code", "copy", "refer", "trace", "error", "unknown", "hookopcheckh", "startexternc", "hookopcheckcb", "userdata", "endexternc", "isinternalbuild", "kickmcxdforuid", "loadappkit", "ardconfig", "authenticator", "dsauthenticator", "dsnode", "dsrecord", "group", "hostconfig", "apfsvolumelock", "apfsvolumerole", "aoskgetosinfo", "aoskgetuserinfo", "aosaddappleid", "aosdisablepcs", "aosenablepcs", "aoslog", "aoslogforce", "aosrelaycookie", "didfailcallback", "kaosaccountkey", "kapcsbundle", "kapcspath", "kjsonextension", "apcsbucketid", "apcsreports", "apconfiguration", "apversiondata", "apversionhelper", "systemvolumesvm", "name size", "identifier", "gb disk0s3", "devdisk3", "apfs container", "scheme", "physical store", "macintosh hd", "apfs snapshot", "preboot", "refs address", "size wired", "name", "version", "uuid", "linked against", "renderer", "helper", "chrome helper", "contains", "cloud ui", "macintosh", "khtml", "gecko", "ui helper", "plugin", "service", "good", "battery power", "apfs encryption", "jumpcloud go", "chrome web", "store", "privacy badger", "flowcrypt", "encrypt gmail", "simple", "google", "b2b phone", "number", "apollo", "future", "exccrash", "sigkill", "code signature", "invalid", "sigabrt", "protonvpn", "excguard", "excbreakpoint", "sigtrap", "excbadaccess", "appl", "english", "adobe crash", "adobe", "acrobat dcadobe", "processor", "uninstaller", "assistant", "install", "cloud", "dock", "calendar", "music", "terminal", "tips", "installer", "updater", "proton", "tools", "stub", "python", "clock", "powershell", "team", "rave scout", "cookies", "public folder", "key cert", "sign", "crl sign", "root ca", "authority", "public primary", "global root", "verisign", "academic", "premium", "adaptive", "interactive", "background", "standard", "launchd sandbox", "s mdworker", "agent", "command line", "progress", "yubico", "macos13action", "disableoverride", "disableairdrop", "denyactivation", "enable", "loginwindowtext", "jumpcloud", "autoupdate", "loggingoption", "enablefirewall", "arm64e", "apple m2", "mac142", "kjqqtw7pqt", "daemon", "server", "open directory", "user", "account", "kerberos admin", "kerberos change", "device daemon", "network", "desktop", "screensaver", "bridge", "aesxtsarm", "aesecbarm", "sha512vngarmhw", "sha384vngarmhw", "sha256vngarm", "sha1vngarm", "darwin kernel", "wed mar", "wkarraycreate", "wkbooleancreate", "wkcontextcreate", "wkdatacreate", "wkdatagettypeid", "wkdoublecreate", "wkframecopyurl", "wkgettypeid", "wkimagecreate", "wkpagecandelete", "webview", "notice", "this software", "including", "but not", "limited to", "redistribution", "is provided", "by apple", "direct", "damage", "apiavailable", "webkit", "nsswiftname", "document", "a block", "as is", "hasinclude", "wkdownload", "abstract", "wkerrorcode", "wkerrorunknown", "discussion", "bool", "whether", "wkcontentworld", "wkwebview", "javascript", "nsunavailable", "vaargs", "nsswiftasync", "wkswiftasync", "wkcookiepolicy", "wkswiftuiactor", "nshttpcookie", "targetosiphone", "wknavigation", "decides", "boolean value", "apideprecated", "methodkind", "wkerrordomain", "wkscriptmessage", "promise", "fulfill", "const", "url scheme", "mark", "wkuserscript", "targetosvision", "param", "wkframeinfo", "targetosios", "pass", "window", "mime type", "link", "nsimage", "returns", "nsset", "checks", "matches", "a boolean", "defaults", "wkwebextension", "cgsize", "uiimage", "apis", "nsdate", "wkcontentmode", "wkextern", "possible", "cgfloat", "media", "cgrect", "apiunavailable", "framework", "nsswiftuiactor", "targetoswatch", "confirms", "apple upgrade", "nsstring user", "nsobject", "provider", "apple", "password", "uicontrol", "nscontrol", "asuseragerange", "check", "opaque user", "apple id", "initiate", "asauthorization", "operation", "state", "nserrorenum", "nsdata", "relying party", "asapiavailable", "perform", "realm", "http response", "authorization", "http", "oauth", "saml", "a byte", "nsdata userid", "relying", "a string", "nsdata readdata", "bool didwrite", "a cose", "nsdata first", "nsdata second", "nsstring name", "bool appid", "targetosxr", "nsstring appid", "bluetooth", "mdm profile", "nsurl url", "returns yes", "a state", "a json", "web token", "private seckeys", "enables", "keychain", "asswiftsendable", "cose algorithm", "ecdsa", "sha256", "cose curve", "p256", "nullable", "bool success", "remove", "call", "complete", "initializes", "time code", "extensions", "asextern extern", "asextern", "nsswiftsendable", "prepare", "list", "nsextension", "attempt", "nsstring label", "creates", "nsstring code", "a key", "webauthn", "nssecurecoding", "input", "output", "initialize", "nsinteger rank", "json", "inputs", "hash", "nsstring origin", "settings app", "extension", "https urls", "safari", "cancel", "nsuuid uuid", "r uftpexu", "nsmutabledata", "vnsdate", "mprcjy", "postfix", "domain", "canonical", "tables", "ldap", "post", "replace user", "address", "wietse venema", "bugs", "mail", "aliases", "postfix version", "restrict", "sample", "person", "basic system", "general", "reject empty", "postfix smtp", "ipv6 host", "reject", "reply", "access", "prior", "hold", "info", "mail delivery", "charset", "system", "report", "postfix dsn", "mail returned", "this", "generic", "smtp", "isp mail", "mime", "headerchecks", "readme files", "filters while", "posix", "empty", "body", "write", "date", "smtp server", "specify", "mx host", "unix password", "user unknown", "pathbin", "postfix queue", "unix", "cyrus", "path", "uucp", "shell", "local", "program", "agreement", "contributor", "recipient", "contribution", "the program", "corporation", "contributors", "product x", "as expressly", "arch", "arch x8664", "pipe wall", "wimplicit", "ranlib", "warn", "switch", "start", "systype", "outlook", "postfix master", "begin", "server admin", "mail backend", "modern smtp", "iana", "many", "postfix pipe", "recent cyrus", "amos gouaux", "old example", "or even", "lutz jaenicke", "technology", "cottbus", "germany", "openssl package", "openssl project", "europe", "remember that", "use of", "file", "update", "usrsbin", "file format", "no group", "daemondirectory", "deliver mail", "transport", "description", "result format", "virtual", "virtual alias", "redirect mail", "relocated", "matches user", "synopsis", "lastname", "firstname", "apple computer", "tcpip", "supported", "quantum", "facility", "level", "level info", "broadcast", "ignore", "rules", "sender", "automounter map", "use directory", "get home", "home autohome", "true", "t option", "mount", "force", "environment", "automountdenv", "promptcommand", "shellsessiondir", "histfile", "histfilesize", "myvar", "histtimeformat", "arrange", "bashrematch", "tell", "ps1h", "make bash", "s checkwinsize", "etcbashrc", "termprogram", "inpck", "nnnbaud", "berkeley", "parity", "pc entry", "pass8", "parenb istrip", "fixed speed", "entry", "clocal mode", "maxhistsize", "promptmode", "verbose end", "etcirbrcloaded", "default", "setup", "history file", "kernel", "readline", "jabber", "group database", "dovecot", "postfix scsd", "networkd", "searchpaths", "freebsd", "tmpdir", "fcodes", "prunepaths", "vartmp", "prunedirs", "filesystems", "nroff", "manpath", "uncomment", "manpager", "whatispager", "manlocale", "every", "manpath optman", "maybe", "troff", "status mailfrom", "returnpath via", "pidfile", "flags", "bcgjnuwz", "bin usrsbin", "sbin", "default pf", "care", "audio", "user database", "unix copy", "gate daemon", "bashno", "r etcbashrc", "rfc1323", "m1460", "macos x", "signature", "linux", "opera", "xp sp1", "windows sp1", "nmap syn", "m265", "synack", "mind", "macos", "warp", "ipv6", "internet", "icmp", "cisco", "monitoring", "argus", "chaos", "rsvp", "encapsulation", "aris", "isis", "netbootmount", "netbootshadow", "computername", "localonly", "localnetbootdir", "netboot", "define", "purpose", "networkonly", "waiting", "networkup", "term", "devnull", "common setup", "configure", "set command", "dns hostname", "dns query", "see also", "kame", "sunnet manager", "rpcsrc", "netlicense", "ftpd", "bindash binksh", "binsh bintcsh", "jumpcloud ldap", "smb2", "security", "workgroup", "standalone", "samba server", "enforce", "smb3", "example share", "improper use", "ctrlc", "none", "fax reception", "hardwired", "0007", "must", "visudo", "blocksize", "charset lang", "language lcall", "lines columns", "lscolors", "sshauthsock", "orion", "setup user", "home", "zdotdir", "delete", "beep", "vendor", "kf10", "kf11", "kf12", "kf13", "backspace", "insert", "resume", "termsessionid", "savehist", "sharehistory", "h do", "volume", "de l", "l uuid", "m tra", "n est", "suuid", "prfen", "fusion", "syst", "look", "executant", "alla", "over", "test", "overie", "zapis", "rapid", "disco usa", "de macos", "nie s", "i denne", "adgjmpsvx", "diskgthis disk", "01k8x j", "34disk", "levy kytt", "dict", "array", "plist", "apple root", "code signing", "inode64r", "xofkoxzh", "integer", "doctype", "brain", "abcd", "ogwo", "boaw", "cobwa", "uhawavauatsh", "ip bitmap", "foewdc", "could", "ip block", "funcs", "cogwo", "trash", "double", "hunt", "affa", "carr", "crypto", "docwbac", "q1b0", "q1 0", "h h5", "docwbag", "slice", "format", "zero", "alfa", "hera", "lelei", "hehe", "hisp", "fail", "katy", "zakk", "eodwcbgao", "hhk8di", "alma", "topo", "open", "huhk", "piper", "hehx", "eh ui", "h20hph", "hif h", "hmhhihqhyla hq", "r11b0", "target", "uus10u", "hifh", "loghookfailed", "loghook", "hell", "q1b 0", "f duh", "aqw1", "1160" ], "references": [ "index.html.en", "bind.html", "caching.html", "BUILDING", "configuring.html", "content-negotiation.html", "custom-error.html", "convenience.map", "LDAP.tbd", "lber.h", "ldap.h", "LocalAuthentication.tbd", "arm64e-apple-macos.swiftinterface", "x86_64-apple-ios-macabi.swiftinterface", "arm64e-apple-ios-macabi.swiftinterface", "x86_64-apple-macos.swiftinterface", "MultipeerConnectivity.tbd", "module.modulemap", "MCNearbyServiceAdvertiser.h", "MCPeerID.h", "MCError.h", "MCNearbyServiceBrowser.h", "MCAdvertiserAssistant.h", "MultipeerConnectivity.apinotes", "MultipeerConnectivity.h", "MCSession.h", "MCBrowserViewController.h", "dbivport.h", "dbi_sql.h", "dbd_xsh.h", "dbixs_rev.h", "Driver_xst.h", "DBIXS.h", "hook_op_check.h", "Admin.tbd", "AirPlayReceiver.tbd", "apfs_boot_mount.tbd", "AOSKit.tbd", "APConfigurationSystem.tbd", "AppleFirmwareUpdate.tbd", "launchdaemons.txt", "preboot_archive_errors.log", "mounts.txt", "launchagents.txt", "disk_structure.txt", "user_launchagents.txt", "security_status.txt", "kexts.txt", "process_list.txt", "battery.csv", "diskEncryption.csv", "chromeExtensions.csv", "crashes.csv", "interfaceAddrs.csv", "kernel.csv", "interfaceDetails.csv", "etcHosts.csv", "applications.csv", "mounts.csv", "sharedFolders.csv", "certificates.csv", "sharingPreferences.csv", "launchD.csv", "usbDevices.csv", "managedPolicies.csv", "systemInfo.csv", "users.csv", "sipConfig.csv", "systemControls.csv", "canonical", "aliases", "custom_header_checks", "access", "bounce.cf.default", "generic", "header_checks", "main.cf.default", "LICENSE", "makedefs.out", "main.cf", "master.cf.default", "main.cf.proto", "master.cf.proto", "master.cf", "TLS_LICENSE", "postfix-files", "transport", "virtual", "relocated", "afpovertcp.cfg", "asl.conf", "auto_home", "auto_master", "autofs.conf", "bashrc_Apple_Terminal", "com.apple.screensharing.agent.launchd", "bashrc", "command_args.json", "csh.cshrc", "csh.login", "find.codes", "csh.logout", "ftpusers", "gettytab", "irbrc", "kern_loader.conf", "group", "locate.rc", "man.conf", "mail.rc", "manpaths", "networks", "nfs.conf", "newsyslog.conf", "ntp_opendirectory.conf", "ntp.conf", "notify.conf", "paths", "pf.conf", "passwd", "profile", "pf.os", "protocols", "rc.netboot", "rc.common", "rmtab", "resolv.conf", "rtadvd.conf", "rpc", "shells", "smb.conf", "sudo_lecture", "ttys", "syslog.conf", "xtab", "sudoers", "zprofile", "zshrc", "zshrc_Apple_Terminal", "CodeResources", "version.plist", "Info.plist" ], "public": 1, "adversary": "DragonForce Malaysia Hacker Group", "targeted_countries": [], "malware_families": [ { "id": "Lastname", "display_name": "Lastname", "target": null }, { "id": "Firstname", "display_name": "Firstname", "target": null } ], "attack_ids": [ { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 66, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 4449, "domain": 3847, "URL": 14263, "FileHash-SHA256": 2356, "FileHash-MD5": 223, "FileHash-SHA1": 523, "email": 223, "CVE": 40, "CIDR": 12, "SSLCertFingerprint": 302 }, "indicator_count": 26238, "is_author": false, "is_subscribing": null, "subscriber_count": 35, "modified_text": "342 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6783747341bbde9b111920d8", "name": "SP10 \u2013 Szko\u0142a Podstawowa nr 10 im. Marii Sk\u0142odowskiej-Curie w Jeleniej G\u00f3rze", "description": "CVE-2024-1975\nHere is a full list of annotations and links to the work of the University ofzechoslovakia's research team, which has been working on the topic for the past two years. \u00c2\u00a31.", "modified": "2025-02-11T07:03:07.817000", "created": "2025-01-12T07:51:13.989000", "tags": [ "user", "datamodule info", "sha256", "ssdeep", "hashes cape", "sandbox", "zenbox", "file system", "color space", "cache c", "shell" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "FileHash-MD5": 9, "FileHash-SHA1": 1, "FileHash-SHA256": 4, "URL": 248, "hostname": 39, "CVE": 2 }, "indicator_count": 331, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "432 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66fae0cea9dbd082c30e30ea", "name": "The Jane Syndrome Files: Espionage-Grade Apple iPhone Infiltration", "description": "Here is a full list of details about Apple's latest operating system (OS) and the services it offers: DNS poisonings, network insecurities, malware, malicious script injections.", "modified": "2024-10-30T16:01:07.364000", "created": "2024-09-30T17:33:02.318000", "tags": [ "disabled awdl", "awdl", "status ipv6", "mode", "off awdl", "auto", "discovery", "disabled", "status power", "mac address", "f5 discoverable", "scanning", "current network", "wifi", "security", "wpa2 personal", "legacy", "ipv6", "count", "interval", "timestamp name", "open", "begin", "d71ff", "status", "begin wifi", "collect", "end wifi", "logs", "dump", "end corecapture", "cache", "stats", "cfnetwork", "could", "could ping", "dns server", "duration result", "description", "reach apple", "ping lan", "resolve dns", "number", "guard period", "errors summary", "report guard", "scan psf", "period ranges", "aw errors", "summary", "ap stats", "ap status", "period", "i en0", "airport sync", "airport network", "rave scout", "salman", "scout iphone", "guest agrp", "guest mdat", "items", "status primary", "ipv4", "interface", "nonpsc", "active", "address", "method", "supported", "status mac", "ssid", "bssid", "rssi", "tx rate", "mbps security", "congested wifi", "channel", "current channel", "ht40", "networks", "ht40 network", "wifi cc", "mcastaesccm", "mcasttkip", "fiosd8f6r", "jparadise", "bradstevens", "hazelnuthut", "karen dave", "fios", "brookleyroad", "mobile", "gator", "mach virtual", "memory", "never", "command", "execution time", "timeout", "max rss", "o user", "o ppid", "usrbintaskinfo", "a registry", "ioservice", "state", "executing task", "cpu time", "child process", "cpuwall", "cputimeout", "task container", "handshake", "tmpoutputdir", "executing", "phase", "locker", "atomic", "error", "companion", "savage", "demo", "trigger", "caller", "autounlock", "macbook air", "leaflifetime", "evaluationtime", "afterctflagday", "anchorsource", "validstatus", "numberscts", "mmcs", "unknown", "lmdc", "fssnapshot", "fpck", "fpsnapshot", "fpckrunreason", "iphone", "version", "product type", "os build", "appleinternal", "cpuarchitecture", "chipid", "hwmodel", "d53gap", "hassep", "ap1i", "ap1p", "ap1v", "b0ti", "d1pt", "iq0b", "iq1b", "mbse", "adce", "aopc", "bupt", "chcc", "chif", "upof", "waps", "warp", "wass", "default filters", "size limit", "mb on", "done enforcing", "file", "candidate", "filters", "enforcing size", "limit", "added", "predicate not", "file past", "beginswith", "endswith", "excresource", "analytics", "predicate", "not self", "contains", "max size", "matches", "osvalueobject", "ioport", "ioregistryentry", "iopower", "ioaccessory", "iousb", "iodevicetree", "root", "class", "wcfb", "gtd0x0 dtb", "rfrs", "adfh", "adhf", "vbwr", "vbrr", "cfdwc", "cfdrc", "dlwd", "gcrd", "gccan1 gcmust0", "gccan0 gcmust0", "erase quantile", "bad blocks", "max band", "eol erase", "user partition", "indpoolfree", "key1242", "timestamp", "weightedra", "qmax0", "cyclecount", "timeathighsoc", "chargingvoltage", "bhserviceflags", "04430", "familycode", "vacvoltagelimit", "53685452100", "53685452811", "1284430", "53685452411", "04410", "11524410", "53685452401", "1284410", "10244410", "11534410", "11524430", "10244430", "11534430", "53685451811", "53685451911", "chemid", "algochemid", "eeee", "designcapacity", "presentdod0", "currentcapacity", "ischarging", "temperature", "amperage", "instantamperage", "voltage", "stateofcharge", "chargeaccum", "chargingstate", "inflowstate", "chargelimit", "checkpoint", "decisionmaker", "modeofoperation", "af96b", "begin bluetooth", "b590b", "e97d3", "e1306", "certificate", "start", "status code", "sameorigin body", "xsannwhh5zixhy", "debug", "sun sep", "thu sep", "notice", "fri sep", "unbrick", "dcrt reissue", "commcenter fri", "sat sep", "commcenter sun", "data", "plist", "dict", "post useragent", "dcrt", "body", "doctype", "public", "pkitruststore", "download", "autolocker", "autojob", "data container", "installing", "ls save", "ls operation", "customer", "lsinstalltype", "miinstaller", "staging", "update", "consumed", "missingvalue", "raptor certs", "full service", "pinged configd", "cachedata", "cacheextra", "gmt4", "boot session", "bonjour", "f0fs24 cf0", "xml version", "appledtd plist", "adapter", "sen097", "wairport97", "t3gpp u8721", "u960 u8747", "bae69693u8719", "c2cb", "f1f49791page", "c4 e8", "page", "xethernet97", "sen1u8260", "u8721 u8719", "u8805 a5u8706", "a5u8706 u8721", "u8719 u960", "u8800 c6d8u8734", "b1u8804 u8805", "u8747 aabau937", "u64258 u8800", "u8747 u8776", "u64257 u64258", "u305 u8710", "u63743", "u8260", "u8805 u8706", "u731 u711", "u731", "u733", "time", "time secs", "uuid", "osversion", "lqmlogging", "su ms", "nb nrs", "na cm", "ex tf", "ffp mret", "highband", "ghz sep", "noise 88", "capture", "interfacelogs", "disabledatapath", "role lowlatency", "enabledatapath", "tx submission", "queue sep", "disablesync", "txsubq sep", "datapath", "printdatapath", "txsub disable", "txsub enable", "awdl prox", "awdl interface", "appleolyhal", "iopcidevice", "iopcidevice sep", "appleolyhallog", "pktsec", "mbitssec", "txreported", "u0 m0", "rxmacst", "monitor0 vif", "ff input", "pmopen", "rssi 100", "flushed", "rssi threshold", "service", "p2p concurrency", "allowed", "multicast", "unicast", "p2p interface", "off configured", "host edge", "awdl0", "awdl state", "configured", "d12c2680", "monitor18 vif", "transition", "wait", "device sleep", "device wake", "device active", "pending", "pnd0", "exit", "int state", "tx power", "cap config", "device tree", "ps params", "dtim", "motion profile", "womp disabled", "region info", "lla prefer", "prefer", "moving", "logic", "config", "wlcgetbssinfo", "queue", "check que", "wd scheduled1", "curr", "configure wd", "history", "wlcsetlrl", "wlcgetcountry", "debuggable", "eventbitfield", "fwid 01b0ec0e2e", "d53gap build", "device serial", "file name", "wme acm", "frequestiotx", "busytags", "peer", "u409224", "u527236 m103198", "monitor2827", "totaldropped0", "queue status", "totalflushed0", "tx completion", "rx completion", "fault report", "logging rx", "join mgr", "backpl", "85 85", "fl2 rt601", "bsside2", "rssi avg", "41 48", "44 42", "46 48", "43 42", "io80211 scan", "updated", "mpdus", "chanspec", "roam candidate", "logtransition", "cache channels", "scan home", "infra", "filesystem size", "avail capacity", "devdisk1s1", "dev devdisk1s6", "devdisk1s3", "calls", "file defrag", "metadata", "write", "object cache", "read", "fx defrag", "vnopallocate", "vnopblktooff", "meta", "user pid", "cpu stat", "pri stime", "utime command", "ppid f", "mem pri", "ni vsz", "rss wchan", "started time", "wd scheduled0", "e666293574", "monitor38 vif", "u2642957", "u4321860 m8433", "monitor9744", "b7c5a", "fl2 rt3505", "43 43", "bssid00", "lightphoneii", "43 44", "44 44", "rx data", "f4e0wf", "session", "cached", "access", "integer not", "null default", "null", "text not", "from", "text unique", "where", "order by", "not null", "bool not", "expected t", "nsdata", "unique", "integer primary", "array", "hard", "u63743 fceae8" ], "references": [ "awdl_status.txt", "arp.txt", "bluetooth_status.txt", "com.apple.wifi.syncable-networks.legacy.plist", "com.apple.wifi.syncable-networks.plist", "diagnostics-configuration.txt", "debug-log.txt", "diagnostics-connectivity.txt", "com.apple.wifi.recent-networks.json", "ifconfig.txt", "leaky_ap_stats.txt", "netstat-POST.txt", "mobilewifitool.txt", "security.txt", "netstat-PRE.txt", "network_status.txt", "wifi_datapath-PRE.txt", "wifi_scan_cache.txt", "wifi_logarchive.log", "wifi_datapath-POST.txt", "wifi_status.txt", "diagnostics-environment.txt", "wifi_scan.txt", "vm_stat.txt", "transparency.log", "tzDataVersion.log", "tailspin-info.txt", "taskSummary.csv", "sysdiagnose.log", "security-sysdiagnose.txt", "fileproviderctl_check.log", "hpmDiagnose.txt", "fileproviderctl.log", "hidutil.plist", "remotectl_dumpstate.txt", "smcDiagnose.txt", "BridgeReporting.log", "BridgeActivation.log", "AppConduit.log", "appinstallation.log", "AlishaLogs.log", "ASPSnapshots.log", "AppSupport.log", "astro.log", "AUDeveloperSettings.log", "ATVUpdateLog.log", "AVConference.log", "atcrtcomm.log", "BatteryBDC.log", "avconferenced-embedded.log", "BatteryIntelligence.log", "BluetoothAccessory.log", "BluetoothCoreDump.log", "BatteryHealth.log", "BatteryUIPlist.log", "brctl.log", "BASEBAND_TS_TRIGGER.log", "BTPHY.log", "Burnin.log", "Buddy.log", "CacheDeleteHistory.log", "CalendarPreferences.log", "CMCaptureTailspins.log", "CompanionSync.log", "CommandAndControl.log", "Contacts.log", "coreaudio_reporting.log", "CoreCapture.log", "copySpringBoardStateDump.log", "CoreLocation.log", "CoreCaptureBT.log", "crashes_and_spins.log", "cts.log", "coremediacapture-afdebug.log", "DarwinInit.log", "demod.log", "DataMigration.log", "FDR.log", "diagnostic_summary.log", "ForceResetTailspins.log", "Frametracer.log", "fsck.log", "FindMyDevice.log", "HangTracerTailspins.log", "GenerativeExperiences.log", "Harmony.log", "HIDCrashlogs.log", "HCI.log", "HomePodSetUp.log", "hidfw-crashlogs.log", "itunesstored.log", "LivabilityApp.log", "keyboard_cache.log", "LaunchServices.log", "MailErrorConditions.log", "MapsSyncJournal.log", "MatchTailspins.log", "MCState.log", "MCUCoreDumps.log", "MediaserverdBlockageTailspins.log", "MemoryExceptions.log", "MobileActivation.log", "microstackshots.log", "LogStreamFilter.log", "Mobile_Demo.log", "MobileInstallation.log", "MobileBackup.log", "MobileKeybagLogs.log", "MobileAssetHistory.log", "launchdLogs.log", "MobileSlideShow.log", "MobileLockdown.log", "MobileObliteration.log", "MobileSlideShowPrivateData.log", "MSU.log", "MobileStoreDemo.log", "NanoPreferencesSync.log", "NanoRegistry.log", "NSURLSession_logs.log", "Networking.log", "NetworkRelay.log", "ondemandd.log", "olddsc.log", "OTA.log", "OSEligibility.log", "OTAUpdateLogs.log", "Panics.log", "Personalization.log", "parsecd.log", "powerlogs.log", "process_proxied_device_logs.log", "ProactiveInputPredictions.log", "Preferences.log", "Proximity.log", "ProtectedCloudStorage.log", "RecentHangTracerTailspins.log", "RunningBoard.log", "Recoverylogd.log", "Resource_Exhaustion.log", "SensorKit.log", "SiriTextToSpeech.log", "Sentry.log", "Siri.log", "SiriAnalytics.log", "SleepCycler.log", "SocialLayerPlist.log", "spindump-meta-collection.log", "SplunkHistory.log", "stackshots.log", "SUInfo.log", "StoreServices.log", "SystemVersion.log", "Splat_Versioning.log", "syslog.log", "tailspin-history.log", "ThermalLogs.log", "tailspin-info-ts.log", "Trial.log", "UARP_Packet_Capture.log", "TetheredRestore.log", "UnifiedAsset.log", "time-sensitive-stackshot.log", "TimezoneDB.log", "unnamed_tasks.log", "UARPEndpointPacketCaptures.log", "SpaceAttributionTelemetry.log", "usermanagerd_logs.log", "VideoProcessing.log", "watchdog.log", "WindowServerHangs.log", "WiFi.log", "watchdogd_ddts.log", "asptool_snapshot_timesensitive.log", "asptool_snapshot.log", "acLog.plist", "atcrtcomm.txt", "BDC_Daily_version2.6_2024-08-29_00:19:16.csv", "BDC_Daily_version2.8_2024-09-22_16:06:26.csv", "BDC_Daily_version2.8_2024-09-13_17:49:14.csv", "BDC_Daily_version2.6_2024-09-04_12:00:11.csv", "BDC_Daily_version2.8_2024-09-21_13:45:08.csv", "BDC_OBC_version2.6_2024-08-29_00:19:14.csv", "BDC_OBC_version2.6_2024-09-13_16:25:59.csv", "BDC_OBC_version2.8_2024-09-18_23:12:12.csv", "BDC_OBC_version2.8_2024-09-14_00:28:48.csv", "BDC_OBC_version2.8_2024-09-13_23:35:57.csv", "BDC_OBC_version2.8_2024-09-14_13:32:02.csv", "BDC_OBC_version2.8_2024-09-29_15:16:41.csv", "BDC_Once_version2.6_2024-08-29_00:19:16.csv", "BDC_Once_version2.8_2024-09-13_17:49:16.csv", "BDC_SBC_version2.6_2024-09-02_20:27:16.csv", "BDC_SBC_version2.6_2024-08-29_00:19:16.csv", "BDC_SBC_version2.6_2024-09-03_11:48:00.csv", "BDC_SBC_version2.6_2024-09-11_00:27:57.csv", "BDC_SBC_version2.6_2024-09-04_13:21:06.csv", "BDC_SBC_version2.6_2024-09-04_12:00:11.csv", "BDC_SBC_version2.6_2024-09-03_00:11:37.csv", "BDC_SBC_version2.6_2024-09-13_16:26:54.csv", "BDC_SBC_version2.6_2024-09-13_16:16:55.csv", "BDC_SBC_version2.6_2024-09-08_17:52:28.csv", "BDC_SBC_version2.6_2024-09-13_02:10:48.csv", "BDC_SBC_version2.6_2024-09-12_02:07:40.csv", "BDC_SBC_version2.8_2024-09-13_17:54:28.csv", "BDC_SBC_version2.6_2024-09-13_17:07:26.csv", "BDC_SBC_version2.8_2024-09-13_17:49:18.csv", "BDC_SBC_version2.8_2024-09-14_00:28:50.csv", "BDC_SBC_version2.8_2024-09-18_03:20:38.csv", "BDC_SBC_version2.8_2024-09-18_23:12:15.csv", "BDC_SBC_version2.8_2024-09-14_13:32:04.csv", "BDC_SBC_version2.8_2024-09-21_13:45:07.csv", "BDC_SBC_version2.8_2024-09-22_05:55:57.csv", "BDC_SBC_version2.8_2024-09-23_19:56:36.csv", "BDC_SBC_version2.8_2024-09-17_01:27:03.csv", "BDC_SBC_version2.8_2024-09-23_21:27:40.csv", "BDC_SBC_version2.8_2024-09-24_19:36:33.csv", "BDC_SBC_version2.8_2024-09-14_01:16:12.csv", "BDC_SmartCharging_version2.6_2024-09-02_20:25:09.csv", "BDC_SmartCharging_version2.6_2024-08-29_00:21:46.csv", "BDC_SmartCharging_version2.6_2024-09-03_04:09:12.csv", "BDC_SmartCharging_version2.6_2024-09-03_11:48:07.csv", "BDC_SmartCharging_version2.6_2024-09-03_00:11:44.csv", "BDC_SmartCharging_version2.6_2024-09-04_12:00:20.csv", "BDC_SmartCharging_version2.6_2024-09-04_13:19:02.csv", "CacheDeletePurgeHistory.txt", "FDRDiagnosticReport.plist", "GEAvailability.log", "IOSADiagnose.log", "version", "akd_dcrt_baa_response.txt", "mobileactivationd.log.0", "akd_dcrt_baa_request.txt", "MAAutoAsset_Atomic_History_00.log", "MAAutoAsset_Atomic_History_02.log", "MAAutoAsset_Atomic_History_01.log", "MAAutoAsset_Atomic_History_03.log", "MAAutoAsset_Atomic_History_05.log", "MAAutoAsset_Atomic_History_04.log", "MAAutoAsset_Atomic_History_09.log", "MAAutoAsset_Atomic_History.txt", "MAAutoAsset_Atomic_History_08.log", "MAAutoAsset_Error_History_00.log", "MAAutoAsset_Atomic_History_06.log", "MAAutoAsset_Error_History_02.log", "MAAutoAsset_Error_History_04.log", "MAAutoAsset_Error_History_05.log", "MAAutoAsset_Error_History_08.log", "MAAutoAsset_Error_History.txt", "MAAutoAsset_Filesystem_History_01.log", "MAAutoAsset_Error_History_06.log", "MAAutoAsset_Error_History_09.log", "MAAutoAsset_Error_History_07.log", "MAAutoAsset_Filesystem_History_03.log", "MAAutoAsset_Filesystem_History_02.log", "MAAutoAsset_Filesystem_History_04.log", "MAAutoAsset_Filesystem_History_05.log", "MAAutoAsset_Filesystem_History_08.log", "MAAutoAsset_Filesystem_History_09.log", "MAAutoAsset_Filesystem_History_06.log", "MAAutoAsset_Filesystem_History_00.log", "MAAutoAsset_Filesystem_History_07.log", "MAAutoAsset_Filesystem_History.txt", "MAAutoAsset_Locker_History_00.log", "MAAutoAsset_Locker_History_01.log", "MAAutoAsset_Locker_History_03.log", "MAAutoAsset_Locker_History_06.log", "MAAutoAsset_Locker_History_02.log", "MAAutoAsset_Locker_History_04.log", "MAAutoAsset_Locker_History_05.log", "MAAutoAsset_Locker_History_07.log", "MAAutoAsset_Scheduler_History_00.log", "MAAutoAsset_Locker_History.txt", "MAAutoAsset_Locker_History_08.log", "MAAutoAsset_Scheduler_History_03.log", "MAAutoAsset_Scheduler_History_02.log", "MAAutoAsset_Scheduler_History_04.log", "MAAutoAsset_Scheduler_History_01.log", "MAAutoAsset_Locker_History_09.log", "MAAutoAsset_Scheduler_History_07.log", "MAAutoAsset_Scheduler_History_08.log", "MAAutoAsset_Scheduler_History_05.log", "MAAutoAsset_Scheduler_History_06.log", "MAAutoAsset_Scheduler_History.txt", "MAAutoAsset_Scheduler_History_09.log", "MAAutoAsset_Secure_History_01.log", "MAAutoAsset_Secure_History_00.log", "MAAutoAsset_Secure_History_04.log", "MAAutoAsset_Secure_History_05.log", "MAAutoAsset_Secure_History_03.log", "MAAutoAsset_Secure_History_07.log", "MAAutoAsset_Secure_History_08.log", "MAAutoAsset_Secure_History_06.log", "MAAutoAsset_Secure_History_09.log", "MAAutoAsset_Stager_History_01.log", "MAAutoAsset_Stager_History_02.log", "MAAutoAsset_Stager_History_00.log", "MAAutoAsset_Secure_History.txt", "MAAutoAsset_Stager_History_03.log", "MAAutoAsset_Stager_History_05.log", "MAAutoAsset_Stager_History_07.log", "MAAutoAsset_Stager_History_04.log", "MAAutoAsset_Stager_History_08.log", "MAAutoAsset_Stager_History_06.log", "MAAutoAsset_Stager_History_09.log", "MAAutoAsset_Stager_History.txt", "mobile_installation.log.0", "mobile_installation.log.1", "mobile_installation_helper.log.0", "lockdownd.log", "SUCoreSplunkHistory.log", "model_catalog_dump.txt", "model_manager_dump.json", "com.apple.networkextension.necp.rtf", "preferences.rtf", "NetworkInterfaces.rtf", "com.apple.networkextension.rtf", "com.apple.networkextension.uuidcache.rtf", "com.apple.networkextension.cache.rtf", "com.apple.networkextension.control.rtf", "Entity_2024-09-29 22:12:50.359_Blacklist.csv", "capture.rtf", "system.rtf", "[2024-09-29_22,12,45.966405]-LQMLogging-001.txt", "[2024-09-29_22,12,45.960131]-Interface_SoftAP_0-001.txt", "[2024-09-29_22,12,56.122877]-Interface_LowLatency_0-001.txt", "[2024-09-29_22,12,56.815468]-Interface_Infrastructure_0-001.txt", "[2024-09-29_22,12,56.591747]-Interface_AirLink_0-001.txt", "[2024-09-29_22,12,56.327440]-uartFirmwareLogs-001.txt", "[2024-09-29_22,12,56.457960]-AppleOLYHAL_log-001.txt", "AddFileList.txt", "ap1_AllPeersVerbose_IO80211PeerManager.txt", "awdl0_PrintState_IO80211AWDLPeerManager.txt", "awdl0_AllPeersVerbose_IO80211AWDLPeerManager.txt", "BusState.txt", "ConfigManagerState.txt", "CommanderState.txt", "CoreState.txt", "DeviceInfo.xml", "en0_AllPeersVerbose_IO80211PeerManager.txt", "en0_PrintState_IO80211PeerManager.txt", "InterfaceState_apsta.txt", "ap1_PrintState_IO80211PeerManager.txt", "FaultReportState.txt", "History.txt", "InterfaceState_prox.txt", "ivars->fChannelSwitchDictionary[0].xml", "InterfaceState_llw.txt", "JoinManagerState.txt", "ivars->fChannelSwitchDictionary[1].xml", "InterfaceState_skywalkinfra.txt", "ScanManagerState.txt", "LowLatencyRxCompRing", "MMIO_Log.txt", "SoC_Registers.xml", "LowLatencyTxCompRing", "NetManagerState.txt", "[2024-09-29_22,12,56.477273]-AppleBCMWLAN_Logs-001.txt", "disks.txt", "apfs_stats.txt", "oslog_archive_error.log", "ps_thread.txt", "971A5878D635EB8B262FF791353234.rtf", "B730B951A932F5AE2648F478FDDA81.rtf", "E7B80B551D34E4BCDBC1E47D6AB627.rtf", "2B553D16843D7B9CD7A4504A96CF2F.rtf", "594CB14E19331E8CFB5365144D46C4.rtf", "DE90FBA8603371B106DDEC727E696D.rtf", "C1ACD227FD3CE992C115DD95BD2B42.rtf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 105, "domain": 71, "hostname": 211, "URL": 125, "email": 2, "FileHash-MD5": 14, "FileHash-SHA1": 212 }, "indicator_count": 740, "is_author": false, "is_subscribing": null, "subscriber_count": 30, "modified_text": "536 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66fae0d0177ccf5dfc5c1fb0", "name": "The Jane Syndrome Files: Espionage-Grade Apple iPhone Infiltration", "description": "Here is a full list of details about Apple's latest operating system (OS) and the services it offers: DNS poisonings, network insecurities, malware, malicious script injections.", "modified": "2024-10-30T16:01:07.364000", "created": "2024-09-30T17:33:04.581000", "tags": [ "disabled awdl", "awdl", "status ipv6", "mode", "off awdl", "auto", "discovery", "disabled", "status power", "mac address", "f5 discoverable", "scanning", "current network", "wifi", "security", "wpa2 personal", "legacy", "ipv6", "count", "interval", "timestamp name", "open", "begin", "d71ff", "status", "begin wifi", "collect", "end wifi", "logs", "dump", "end corecapture", "cache", "stats", "cfnetwork", "could", "could ping", "dns server", "duration result", "description", "reach apple", "ping lan", "resolve dns", "number", "guard period", "errors summary", "report guard", "scan psf", "period ranges", "aw errors", "summary", "ap stats", "ap status", "period", "i en0", "airport sync", "airport network", "rave scout", "salman", "scout iphone", "guest agrp", "guest mdat", "items", "status primary", "ipv4", "interface", "nonpsc", "active", "address", "method", "supported", "status mac", "ssid", "bssid", "rssi", "tx rate", "mbps security", "congested wifi", "channel", "current channel", "ht40", "networks", "ht40 network", "wifi cc", "mcastaesccm", "mcasttkip", "fiosd8f6r", "jparadise", "bradstevens", "hazelnuthut", "karen dave", "fios", "brookleyroad", "mobile", "gator", "mach virtual", "memory", "never", "command", "execution time", "timeout", "max rss", "o user", "o ppid", "usrbintaskinfo", "a registry", "ioservice", "state", "executing task", "cpu time", "child process", "cpuwall", "cputimeout", "task container", "handshake", "tmpoutputdir", "executing", "phase", "locker", "atomic", "error", "companion", "savage", "demo", "trigger", "caller", "autounlock", "macbook air", "leaflifetime", "evaluationtime", "afterctflagday", "anchorsource", "validstatus", "numberscts", "mmcs", "unknown", "lmdc", "fssnapshot", "fpck", "fpsnapshot", "fpckrunreason", "iphone", "version", "product type", "os build", "appleinternal", "cpuarchitecture", "chipid", "hwmodel", "d53gap", "hassep", "ap1i", "ap1p", "ap1v", "b0ti", "d1pt", "iq0b", "iq1b", "mbse", "adce", "aopc", "bupt", "chcc", "chif", "upof", "waps", "warp", "wass", "default filters", "size limit", "mb on", "done enforcing", "file", "candidate", "filters", "enforcing size", "limit", "added", "predicate not", "file past", "beginswith", "endswith", "excresource", "analytics", "predicate", "not self", "contains", "max size", "matches", "osvalueobject", "ioport", "ioregistryentry", "iopower", "ioaccessory", "iousb", "iodevicetree", "root", "class", "wcfb", "gtd0x0 dtb", "rfrs", "adfh", "adhf", "vbwr", "vbrr", "cfdwc", "cfdrc", "dlwd", "gcrd", "gccan1 gcmust0", "gccan0 gcmust0", "erase quantile", "bad blocks", "max band", "eol erase", "user partition", "indpoolfree", "key1242", "timestamp", "weightedra", "qmax0", "cyclecount", "timeathighsoc", "chargingvoltage", "bhserviceflags", "04430", "familycode", "vacvoltagelimit", "53685452100", "53685452811", "1284430", "53685452411", "04410", "11524410", "53685452401", "1284410", "10244410", "11534410", "11524430", "10244430", "11534430", "53685451811", "53685451911", "chemid", "algochemid", "eeee", "designcapacity", "presentdod0", "currentcapacity", "ischarging", "temperature", "amperage", "instantamperage", "voltage", "stateofcharge", "chargeaccum", "chargingstate", "inflowstate", "chargelimit", "checkpoint", "decisionmaker", "modeofoperation", "af96b", "begin bluetooth", "b590b", "e97d3", "e1306", "certificate", "start", "status code", "sameorigin body", "xsannwhh5zixhy", "debug", "sun sep", "thu sep", "notice", "fri sep", "unbrick", "dcrt reissue", "commcenter fri", "sat sep", "commcenter sun", "data", "plist", "dict", "post useragent", "dcrt", "body", "doctype", "public", "pkitruststore", "download", "autolocker", "autojob", "data container", "installing", "ls save", "ls operation", "customer", "lsinstalltype", "miinstaller", "staging", "update", "consumed", "missingvalue", "raptor certs", "full service", "pinged configd", "cachedata", "cacheextra", "gmt4", "boot session", "bonjour", "f0fs24 cf0", "xml version", "appledtd plist", "adapter", "sen097", "wairport97", "t3gpp u8721", "u960 u8747", "bae69693u8719", "c2cb", "f1f49791page", "c4 e8", "page", "xethernet97", "sen1u8260", "u8721 u8719", "u8805 a5u8706", "a5u8706 u8721", "u8719 u960", "u8800 c6d8u8734", "b1u8804 u8805", "u8747 aabau937", "u64258 u8800", "u8747 u8776", "u64257 u64258", "u305 u8710", "u63743", "u8260", "u8805 u8706", "u731 u711", "u731", "u733", "time", "time secs", "uuid", "osversion", "lqmlogging", "su ms", "nb nrs", "na cm", "ex tf", "ffp mret", "highband", "ghz sep", "noise 88", "capture", "interfacelogs", "disabledatapath", "role lowlatency", "enabledatapath", "tx submission", "queue sep", "disablesync", "txsubq sep", "datapath", "printdatapath", "txsub disable", "txsub enable", "awdl prox", "awdl interface", "appleolyhal", "iopcidevice", "iopcidevice sep", "appleolyhallog", "pktsec", "mbitssec", "txreported", "u0 m0", "rxmacst", "monitor0 vif", "ff input", "pmopen", "rssi 100", "flushed", "rssi threshold", "service", "p2p concurrency", "allowed", "multicast", "unicast", "p2p interface", "off configured", "host edge", "awdl0", "awdl state", "configured", "d12c2680", "monitor18 vif", "transition", "wait", "device sleep", "device wake", "device active", "pending", "pnd0", "exit", "int state", "tx power", "cap config", "device tree", "ps params", "dtim", "motion profile", "womp disabled", "region info", "lla prefer", "prefer", "moving", "logic", "config", "wlcgetbssinfo", "queue", "check que", "wd scheduled1", "curr", "configure wd", "history", "wlcsetlrl", "wlcgetcountry", "debuggable", "eventbitfield", "fwid 01b0ec0e2e", "d53gap build", "device serial", "file name", "wme acm", "frequestiotx", "busytags", "peer", "u409224", "u527236 m103198", "monitor2827", "totaldropped0", "queue status", "totalflushed0", "tx completion", "rx completion", "fault report", "logging rx", "join mgr", "backpl", "85 85", "fl2 rt601", "bsside2", "rssi avg", "41 48", "44 42", "46 48", "43 42", "io80211 scan", "updated", "mpdus", "chanspec", "roam candidate", "logtransition", "cache channels", "scan home", "infra", "filesystem size", "avail capacity", "devdisk1s1", "dev devdisk1s6", "devdisk1s3", "calls", "file defrag", "metadata", "write", "object cache", "read", "fx defrag", "vnopallocate", "vnopblktooff", "meta", "user pid", "cpu stat", "pri stime", "utime command", "ppid f", "mem pri", "ni vsz", "rss wchan", "started time", "wd scheduled0", "e666293574", "monitor38 vif", "u2642957", "u4321860 m8433", "monitor9744", "b7c5a", "fl2 rt3505", "43 43", "bssid00", "lightphoneii", "43 44", "44 44", "rx data", "f4e0wf", "session", "cached", "access", "integer not", "null default", "null", "text not", "from", "text unique", "where", "order by", "not null", "bool not", "expected t", "nsdata", "unique", "integer primary", "array", "hard", "u63743 fceae8" ], "references": [ "awdl_status.txt", "arp.txt", "bluetooth_status.txt", "com.apple.wifi.syncable-networks.legacy.plist", "com.apple.wifi.syncable-networks.plist", "diagnostics-configuration.txt", "debug-log.txt", "diagnostics-connectivity.txt", "com.apple.wifi.recent-networks.json", "ifconfig.txt", "leaky_ap_stats.txt", "netstat-POST.txt", "mobilewifitool.txt", "security.txt", "netstat-PRE.txt", "network_status.txt", "wifi_datapath-PRE.txt", "wifi_scan_cache.txt", "wifi_logarchive.log", "wifi_datapath-POST.txt", "wifi_status.txt", "diagnostics-environment.txt", "wifi_scan.txt", "vm_stat.txt", "transparency.log", "tzDataVersion.log", "tailspin-info.txt", "taskSummary.csv", "sysdiagnose.log", "security-sysdiagnose.txt", "fileproviderctl_check.log", "hpmDiagnose.txt", "fileproviderctl.log", "hidutil.plist", "remotectl_dumpstate.txt", "smcDiagnose.txt", "BridgeReporting.log", "BridgeActivation.log", "AppConduit.log", "appinstallation.log", "AlishaLogs.log", "ASPSnapshots.log", "AppSupport.log", "astro.log", "AUDeveloperSettings.log", "ATVUpdateLog.log", "AVConference.log", "atcrtcomm.log", "BatteryBDC.log", "avconferenced-embedded.log", "BatteryIntelligence.log", "BluetoothAccessory.log", "BluetoothCoreDump.log", "BatteryHealth.log", "BatteryUIPlist.log", "brctl.log", "BASEBAND_TS_TRIGGER.log", "BTPHY.log", "Burnin.log", "Buddy.log", "CacheDeleteHistory.log", "CalendarPreferences.log", "CMCaptureTailspins.log", "CompanionSync.log", "CommandAndControl.log", "Contacts.log", "coreaudio_reporting.log", "CoreCapture.log", "copySpringBoardStateDump.log", "CoreLocation.log", "CoreCaptureBT.log", "crashes_and_spins.log", "cts.log", "coremediacapture-afdebug.log", "DarwinInit.log", "demod.log", "DataMigration.log", "FDR.log", "diagnostic_summary.log", "ForceResetTailspins.log", "Frametracer.log", "fsck.log", "FindMyDevice.log", "HangTracerTailspins.log", "GenerativeExperiences.log", "Harmony.log", "HIDCrashlogs.log", "HCI.log", "HomePodSetUp.log", "hidfw-crashlogs.log", "itunesstored.log", "LivabilityApp.log", "keyboard_cache.log", "LaunchServices.log", "MailErrorConditions.log", "MapsSyncJournal.log", "MatchTailspins.log", "MCState.log", "MCUCoreDumps.log", "MediaserverdBlockageTailspins.log", "MemoryExceptions.log", "MobileActivation.log", "microstackshots.log", "LogStreamFilter.log", "Mobile_Demo.log", "MobileInstallation.log", "MobileBackup.log", "MobileKeybagLogs.log", "MobileAssetHistory.log", "launchdLogs.log", "MobileSlideShow.log", "MobileLockdown.log", "MobileObliteration.log", "MobileSlideShowPrivateData.log", "MSU.log", "MobileStoreDemo.log", "NanoPreferencesSync.log", "NanoRegistry.log", "NSURLSession_logs.log", "Networking.log", "NetworkRelay.log", "ondemandd.log", "olddsc.log", "OTA.log", "OSEligibility.log", "OTAUpdateLogs.log", "Panics.log", "Personalization.log", "parsecd.log", "powerlogs.log", "process_proxied_device_logs.log", "ProactiveInputPredictions.log", "Preferences.log", "Proximity.log", "ProtectedCloudStorage.log", "RecentHangTracerTailspins.log", "RunningBoard.log", "Recoverylogd.log", "Resource_Exhaustion.log", "SensorKit.log", "SiriTextToSpeech.log", "Sentry.log", "Siri.log", "SiriAnalytics.log", "SleepCycler.log", "SocialLayerPlist.log", "spindump-meta-collection.log", "SplunkHistory.log", "stackshots.log", "SUInfo.log", "StoreServices.log", "SystemVersion.log", "Splat_Versioning.log", "syslog.log", "tailspin-history.log", "ThermalLogs.log", "tailspin-info-ts.log", "Trial.log", "UARP_Packet_Capture.log", "TetheredRestore.log", "UnifiedAsset.log", "time-sensitive-stackshot.log", "TimezoneDB.log", "unnamed_tasks.log", "UARPEndpointPacketCaptures.log", "SpaceAttributionTelemetry.log", "usermanagerd_logs.log", "VideoProcessing.log", "watchdog.log", "WindowServerHangs.log", "WiFi.log", "watchdogd_ddts.log", "asptool_snapshot_timesensitive.log", "asptool_snapshot.log", "acLog.plist", "atcrtcomm.txt", "BDC_Daily_version2.6_2024-08-29_00:19:16.csv", "BDC_Daily_version2.8_2024-09-22_16:06:26.csv", "BDC_Daily_version2.8_2024-09-13_17:49:14.csv", "BDC_Daily_version2.6_2024-09-04_12:00:11.csv", "BDC_Daily_version2.8_2024-09-21_13:45:08.csv", "BDC_OBC_version2.6_2024-08-29_00:19:14.csv", "BDC_OBC_version2.6_2024-09-13_16:25:59.csv", "BDC_OBC_version2.8_2024-09-18_23:12:12.csv", "BDC_OBC_version2.8_2024-09-14_00:28:48.csv", "BDC_OBC_version2.8_2024-09-13_23:35:57.csv", "BDC_OBC_version2.8_2024-09-14_13:32:02.csv", "BDC_OBC_version2.8_2024-09-29_15:16:41.csv", "BDC_Once_version2.6_2024-08-29_00:19:16.csv", "BDC_Once_version2.8_2024-09-13_17:49:16.csv", "BDC_SBC_version2.6_2024-09-02_20:27:16.csv", "BDC_SBC_version2.6_2024-08-29_00:19:16.csv", "BDC_SBC_version2.6_2024-09-03_11:48:00.csv", "BDC_SBC_version2.6_2024-09-11_00:27:57.csv", "BDC_SBC_version2.6_2024-09-04_13:21:06.csv", "BDC_SBC_version2.6_2024-09-04_12:00:11.csv", "BDC_SBC_version2.6_2024-09-03_00:11:37.csv", "BDC_SBC_version2.6_2024-09-13_16:26:54.csv", "BDC_SBC_version2.6_2024-09-13_16:16:55.csv", "BDC_SBC_version2.6_2024-09-08_17:52:28.csv", "BDC_SBC_version2.6_2024-09-13_02:10:48.csv", "BDC_SBC_version2.6_2024-09-12_02:07:40.csv", "BDC_SBC_version2.8_2024-09-13_17:54:28.csv", "BDC_SBC_version2.6_2024-09-13_17:07:26.csv", "BDC_SBC_version2.8_2024-09-13_17:49:18.csv", "BDC_SBC_version2.8_2024-09-14_00:28:50.csv", "BDC_SBC_version2.8_2024-09-18_03:20:38.csv", "BDC_SBC_version2.8_2024-09-18_23:12:15.csv", "BDC_SBC_version2.8_2024-09-14_13:32:04.csv", "BDC_SBC_version2.8_2024-09-21_13:45:07.csv", "BDC_SBC_version2.8_2024-09-22_05:55:57.csv", "BDC_SBC_version2.8_2024-09-23_19:56:36.csv", "BDC_SBC_version2.8_2024-09-17_01:27:03.csv", "BDC_SBC_version2.8_2024-09-23_21:27:40.csv", "BDC_SBC_version2.8_2024-09-24_19:36:33.csv", "BDC_SBC_version2.8_2024-09-14_01:16:12.csv", "BDC_SmartCharging_version2.6_2024-09-02_20:25:09.csv", "BDC_SmartCharging_version2.6_2024-08-29_00:21:46.csv", "BDC_SmartCharging_version2.6_2024-09-03_04:09:12.csv", "BDC_SmartCharging_version2.6_2024-09-03_11:48:07.csv", "BDC_SmartCharging_version2.6_2024-09-03_00:11:44.csv", "BDC_SmartCharging_version2.6_2024-09-04_12:00:20.csv", "BDC_SmartCharging_version2.6_2024-09-04_13:19:02.csv", "CacheDeletePurgeHistory.txt", "FDRDiagnosticReport.plist", "GEAvailability.log", "IOSADiagnose.log", "version", "akd_dcrt_baa_response.txt", "mobileactivationd.log.0", "akd_dcrt_baa_request.txt", "MAAutoAsset_Atomic_History_00.log", "MAAutoAsset_Atomic_History_02.log", "MAAutoAsset_Atomic_History_01.log", "MAAutoAsset_Atomic_History_03.log", "MAAutoAsset_Atomic_History_05.log", "MAAutoAsset_Atomic_History_04.log", "MAAutoAsset_Atomic_History_09.log", "MAAutoAsset_Atomic_History.txt", "MAAutoAsset_Atomic_History_08.log", "MAAutoAsset_Error_History_00.log", "MAAutoAsset_Atomic_History_06.log", "MAAutoAsset_Error_History_02.log", "MAAutoAsset_Error_History_04.log", "MAAutoAsset_Error_History_05.log", "MAAutoAsset_Error_History_08.log", "MAAutoAsset_Error_History.txt", "MAAutoAsset_Filesystem_History_01.log", "MAAutoAsset_Error_History_06.log", "MAAutoAsset_Error_History_09.log", "MAAutoAsset_Error_History_07.log", "MAAutoAsset_Filesystem_History_03.log", "MAAutoAsset_Filesystem_History_02.log", "MAAutoAsset_Filesystem_History_04.log", "MAAutoAsset_Filesystem_History_05.log", "MAAutoAsset_Filesystem_History_08.log", "MAAutoAsset_Filesystem_History_09.log", "MAAutoAsset_Filesystem_History_06.log", "MAAutoAsset_Filesystem_History_00.log", "MAAutoAsset_Filesystem_History_07.log", "MAAutoAsset_Filesystem_History.txt", "MAAutoAsset_Locker_History_00.log", "MAAutoAsset_Locker_History_01.log", "MAAutoAsset_Locker_History_03.log", "MAAutoAsset_Locker_History_06.log", "MAAutoAsset_Locker_History_02.log", "MAAutoAsset_Locker_History_04.log", "MAAutoAsset_Locker_History_05.log", "MAAutoAsset_Locker_History_07.log", "MAAutoAsset_Scheduler_History_00.log", "MAAutoAsset_Locker_History.txt", "MAAutoAsset_Locker_History_08.log", "MAAutoAsset_Scheduler_History_03.log", "MAAutoAsset_Scheduler_History_02.log", "MAAutoAsset_Scheduler_History_04.log", "MAAutoAsset_Scheduler_History_01.log", "MAAutoAsset_Locker_History_09.log", "MAAutoAsset_Scheduler_History_07.log", "MAAutoAsset_Scheduler_History_08.log", "MAAutoAsset_Scheduler_History_05.log", "MAAutoAsset_Scheduler_History_06.log", "MAAutoAsset_Scheduler_History.txt", "MAAutoAsset_Scheduler_History_09.log", "MAAutoAsset_Secure_History_01.log", "MAAutoAsset_Secure_History_00.log", "MAAutoAsset_Secure_History_04.log", "MAAutoAsset_Secure_History_05.log", "MAAutoAsset_Secure_History_03.log", "MAAutoAsset_Secure_History_07.log", "MAAutoAsset_Secure_History_08.log", "MAAutoAsset_Secure_History_06.log", "MAAutoAsset_Secure_History_09.log", "MAAutoAsset_Stager_History_01.log", "MAAutoAsset_Stager_History_02.log", "MAAutoAsset_Stager_History_00.log", "MAAutoAsset_Secure_History.txt", "MAAutoAsset_Stager_History_03.log", "MAAutoAsset_Stager_History_05.log", "MAAutoAsset_Stager_History_07.log", "MAAutoAsset_Stager_History_04.log", "MAAutoAsset_Stager_History_08.log", "MAAutoAsset_Stager_History_06.log", "MAAutoAsset_Stager_History_09.log", "MAAutoAsset_Stager_History.txt", "mobile_installation.log.0", "mobile_installation.log.1", "mobile_installation_helper.log.0", "lockdownd.log", "SUCoreSplunkHistory.log", "model_catalog_dump.txt", "model_manager_dump.json", "com.apple.networkextension.necp.rtf", "preferences.rtf", "NetworkInterfaces.rtf", "com.apple.networkextension.rtf", "com.apple.networkextension.uuidcache.rtf", "com.apple.networkextension.cache.rtf", "com.apple.networkextension.control.rtf", "Entity_2024-09-29 22:12:50.359_Blacklist.csv", "capture.rtf", "system.rtf", "[2024-09-29_22,12,45.966405]-LQMLogging-001.txt", "[2024-09-29_22,12,45.960131]-Interface_SoftAP_0-001.txt", "[2024-09-29_22,12,56.122877]-Interface_LowLatency_0-001.txt", "[2024-09-29_22,12,56.815468]-Interface_Infrastructure_0-001.txt", "[2024-09-29_22,12,56.591747]-Interface_AirLink_0-001.txt", "[2024-09-29_22,12,56.327440]-uartFirmwareLogs-001.txt", "[2024-09-29_22,12,56.457960]-AppleOLYHAL_log-001.txt", "AddFileList.txt", "ap1_AllPeersVerbose_IO80211PeerManager.txt", "awdl0_PrintState_IO80211AWDLPeerManager.txt", "awdl0_AllPeersVerbose_IO80211AWDLPeerManager.txt", "BusState.txt", "ConfigManagerState.txt", "CommanderState.txt", "CoreState.txt", "DeviceInfo.xml", "en0_AllPeersVerbose_IO80211PeerManager.txt", "en0_PrintState_IO80211PeerManager.txt", "InterfaceState_apsta.txt", "ap1_PrintState_IO80211PeerManager.txt", "FaultReportState.txt", "History.txt", "InterfaceState_prox.txt", "ivars->fChannelSwitchDictionary[0].xml", "InterfaceState_llw.txt", "JoinManagerState.txt", "ivars->fChannelSwitchDictionary[1].xml", "InterfaceState_skywalkinfra.txt", "ScanManagerState.txt", "LowLatencyRxCompRing", "MMIO_Log.txt", "SoC_Registers.xml", "LowLatencyTxCompRing", "NetManagerState.txt", "[2024-09-29_22,12,56.477273]-AppleBCMWLAN_Logs-001.txt", "disks.txt", "apfs_stats.txt", "oslog_archive_error.log", "ps_thread.txt", "971A5878D635EB8B262FF791353234.rtf", "B730B951A932F5AE2648F478FDDA81.rtf", "E7B80B551D34E4BCDBC1E47D6AB627.rtf", "2B553D16843D7B9CD7A4504A96CF2F.rtf", "594CB14E19331E8CFB5365144D46C4.rtf", "DE90FBA8603371B106DDEC727E696D.rtf", "C1ACD227FD3CE992C115DD95BD2B42.rtf" ], "public": 1, "adversary": "DragonForce Malaysia Hacker Group", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "", "display_name": "", "target": null } ], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1088", "name": "Bypass User Account Control", "display_name": "T1088 - Bypass User Account Control" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1546.004", "name": "Unix Shell Configuration Modification", "display_name": "T1546.004 - Unix Shell Configuration Modification" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1213", "name": "Data from Information Repositories", "display_name": "T1213 - Data from Information Repositories" }, { "id": "T1070.002", "name": "Clear Linux or Mac System Logs", "display_name": "T1070.002 - Clear Linux or Mac System Logs" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1404", "name": "Exploit OS Vulnerability", "display_name": "T1404 - Exploit OS Vulnerability" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 105, "domain": 70, "hostname": 211, "URL": 125, "email": 2, "FileHash-MD5": 14, "FileHash-SHA1": 212 }, "indicator_count": 739, "is_author": false, "is_subscribing": null, "subscriber_count": 31, "modified_text": "536 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65aab954f5f03a1f2906b39c", "name": "Zerobot", "description": "", "modified": "2024-10-12T07:01:26.973000", "created": "2024-01-19T18:03:00.966000", "tags": [ "ssl certificate", "whois record", "referrer", "historical ssl", "resolutions", "whois whois", "communicating", "subdomains", "contacted", "c1on", "cmdwget http", "metro", "zerobot", "execution", "skynet", "june" ], "references": [ "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ZeroBot", "display_name": "ZeroBot", "target": null }, { "id": "Skynet", "display_name": "Skynet", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65aa168aeddea4851fc47cc3", "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 123, "FileHash-SHA1": 123, "FileHash-SHA256": 2498, "domain": 1600, "hostname": 2749, "URL": 6303, "CVE": 1 }, "indicator_count": 13397, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "554 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d32648280eb859dfca1c19", "name": "x.com - That's what friends are for!", "description": "Original pulses modified, unknown stealer, junk data stuffing sifted through. Careful notes have been taken regarding ultra significant pulses. I've done the best I can to analyze compare, compile from all record of original pulse. | Further analysis shows an effort to destroy quite a bit of pertinent evidence. | I consider the target, family and associates to be especially endangered. Target has become isolated from most people target associated with, mostly by force as not to spread the malicious vulnerabilities that ha e affected many.\nTarget & associated have been interacting with and work with \n, hiring (not everyone they know) those involved. | There has been significant modification and degradation of the origin of information collected. | Who can you report to if the perpetrator is the Law. | This has always been the reason. | Don't hire another hit. What's the point? To uphold a fake integrity as a legacy?", "modified": "2024-09-30T10:01:49.889000", "created": "2024-08-31T14:18:48.037000", "tags": [ "referrer", "historical ssl", "united", "as13414 twitter", "nxdomain", "whitelisted", "cname", "a nxdomain", "status", "aaaa", "as15133 verizon", "search", "date", "twitter", "spoofed", "qbot qakbot", "qbot", "information", "t1027", "files", "t1036", "t1041", "c2 channel", "t1056", "capture", "t1057", "discovery", "memcommit", "process32nextw", "regsetvalueexa", "regdword", "module load", "t1129", "show", "intel", "ms windows", "trojan", "copy", "write", "win64", "next", "url https", "qbot type", "indicator role", "title added", "active related", "pulses url", "url http", "showing", "entries", "msie", "windows nt", "formsecnen", "read", "read c", "russia as48848", "qmount", "unknown", "pecompact", "malware", "role title", "added active", "related pulses", "type indicator", "as44273 host", "name servers", "as47846", "germany unknown", "443 ma2592000", "scan endpoints", "passive dns", "urls", "creation date", "all scoreblue", "hostname", "filehashsha256", "filehashsha1", "filehashmd5", "months ago", "ipv4", "report spam", "tinynote", "cobalt strike", "ransomexx", "quackbot", "comspec", "prefetch8", "pattern match", "prefetch1", "mitre att", "ck id", "show technique", "ck matrix", "null", "path", "hybrid", "general", "click", "strings", "langchinese", "icmp traffic", "pe resource", "pe section", "companyname gm", "win32", "push", "fakedout threat", "analyzer paste", "iocs", "hostnames", "urls https", "overview ip", "address", "related nids", "files hostname", "files domain", "files related", "pulses none", "related tags", "virustotal", "china unknown", "as4837 china", "redacted for", "as4835 china", "douglas county", "co sheriff", "office", "pegasus attacks", "sa victim", "cve type", "cve cve20170147", "no expiration", "expiration", "domain", "create new", "subsys00000000", "as16625 akamai", "as20940", "as39960", "as6762 telecom", "united kingdom", "emails", "span", "created", "white", "formatpng feb", "refererparam", "classid1", "login0", "typeid1", "style1", "dynamicloader", "high", "yara rule", "neshta", "neshta virus", "myapp", "ids detections", "yara detections", "alerts", "worm", "delphi", "ip address", "files location", "china flag", "china domain", "pulses otx", "pulses", "as45102 alibaba", "japan unknown", "as32934", "as19679 dropbox", "pulse pulses", "google safe", "browsing", "hosting", "body", "as7018 att", "verdict vpn", "as9009 m247", "canada unknown", "as174 cogent", "israel unknown", "as12310", "romania unknown", "as48945", "as64286", "b3viles0 feb", "modified", "siteid290", "org7", "novno jan", "siteid289", "org4", "org9", "locuo", "siteid969", "https", "http", "rims https", "evader", "message", "jeffrey scott", "reimer dpt", "pegasus", "pinterest", "amadey", "quasar rat", "eternalblue", "service", "sahil", "andcustomer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Germany", "Netherlands", "Italy", "United Kingdom of Great Britain and Northern Ireland", "Japan", "Korea, Republic of", "France", "Malaysia" ], "malware_families": [ { "id": "Qbot", "display_name": "Qbot", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 39, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2161, "FileHash-SHA1": 2073, "FileHash-SHA256": 7032, "domain": 3959, "hostname": 7581, "email": 22, "URL": 17579, "SSLCertFingerprint": 3, "CVE": 2 }, "indicator_count": 40412, "is_author": false, "is_subscribing": null, "subscriber_count": 234, "modified_text": "566 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d3264283628d23b8f28b9d", "name": "x.com - That's what friends are for!", "description": "Original pulses modified, unknown stealer, junk data stuffing sifted through. Careful notes have been taken regarding ultra significant pulses. I've done the best I can to analyze compare, compile from all record of original pulse. | Further analysis shows an effort to destroy quite a bit of pertinent evidence. | I consider the target, family and associates to be especially endangered. Target has become isolated from most people target associated with, mostly by force as not to spread the malicious vulnerabilities that ha e affected many.\nTarget & associated have been interacting with and work with \n, hiring (not everyone they know) those involved. | There has been significant modification and degradation of the origin of information collected. | Who can you report to if the perpetrator is the Law. | This has always been the reason. | Don't hire another hit. What's the point? To uphold a fake integrity as a legacy?", "modified": "2024-09-30T10:01:49.889000", "created": "2024-08-31T14:18:42.621000", "tags": [ "referrer", "historical ssl", "united", "as13414 twitter", "nxdomain", "whitelisted", "cname", "a nxdomain", "status", "aaaa", "as15133 verizon", "search", "date", "twitter", "spoofed", "qbot qakbot", "qbot", "information", "t1027", "files", "t1036", "t1041", "c2 channel", "t1056", "capture", "t1057", "discovery", "memcommit", "process32nextw", "regsetvalueexa", "regdword", "module load", "t1129", "show", "intel", "ms windows", "trojan", "copy", "write", "win64", "next", "url https", "qbot type", "indicator role", "title added", "active related", "pulses url", "url http", "showing", "entries", "msie", "windows nt", "formsecnen", "read", "read c", "russia as48848", "qmount", "unknown", "pecompact", "malware", "role title", "added active", "related pulses", "type indicator", "as44273 host", "name servers", "as47846", "germany unknown", "443 ma2592000", "scan endpoints", "passive dns", "urls", "creation date", "all scoreblue", "hostname", "filehashsha256", "filehashsha1", "filehashmd5", "months ago", "ipv4", "report spam", "tinynote", "cobalt strike", "ransomexx", "quackbot", "comspec", "prefetch8", "pattern match", "prefetch1", "mitre att", "ck id", "show technique", "ck matrix", "null", "path", "hybrid", "general", "click", "strings", "langchinese", "icmp traffic", "pe resource", "pe section", "companyname gm", "win32", "push", "fakedout threat", "analyzer paste", "iocs", "hostnames", "urls https", "overview ip", "address", "related nids", "files hostname", "files domain", "files related", "pulses none", "related tags", "virustotal", "china unknown", "as4837 china", "redacted for", "as4835 china", "douglas county", "co sheriff", "office", "pegasus attacks", "sa victim", "cve type", "cve cve20170147", "no expiration", "expiration", "domain", "create new", "subsys00000000", "as16625 akamai", "as20940", "as39960", "as6762 telecom", "united kingdom", "emails", "span", "created", "white", "formatpng feb", "refererparam", "classid1", "login0", "typeid1", "style1", "dynamicloader", "high", "yara rule", "neshta", "neshta virus", "myapp", "ids detections", "yara detections", "alerts", "worm", "delphi", "ip address", "files location", "china flag", "china domain", "pulses otx", "pulses", "as45102 alibaba", "japan unknown", "as32934", "as19679 dropbox", "pulse pulses", "google safe", "browsing", "hosting", "body", "as7018 att", "verdict vpn", "as9009 m247", "canada unknown", "as174 cogent", "israel unknown", "as12310", "romania unknown", "as48945", "as64286", "b3viles0 feb", "modified", "siteid290", "org7", "novno jan", "siteid289", "org4", "org9", "locuo", "siteid969", "https", "http", "rims https", "evader", "message", "jeffrey scott", "reimer dpt", "pegasus", "pinterest", "amadey", "quasar rat", "eternalblue", "service", "sahil", "andcustomer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Germany", "Netherlands", "Italy", "United Kingdom of Great Britain and Northern Ireland", "Japan", "Korea, Republic of", "France", "Malaysia" ], "malware_families": [ { "id": "Qbot", "display_name": "Qbot", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2161, "FileHash-SHA1": 2073, "FileHash-SHA256": 7032, "domain": 3959, "hostname": 7581, "email": 22, "URL": 17579, "SSLCertFingerprint": 3, "CVE": 2 }, "indicator_count": 40412, "is_author": false, "is_subscribing": null, "subscriber_count": 233, "modified_text": "566 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65aa168aeddea4851fc47cc3", "name": "Zerobot & Skynet", "description": "Zerobot is a new botnet written in the Go programming language. It communicates via the WebSocket protocol", "modified": "2024-03-23T01:01:38.014000", "created": "2024-01-19T06:28:26.343000", "tags": [ "ssl certificate", "whois record", "referrer", "historical ssl", "resolutions", "whois whois", "communicating", "subdomains", "contacted", "c1on", "cmdwget http", "metro", "zerobot", "execution", "skynet", "june" ], "references": [ "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ZeroBot", "display_name": "ZeroBot", "target": null }, { "id": "Skynet", "display_name": "Skynet", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 78, "FileHash-SHA1": 78, "FileHash-SHA256": 2290, "domain": 1491, "hostname": 2611, "URL": 5879, "CVE": 8 }, "indicator_count": 12435, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "757 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65be8f1e5db08cf140cdea23", "name": "TinyNote | Douglas County, Co Sheriff's Office | Pegasus Attacks SA victim ", "description": "", "modified": "2024-02-03T19:08:14.934000", "created": "2024-02-03T19:08:14.934000", "tags": [ "june", "whois record", "ssl certificate", "threat roundup", "september", "roundup", "problems", "threat network", "drive", "march", "february", "startpage", "installer", "cobalt strike", "cobaltstrike", "whois whois", "referrer", "malicious", "quackbot", "tinynote", "contacted", "hacktool", "ransomexx", "name verdict", "falcon sandbox", "ioc search", "new ioc", "teams api", "contact", "threat analyzer", "threat", "paste", "iocs", "getprocaddress", "prefetch8", "mitre att", "ck id", "show technique", "ck matrix", "indicator", "file", "observed email", "united", "null", "path", "date", "twitter", "factory", "hybrid", "general", "model", "comspec", "click", "strings", "tsara brashears", "corruption", "sherrif", "douglas county", "framing", "hacking", "tracking", "infostealer", "porn", "critical", "danger", "spurlock" ], "references": [ "https://twitter.com/sheriffspurlock?lang=en", "https://hybrid-analysis.com/sample/a728fc352e13fa39c7490ddcfff86b0919b3de6ea5786cf48b22095e0607bde9/6593b386f70b45c7c70419c8", "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "nr-data.net", "https://ww11.0123movie.net/icons/apple-touch-icon.png", "https://ww9.0123movie.net/icons/apple-touch-icon.png", "apple-identifiant.info", "cs001.informativeremail-apple.zoom.com.cn", "0-i-0.xyz", "0-courier.push.apple.com", "https://www.anyxxxtube.net/media/favicon/apple", "message.htm.com", "joebiden.com", "familyhandyman.com", "deadlineday.twitter.com", "https://autodiscover.socket.net/Autodiscover/DEADJOE", "http://watchhers.net/index.php", "69.197.153.180", "This is all too strange! Corruption or Spoofed?", "quackbot? Qbot qakbot positive" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TinyNote", "display_name": "TinyNote", "target": null }, { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null }, { "id": "RansomEXX", "display_name": "RansomEXX", "target": null }, { "id": "QuackBot", "display_name": "QuackBot", "target": null }, { "id": "Comspec", "display_name": "Comspec", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" } ], "industries": [], "TLP": "white", "cloned_from": "65b85d301a253bd67048cbba", "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7190, "FileHash-MD5": 157, "FileHash-SHA1": 116, "FileHash-SHA256": 2281, "domain": 2139, "hostname": 2485, "CVE": 2, "SSLCertFingerprint": 2 }, "indicator_count": 14372, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "805 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65b85d301a253bd67048cbba", "name": "TinyNote | Douglas County, Co Sheriff's Office | Pegasus Attacks SA victim ", "description": "", "modified": "2024-02-01T07:00:20.140000", "created": "2024-01-30T02:21:36.334000", "tags": [ "june", "whois record", "ssl certificate", "threat roundup", "september", "roundup", "problems", "threat network", "drive", "march", "february", "startpage", "installer", "cobalt strike", "cobaltstrike", "whois whois", "referrer", "malicious", "quackbot", "tinynote", "contacted", "hacktool", "ransomexx", "name verdict", "falcon sandbox", "ioc search", "new ioc", "teams api", "contact", "threat analyzer", "threat", "paste", "iocs", "getprocaddress", "prefetch8", "mitre att", "ck id", "show technique", "ck matrix", "indicator", "file", "observed email", "united", "null", "path", "date", "twitter", "factory", "hybrid", "general", "model", "comspec", "click", "strings", "tsara brashears", "corruption", "sherrif", "douglas county", "framing", "hacking", "tracking", "infostealer", "porn", "critical", "danger", "spurlock" ], "references": [ "https://twitter.com/sheriffspurlock?lang=en", "https://hybrid-analysis.com/sample/a728fc352e13fa39c7490ddcfff86b0919b3de6ea5786cf48b22095e0607bde9/6593b386f70b45c7c70419c8", "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "nr-data.net", "https://ww11.0123movie.net/icons/apple-touch-icon.png", "https://ww9.0123movie.net/icons/apple-touch-icon.png", "apple-identifiant.info", "cs001.informativeremail-apple.zoom.com.cn", "0-i-0.xyz", "0-courier.push.apple.com", "https://www.anyxxxtube.net/media/favicon/apple", "message.htm.com", "joebiden.com", "familyhandyman.com", "deadlineday.twitter.com", "https://autodiscover.socket.net/Autodiscover/DEADJOE", "http://watchhers.net/index.php", "69.197.153.180", "This is all too strange! Corruption or Spoofed?", "quackbot? Qbot qakbot positive" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TinyNote", "display_name": "TinyNote", "target": null }, { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null }, { "id": "RansomEXX", "display_name": "RansomEXX", "target": null }, { "id": "QuackBot", "display_name": "QuackBot", "target": null }, { "id": "Comspec", "display_name": "Comspec", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" } ], "industries": [], "TLP": "white", "cloned_from": "65a2e3ebbb1bdfd541af3e91", "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7190, "FileHash-MD5": 157, "FileHash-SHA1": 116, "FileHash-SHA256": 2281, "domain": 2139, "hostname": 2485, "CVE": 2, "SSLCertFingerprint": 2 }, "indicator_count": 14372, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "808 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65a2e3ebbb1bdfd541af3e91", "name": "TinyNote | Douglas County, Colorado Sheriff's Office?", "description": "", "modified": "2024-02-01T07:00:20.140000", "created": "2024-01-13T19:26:35.621000", "tags": [ "june", "whois record", "ssl certificate", "threat roundup", "september", "roundup", "problems", "threat network", "drive", "march", "february", "startpage", "installer", "cobalt strike", "cobaltstrike", "whois whois", "referrer", "malicious", "quackbot", "tinynote", "contacted", "hacktool", "ransomexx", "name verdict", "falcon sandbox", "ioc search", "new ioc", "teams api", "contact", "threat analyzer", "threat", "paste", "iocs", "getprocaddress", "prefetch8", "mitre att", "ck id", "show technique", "ck matrix", "indicator", "file", "observed email", "united", "null", "path", "date", "twitter", "factory", "hybrid", "general", "model", "comspec", "click", "strings", "tsara brashears", "corruption", "sherrif", "douglas county", "framing", "hacking", "tracking", "infostealer", "porn", "critical", "danger", "spurlock" ], "references": [ "https://twitter.com/sheriffspurlock?lang=en", "https://hybrid-analysis.com/sample/a728fc352e13fa39c7490ddcfff86b0919b3de6ea5786cf48b22095e0607bde9/6593b386f70b45c7c70419c8", "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "nr-data.net", "https://ww11.0123movie.net/icons/apple-touch-icon.png", "https://ww9.0123movie.net/icons/apple-touch-icon.png", "apple-identifiant.info", "cs001.informativeremail-apple.zoom.com.cn", "0-i-0.xyz", "0-courier.push.apple.com", "https://www.anyxxxtube.net/media/favicon/apple", "message.htm.com", "joebiden.com", "familyhandyman.com", "deadlineday.twitter.com", "https://autodiscover.socket.net/Autodiscover/DEADJOE", "http://watchhers.net/index.php", "69.197.153.180", "This is all too strange! Corruption or Spoofed?", "quackbot? Qbot qakbot positive" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TinyNote", "display_name": "TinyNote", "target": null }, { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null }, { "id": "RansomEXX", "display_name": "RansomEXX", "target": null }, { "id": "QuackBot", "display_name": "QuackBot", "target": null }, { "id": "Comspec", "display_name": "Comspec", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" } ], "industries": [], "TLP": "white", "cloned_from": "6593c7224a0e8926c28f73d5", "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7190, "FileHash-MD5": 157, "FileHash-SHA1": 116, "FileHash-SHA256": 2281, "domain": 2139, "hostname": 2485, "CVE": 2, "SSLCertFingerprint": 2 }, "indicator_count": 14372, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "808 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6593c7224a0e8926c28f73d5", "name": "TinyNote | Douglas County, Colorado Sheriff's Office?", "description": "Sent to me by D*n*i* M. P*r**h. I can't comprehend. Looks like framing and cyber tracking pf a SA victim by a sheriff best friend of reporting doctor whose wife is Douglas Co coroner. Reporting MD threatened and warned Brashears of what would happen then warned SA PT by relating issues. Targets and associated as severe risk.", "modified": "2024-02-01T07:00:20.140000", "created": "2024-01-02T08:19:45.693000", "tags": [ "june", "whois record", "ssl certificate", "threat roundup", "september", "roundup", "problems", "threat network", "drive", "march", "february", "startpage", "installer", "cobalt strike", "cobaltstrike", "whois whois", "referrer", "malicious", "quackbot", "tinynote", "contacted", "hacktool", "ransomexx", "name verdict", "falcon sandbox", "ioc search", "new ioc", "teams api", "contact", "threat analyzer", "threat", "paste", "iocs", "getprocaddress", "prefetch8", "mitre att", "ck id", "show technique", "ck matrix", "indicator", "file", "observed email", "united", "null", "path", "date", "twitter", "factory", "hybrid", "general", "model", "comspec", "click", "strings", "tsara brashears", "corruption", "sherrif", "douglas county", "framing", "hacking", "tracking", "infostealer", "porn", "critical", "danger", "spurlock" ], "references": [ "https://twitter.com/sheriffspurlock?lang=en", "https://hybrid-analysis.com/sample/a728fc352e13fa39c7490ddcfff86b0919b3de6ea5786cf48b22095e0607bde9/6593b386f70b45c7c70419c8", "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "nr-data.net", "https://ww11.0123movie.net/icons/apple-touch-icon.png", "https://ww9.0123movie.net/icons/apple-touch-icon.png", "apple-identifiant.info", "cs001.informativeremail-apple.zoom.com.cn", "0-i-0.xyz", "0-courier.push.apple.com", "https://www.anyxxxtube.net/media/favicon/apple", "message.htm.com", "joebiden.com", "familyhandyman.com", "deadlineday.twitter.com", "https://autodiscover.socket.net/Autodiscover/DEADJOE", "http://watchhers.net/index.php", "69.197.153.180", "This is all too strange! Corruption or Spoofed?", "quackbot? Qbot qakbot positive" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TinyNote", "display_name": "TinyNote", "target": null }, { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null }, { "id": "RansomEXX", "display_name": "RansomEXX", "target": null }, { "id": "QuackBot", "display_name": "QuackBot", "target": null }, { "id": "Comspec", "display_name": "Comspec", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7190, "FileHash-MD5": 157, "FileHash-SHA1": 116, "FileHash-SHA256": 2281, "domain": 2139, "hostname": 2485, "CVE": 2, "SSLCertFingerprint": 2 }, "indicator_count": 14372, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "808 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6590f9011e57040b2717c99c", "name": "https://neca.omeclk.com/portal/wts/uc^cn^ejkaejsaBeyk7-^Oa", "description": "", "modified": "2023-12-31T05:15:45.262000", "created": "2023-12-31T05:15:45.262000", "tags": [ "ssl certificate", "threat roundup", "contacted", "execution", "august", "march", "whois record", "contacted urls", "malware", "copy", "april", "crypto", "alive", "malicious", "ducktail", "ransomware", "dead", "skynet", "chinese", "october", "roundup", "february", "goldfinder", "sibot", "hacktool", "metro", "goldmax", "installer", "awful", "open", "android", "banker", "keylogger", "united", "maltiverse", "mail spammer", "phishing site", "cyber threat", "engineering", "emotet", "phishing", "spammer", "firehol", "bank", "azorult", "team", "mirai", "pony", "nanocore", "bradesco", "cobalt strike", "installcore", "nymaim", "suppobox", "download", "looquer", "domains", "cisco umbrella", "site", "heur", "alexa top", "million", "safe site", "adware", "malware site", "malicious site", "artemis", "opencandy", "riskware", "tofsee", "gandcrab", "trojanx", "trojan", "generic", "bankerx", "service", "runescape", "facebook", "exploit", "agent", "mimikatz", "unsafe", "alexa", "union", "webtoolbar", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist https", "dsp1", "noname057", "tag count", "sample", "samples", "blacklist", "tsara brashears", "alohatube", "trojan", "scanning_host", "Botnet", "malvertizing", "abuse", "cyber stalking", "defacement", "adult content", "threats", "silencing", "harassment", "target", "aig", "workers compensation", "severe", "attack", "hacking", "yixun tool", "spyware", "malware", "evasion", "malicious", "private investigator", "legal entities", "insurance company", "remote attack", "colorado", "tulach", "Attack origin: United States", "apple", "ios", "victim", "allegations", "assault", "revenge", "retaliation", "libel", "monitoring", "tracking", "pegatech", "bam.nr-data.net", "bam", "nr-data.net", "matrix", "data.net", "asp.net", "apple private data collection", "norad.mil", "norad tracker", "b.scope", "command_and_control", "pornhub", "alohatube", "sweetheart videos", "users voice", "interfacing", "social engineering", "BankerX", "law enforcement aware, complacent or complicit?", "NSA tool Tulach malaware", "metro tmobile", "AS 10975 (NET-AIG) US", "record type", "ttl value", "algorithm", "data", "v3 serial", "number", "cus ou", "entrust", "oentrust", "l1k validity", "cus stnew", "group", "info", "domain status", "server", "date", "registrar abuse", "new york", "postal code", "contact phone", "registrar url", "csc corporate", "code", "microsoft", "win32 exe", "files", "detections type", "name", "confed", "network", "label netaig", "registry arin", "country us", "continent na", "whois lookup", "no match", "google", "dns replication", "domain", "type name", "pine street", "whois database", "email", "registrar iana", "icann whois", "contact", "form", "tech", "iana id", "tech email", "admin country", "CVE-2017-0147", "CVE-2018-0802", "CVE-2017-17215", "CVE-2016-7255", "CVE-2017-11882", "CVE-2017-8570" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Singapore" ], "malware_families": [ { "id": "Chinese", "display_name": "Chinese", "target": null }, { "id": "Looquer", "display_name": "Looquer", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Mimikatz", "display_name": "Mimikatz", "target": null }, { "id": "HiddenTear", "display_name": "HiddenTear", "target": null }, { "id": "Neurovt", "display_name": "Neurovt", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "TrojanX", "display_name": "TrojanX", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Nymaim", "display_name": "Nymaim", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Trojan:Win32/InstallCore", "display_name": "Trojan:Win32/InstallCore", "target": "/malware/Trojan:Win32/InstallCore" }, { "id": "Yixun", "display_name": "Yixun", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax - S0588", "display_name": "GoldMax - S0588", "target": null }, { "id": "DUCKTAIL", "display_name": "DUCKTAIL", "target": null }, { "id": "Artemis", "display_name": "Artemis", "target": null }, { "id": "GandCrab", "display_name": "GandCrab", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "BlackNET", "display_name": "BlackNET", "target": null }, { "id": "Raccoon Stealer", "display_name": "Raccoon Stealer", "target": null }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "OpenCandy", "display_name": "OpenCandy", "target": null }, { "id": "FireHOL", "display_name": "FireHOL", "target": null }, { "id": "HackTool.BruteForce", "display_name": "HackTool.BruteForce", "target": null }, { "id": "HackTool.CheatEngine", "display_name": "HackTool.CheatEngine", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "NanoCore", "display_name": "NanoCore", "target": null }, { "id": "Immortal Stealer", "display_name": "Immortal Stealer", "target": null }, { "id": "WebToolBar", "display_name": "WebToolBar", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1497.002", "name": "User Activity Based Checks", "display_name": "T1497.002 - User Activity Based Checks" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0001", "name": "Initial Access", "display_name": "TA0001 - Initial Access" }, { "id": "T1523", "name": "Evade Analysis Environment", "display_name": "T1523 - Evade Analysis Environment" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1453", "name": "Abuse Accessibility Features", "display_name": "T1453 - Abuse Accessibility Features" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1415", "name": "URL Scheme Hijacking", "display_name": "T1415 - URL Scheme Hijacking" }, { "id": "T1184", "name": "SSH Hijacking", "display_name": "T1184 - SSH Hijacking" }, { "id": "T1134.001", "name": "Token Impersonation/Theft", "display_name": "T1134.001 - Token Impersonation/Theft" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1114.002", "name": "Remote Email Collection", "display_name": "T1114.002 - Remote Email Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "6590f8f3b192d56e80294c13", "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5239, "FileHash-MD5": 929, "FileHash-SHA1": 500, "FileHash-SHA256": 3566, "domain": 1230, "hostname": 2051, "CVE": 6, "email": 5, "CIDR": 1 }, "indicator_count": 13527, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "840 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6590f8f3b192d56e80294c13", "name": "Aig.com Pegasus attack+ https://neca.omeclk.com/portal/wts/uc^cn^ejkaejsaBeyk7-^Oa", "description": "", "modified": "2023-12-31T05:15:31.645000", "created": "2023-12-31T05:15:31.645000", "tags": [ "ssl certificate", "threat roundup", "contacted", "execution", "august", "march", "whois record", "contacted urls", "malware", "copy", "april", "crypto", "alive", "malicious", "ducktail", "ransomware", "dead", "skynet", "chinese", "october", "roundup", "february", "goldfinder", "sibot", "hacktool", "metro", "goldmax", "installer", "awful", "open", "android", "banker", "keylogger", "united", "maltiverse", "mail spammer", "phishing site", "cyber threat", "engineering", "emotet", "phishing", "spammer", "firehol", "bank", "azorult", "team", "mirai", "pony", "nanocore", "bradesco", "cobalt strike", "installcore", "nymaim", "suppobox", "download", "looquer", "domains", "cisco umbrella", "site", "heur", "alexa top", "million", "safe site", "adware", "malware site", "malicious site", "artemis", "opencandy", "riskware", "tofsee", "gandcrab", "trojanx", "trojan", "generic", "bankerx", "service", "runescape", "facebook", "exploit", "agent", "mimikatz", "unsafe", "alexa", "union", "webtoolbar", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist https", "dsp1", "noname057", "tag count", "sample", "samples", "blacklist", "tsara brashears", "alohatube", "trojan", "scanning_host", "Botnet", "malvertizing", "abuse", "cyber stalking", "defacement", "adult content", "threats", "silencing", "harassment", "target", "aig", "workers compensation", "severe", "attack", "hacking", "yixun tool", "spyware", "malware", "evasion", "malicious", "private investigator", "legal entities", "insurance company", "remote attack", "colorado", "tulach", "Attack origin: United States", "apple", "ios", "victim", "allegations", "assault", "revenge", "retaliation", "libel", "monitoring", "tracking", "pegatech", "bam.nr-data.net", "bam", "nr-data.net", "matrix", "data.net", "asp.net", "apple private data collection", "norad.mil", "norad tracker", "b.scope", "command_and_control", "pornhub", "alohatube", "sweetheart videos", "users voice", "interfacing", "social engineering", "BankerX", "law enforcement aware, complacent or complicit?", "NSA tool Tulach malaware", "metro tmobile", "AS 10975 (NET-AIG) US", "record type", "ttl value", "algorithm", "data", "v3 serial", "number", "cus ou", "entrust", "oentrust", "l1k validity", "cus stnew", "group", "info", "domain status", "server", "date", "registrar abuse", "new york", "postal code", "contact phone", "registrar url", "csc corporate", "code", "microsoft", "win32 exe", "files", "detections type", "name", "confed", "network", "label netaig", "registry arin", "country us", "continent na", "whois lookup", "no match", "google", "dns replication", "domain", "type name", "pine street", "whois database", "email", "registrar iana", "icann whois", "contact", "form", "tech", "iana id", "tech email", "admin country", "CVE-2017-0147", "CVE-2018-0802", "CVE-2017-17215", "CVE-2016-7255", "CVE-2017-11882", "CVE-2017-8570" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Singapore" ], "malware_families": [ { "id": "Chinese", "display_name": "Chinese", "target": null }, { "id": "Looquer", "display_name": "Looquer", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Mimikatz", "display_name": "Mimikatz", "target": null }, { "id": "HiddenTear", "display_name": "HiddenTear", "target": null }, { "id": "Neurovt", "display_name": "Neurovt", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "TrojanX", "display_name": "TrojanX", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Nymaim", "display_name": "Nymaim", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Trojan:Win32/InstallCore", "display_name": "Trojan:Win32/InstallCore", "target": "/malware/Trojan:Win32/InstallCore" }, { "id": "Yixun", "display_name": "Yixun", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax - S0588", "display_name": "GoldMax - S0588", "target": null }, { "id": "DUCKTAIL", "display_name": "DUCKTAIL", "target": null }, { "id": "Artemis", "display_name": "Artemis", "target": null }, { "id": "GandCrab", "display_name": "GandCrab", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "BlackNET", "display_name": "BlackNET", "target": null }, { "id": "Raccoon Stealer", "display_name": "Raccoon Stealer", "target": null }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "OpenCandy", "display_name": "OpenCandy", "target": null }, { "id": "FireHOL", "display_name": "FireHOL", "target": null }, { "id": "HackTool.BruteForce", "display_name": "HackTool.BruteForce", "target": null }, { "id": "HackTool.CheatEngine", "display_name": "HackTool.CheatEngine", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "NanoCore", "display_name": "NanoCore", "target": null }, { "id": "Immortal Stealer", "display_name": "Immortal Stealer", "target": null }, { "id": "WebToolBar", "display_name": "WebToolBar", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1497.002", "name": "User Activity Based Checks", "display_name": "T1497.002 - User Activity Based Checks" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0001", "name": "Initial Access", "display_name": "TA0001 - Initial Access" }, { "id": "T1523", "name": "Evade Analysis Environment", "display_name": "T1523 - Evade Analysis Environment" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1453", "name": "Abuse Accessibility Features", "display_name": "T1453 - Abuse Accessibility Features" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1415", "name": "URL Scheme Hijacking", "display_name": "T1415 - URL Scheme Hijacking" }, { "id": "T1184", "name": "SSH Hijacking", "display_name": "T1184 - SSH Hijacking" }, { "id": "T1134.001", "name": "Token Impersonation/Theft", "display_name": "T1134.001 - Token Impersonation/Theft" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1114.002", "name": "Remote Email Collection", "display_name": "T1114.002 - Remote Email Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "653f21878bcd05f7d594ff86", "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5239, "FileHash-MD5": 929, "FileHash-SHA1": 500, "FileHash-SHA256": 3566, "domain": 1230, "hostname": 2051, "CVE": 6, "email": 5, "CIDR": 1 }, "indicator_count": 13527, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "840 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6558c481715409563073cb79", "name": "Fraud Services", "description": "http://kramtechnology.com/, fraud services, network, rat, trojan, phishing, malvertizing, malware hosting, scanning host, archives browser events.", "modified": "2023-12-18T05:05:36.760000", "created": "2023-11-18T14:04:48.923000", "tags": [ "methodpost", "dropped", "contacted", "ssl certificate", "whois record", "zva8k4ghshhpcb5", "contacted urls", "q0gpyr1balpdgpo", "historical ssl", "page dow", "blacklist http", "cisco umbrella", "site", "alexa top", "safe site", "million", "paypal", "team phishing", "malicious url", "alexa", "azorult", "phishing", "service", "runescape", "facebook", "bank", "download", "malware", "united", "passive dns", "scan endpoints", "all search", "otx octoseek", "ipv4", "pulse pulses", "urls", "files", "reverse dns", "twitter", "log id", "gmtn", "sectigo rsa", "secure server", "tls web", "salford", "sectigo limited", "ocsp", "false", "california", "british virgin", "locality", "d3 a5", "url http" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 14816, "FileHash-MD5": 41, "FileHash-SHA1": 33, "FileHash-SHA256": 5158, "domain": 3758, "hostname": 2961, "email": 4, "SSLCertFingerprint": 3, "CVE": 3 }, "indicator_count": 26777, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "853 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65463631b46319b3aa1d071f", "name": "Qausar RAT - aig.com |", "description": "Compilation of research identifilocates aig.com Defense Division of Workers Compensation. \nMalicious & invasive tactics remain. Target seem to have been removed from, revenge porn campaign targeted name no longer auto populates, registrant seems poised for campaign.\nTactics include phishing, tracking, geotracking, device location, monitoring, side loading apps and remote access. \n\nQausar Rat identified:\nAlso known by the names CinaRAT or Yggdrasil, Quasar RAT is a C#-based remote administration tool capable of gathering system information, a list of running applications, files, keystrokes, screenshots, and executing arbitrary shell commands.", "modified": "2023-12-04T11:01:36.202000", "created": "2023-11-04T12:16:49.600000", "tags": [ "general full", "url https", "reverse dns", "security tls", "protocol h2", "name value", "resource", "united", "asn16509", "amazon02", "main", "facebook", "http", "request chain", "november", "de page", "url history", "javascript", "meta", "page url", "redirected", "http redirect", "value", "mime type", "variables", "contexthub", "visitor object", "cq function", "sanitize object", "elqq", "domainpath name", "link", "property", "workers", "compensation", "login myaig", "liability", "contact", "a claim", "commercial auto", "login aig", "form", "cyber", "find", "team", "defense", "crime", "ransom", "energy", "cargo", "life", "media", "enterprise", "american international", "frankfurt", "germany", "october", "domains", "asn20940", "cisco", "umbrella rank", "domain", "de summary", "ssl certificate", "whois record", "whois whois", "malware", "network mooooda", "and china", "filter https", "dsp1", "keepaliveyes", "p11642963562", "quasar", "metro", "android", "djvu", "win32 exe", "win32 dll", "ms excel", "dao360", "spreadsheet", "files", "detections type", "name", "phishing", "tulach exploits", "falcon sandbox", "pattern match", "file", "script", "indicator", "et tor", "known tor", "relayrouter", "exit", "node traffic", "misc attack", "date", "unknown", "body", "error", "span", "class", "generator", "critical", "refresh", "open", "hybrid", "general", "local", "click", "strings", "tools", "look", "verify", "restart", "suricata" ], "references": [ "aig.com", "https://urlscan.io", "https://www.slatergordon.com.au/blog/revenge-porn-laws", "https://thehackernews.com/2023/10/quasar-rat-leverages-dll-side-loading.html?m=1", "https://hybrid-analysis.com/sample/6f4fb33ffb44474e86928549ef3f1a51d0f3e9e8c8d7a08b71b2b59b5921d311", "remoteaccess.aig.com", "https://remote.goeaston.net", "window.location.search", "location.search", "https://s3.rexdl.com/android/game/Desktop-Dungeons-v11-Mod-www.Rexdl.com.apk", "ghb-unoadsrv-com.geodns.me.1.1.11cec3ef.roksit.net", "m.pornsexer.xxx.3.1.adiosfil.roksit.net", "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/" ], "public": 1, "adversary": "American International", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [ { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "American International", "display_name": "American International", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [ "Reinsurance", "Travel" ], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 117, "FileHash-SHA256": 1962, "domain": 575, "hostname": 1623, "FileHash-MD5": 123, "URL": 3670, "CVE": 2 }, "indicator_count": 8072, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "867 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6544cbbca7610e92e4262c47", "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Targeting", "description": "", "modified": "2023-11-29T14:03:31.663000", "created": "2023-11-03T10:30:20.965000", "tags": [ "ssl certificate", "whois record", "contacted", "referrer", "communicating", "resolutions", "historical ssl", "whois whois", "http", "critical risk", "dark power", "cobalt strike", "malware", "core", "critical", "copy", "formbook", "submission", "sophos sophos", "xcitium verdict", "cloud xcitium", "verdict cloud", "history first", "analysis", "utc http", "response final", "url https", "march", "execution", "falcon sandbox", "pattern match", "changelog", "header", "layer", "data", "ipv4", "function", "file", "et tor", "known tor", "meta", "monitoring", "date", "body", "form", "august", "june", "friendly", "main", "footer", "unknown", "hybrid", "general", "click", "strings", "class", "generator", "error", "pe resource", "redline stealer", "april", "lockbit", "emotet", "hacktool", "apple", "tsara brashears", "tmobile", "pyinstaller", "password", "dns poisoning", "domains", "abuse", "kiannas law", "cyber security", "cisco umbrella", "site", "malware site", "malicious site", "safe site", "alexa top", "million", "phishing site", "team phishing", "exploit", "download", "unruy", "alexa", "riskware", "back", "azorult", "phishing", "service", "runescape", "facebook", "bank", "team", "cutwail", "adload", "maltiverse", "kryptik", "united", "cyber threat", "engineering", "bambernek", "strike", "zbot", "suppobox", "malicious", "ransomware", "virut", "bandoo", "matsnu", "iframe", "zeus", "agent", "steam", "nymaim", "citadel", "heur", "covid19", "simda", "artemis", "bradesco", "pony", "pykspa", "sodinokibi", "betabot", "virustotal", "tinba", "domaiq", "ave maria", "revil", "downloader", "tofsee", "vawtrak", "hotmail", "dnspionage", "nexus", "generic", "andromeda", "dropper", "crypt", "outbreak", "wacatac", "mimikatz", "trojanx", "astaroth", "keybase", "stealer", "radamant", "kovter", "unsafe", "win64", "conduit", "presenoker", "opencandy", "remcos", "miner", "agenttesla", "trojan", "detplock", "networm", "fusioncore", "acint", "installpack", "xtrat", "nircmd", "psexec", "occamy", "brontok", "zpevdo", "startpage", "nanocore", "keygen", "fareit", "secrisk", "fakealert", "filetour", "installcore", "floxif", "cleaner", "patcher", "kgs0", "kls0", "threat report", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist http", "samples", "blacklist" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Kryptik", "display_name": "Kryptik", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" } ], "industries": [ "Health" ], "TLP": "green", "cloned_from": "654140bae73f795aa914e8de", "export_count": 108, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 518, "FileHash-SHA1": 507, "FileHash-SHA256": 10945, "URL": 19764, "domain": 5110, "hostname": 8668, "CIDR": 2, "CVE": 24 }, "indicator_count": 45538, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "872 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654140bae73f795aa914e8de", "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Target Tsara Brashears", "description": "", "modified": "2023-11-29T14:03:31.663000", "created": "2023-10-31T18:00:26.439000", "tags": [ "ssl certificate", "whois record", "contacted", "referrer", "communicating", "resolutions", "historical ssl", "whois whois", "http", "critical risk", "dark power", "cobalt strike", "malware", "core", "critical", "copy", "formbook", "submission", "sophos sophos", "xcitium verdict", "cloud xcitium", "verdict cloud", "history first", "analysis", "utc http", "response final", "url https", "march", "execution", "falcon sandbox", "pattern match", "changelog", "header", "layer", "data", "ipv4", "function", "file", "et tor", "known tor", "meta", "monitoring", "date", "body", "form", "august", "june", "friendly", "main", "footer", "unknown", "hybrid", "general", "click", "strings", "class", "generator", "error", "pe resource", "redline stealer", "april", "lockbit", "emotet", "hacktool", "apple", "tsara brashears", "tmobile", "pyinstaller", "password", "dns poisoning", "domains", "abuse", "kiannas law", "cyber security", "cisco umbrella", "site", "malware site", "malicious site", "safe site", "alexa top", "million", "phishing site", "team phishing", "exploit", "download", "unruy", "alexa", "riskware", "back", "azorult", "phishing", "service", "runescape", "facebook", "bank", "team", "cutwail", "adload", "maltiverse", "kryptik", "united", "cyber threat", "engineering", "bambernek", "strike", "zbot", "suppobox", "malicious", "ransomware", "virut", "bandoo", "matsnu", "iframe", "zeus", "agent", "steam", "nymaim", "citadel", "heur", "covid19", "simda", "artemis", "bradesco", "pony", "pykspa", "sodinokibi", "betabot", "virustotal", "tinba", "domaiq", "ave maria", "revil", "downloader", "tofsee", "vawtrak", "hotmail", "dnspionage", "nexus", "generic", "andromeda", "dropper", "crypt", "outbreak", "wacatac", "mimikatz", "trojanx", "astaroth", "keybase", "stealer", "radamant", "kovter", "unsafe", "win64", "conduit", "presenoker", "opencandy", "remcos", "miner", "agenttesla", "trojan", "detplock", "networm", "fusioncore", "acint", "installpack", "xtrat", "nircmd", "psexec", "occamy", "brontok", "zpevdo", "startpage", "nanocore", "keygen", "fareit", "secrisk", "fakealert", "filetour", "installcore", "floxif", "cleaner", "patcher", "kgs0", "kls0", "threat report", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist http", "samples", "blacklist" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Kryptik", "display_name": "Kryptik", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" } ], "industries": [ "Health" ], "TLP": "green", "cloned_from": "65401d73e96dd70037ed22a7", "export_count": 98, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 518, "FileHash-SHA1": 507, "FileHash-SHA256": 10945, "URL": 19764, "domain": 5110, "hostname": 8668, "CIDR": 2, "CVE": 24 }, "indicator_count": 45538, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "872 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65401d8480e4a9ed725f6458", "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Target Tsara Brashears", "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org. I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of domain after being a verified AIG domain. Terrifying. Looks like the main target is the same. Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]", "modified": "2023-11-29T14:03:31.663000", "created": "2023-10-30T21:17:56.820000", "tags": [ "ssl certificate", "whois record", "contacted", "referrer", "communicating", "resolutions", "historical ssl", "whois whois", "http", "critical risk", "dark power", "cobalt strike", "malware", "core", "critical", "copy", "formbook", "submission", "sophos sophos", "xcitium verdict", "cloud xcitium", "verdict cloud", "history first", "analysis", "utc http", "response final", "url https", "march", "execution", "falcon sandbox", "pattern match", "changelog", "header", "layer", "data", "ipv4", "function", "file", "et tor", "known tor", "meta", "monitoring", "date", "body", "form", "august", "june", "friendly", "main", "footer", "unknown", "hybrid", "general", "click", "strings", "class", "generator", "error", "pe resource", "redline stealer", "april", "lockbit", "emotet", "hacktool", "apple", "tsara brashears", "tmobile", "pyinstaller", "password", "dns poisoning", "domains", "abuse", "kiannas law", "cyber security", "cisco umbrella", "site", "malware site", "malicious site", "safe site", "alexa top", "million", "phishing site", "team phishing", "exploit", "download", "unruy", "alexa", "riskware", "back", "azorult", "phishing", "service", "runescape", "facebook", "bank", "team", "cutwail", "adload", "maltiverse", "kryptik", "united", "cyber threat", "engineering", "bambernek", "strike", "zbot", "suppobox", "malicious", "ransomware", "virut", "bandoo", "matsnu", "iframe", "zeus", "agent", "steam", "nymaim", "citadel", "heur", "covid19", "simda", "artemis", "bradesco", "pony", "pykspa", "sodinokibi", "betabot", "virustotal", "tinba", "domaiq", "ave maria", "revil", "downloader", "tofsee", "vawtrak", "hotmail", "dnspionage", "nexus", "generic", "andromeda", "dropper", "crypt", "outbreak", "wacatac", "mimikatz", "trojanx", "astaroth", "keybase", "stealer", "radamant", "kovter", "unsafe", "win64", "conduit", "presenoker", "opencandy", "remcos", "miner", "agenttesla", "trojan", "detplock", "networm", "fusioncore", "acint", "installpack", "xtrat", "nircmd", "psexec", "occamy", "brontok", "zpevdo", "startpage", "nanocore", "keygen", "fareit", "secrisk", "fakealert", "filetour", "installcore", "floxif", "cleaner", "patcher", "kgs0", "kls0", "threat report", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist http", "samples", "blacklist" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Kryptik", "display_name": "Kryptik", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" } ], "industries": [ "Health" ], "TLP": "green", "cloned_from": null, "export_count": 83, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 518, "FileHash-SHA1": 507, "FileHash-SHA256": 10945, "URL": 19764, "domain": 5110, "hostname": 8668, "CIDR": 2, "CVE": 24 }, "indicator_count": 45538, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "872 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65401d76b057b79aaf7ba4a7", "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Target Tsara Brashears", "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org. I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of domain after being a verified AIG domain. Terrifying. Looks like the main target is the same. Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]", "modified": "2023-11-29T14:03:31.663000", "created": "2023-10-30T21:17:40.239000", "tags": [ "ssl certificate", "whois record", "contacted", "referrer", "communicating", "resolutions", "historical ssl", "whois whois", "http", "critical risk", "dark power", "cobalt strike", "malware", "core", "critical", "copy", "formbook", "submission", "sophos sophos", "xcitium verdict", "cloud xcitium", "verdict cloud", "history first", "analysis", "utc http", "response final", "url https", "march", "execution", "falcon sandbox", "pattern match", "changelog", "header", "layer", "data", "ipv4", "function", "file", "et tor", "known tor", "meta", "monitoring", "date", "body", "form", "august", "june", "friendly", "main", "footer", "unknown", "hybrid", "general", "click", "strings", "class", "generator", "error", "pe resource", "redline stealer", "april", "lockbit", "emotet", "hacktool", "apple", "tsara brashears", "tmobile", "pyinstaller", "password", "dns poisoning", "domains", "abuse", "kiannas law", "cyber security", "cisco umbrella", "site", "malware site", "malicious site", "safe site", "alexa top", "million", "phishing site", "team phishing", "exploit", "download", "unruy", "alexa", "riskware", "back", "azorult", "phishing", "service", "runescape", "facebook", "bank", "team", "cutwail", "adload", "maltiverse", "kryptik", "united", "cyber threat", "engineering", "bambernek", "strike", "zbot", "suppobox", "malicious", "ransomware", "virut", "bandoo", "matsnu", "iframe", "zeus", "agent", "steam", "nymaim", "citadel", "heur", "covid19", "simda", "artemis", "bradesco", "pony", "pykspa", "sodinokibi", "betabot", "virustotal", "tinba", "domaiq", "ave maria", "revil", "downloader", "tofsee", "vawtrak", "hotmail", "dnspionage", "nexus", "generic", "andromeda", "dropper", "crypt", "outbreak", "wacatac", "mimikatz", "trojanx", "astaroth", "keybase", "stealer", "radamant", "kovter", "unsafe", "win64", "conduit", "presenoker", "opencandy", "remcos", "miner", "agenttesla", "trojan", "detplock", "networm", "fusioncore", "acint", "installpack", "xtrat", "nircmd", "psexec", "occamy", "brontok", "zpevdo", "startpage", "nanocore", "keygen", "fareit", "secrisk", "fakealert", "filetour", "installcore", "floxif", "cleaner", "patcher", "kgs0", "kls0", "threat report", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist http", "samples", "blacklist" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Kryptik", "display_name": "Kryptik", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" } ], "industries": [ "Health" ], "TLP": "green", "cloned_from": null, "export_count": 84, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 518, "FileHash-SHA1": 507, "FileHash-SHA256": 10945, "URL": 19764, "domain": 5110, "hostname": 8668, "CIDR": 2, "CVE": 24 }, "indicator_count": 45538, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "872 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65401d73e96dd70037ed22a7", "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Target Tsara Brashears", "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org. I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of domain after being a verified AIG domain. Terrifying. Looks like the main target is the same. Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]", "modified": "2023-11-29T14:03:31.663000", "created": "2023-10-30T21:17:39.802000", "tags": [ "ssl certificate", "whois record", "contacted", "referrer", "communicating", "resolutions", "historical ssl", "whois whois", "http", "critical risk", "dark power", "cobalt strike", "malware", "core", "critical", "copy", "formbook", "submission", "sophos sophos", "xcitium verdict", "cloud xcitium", "verdict cloud", "history first", "analysis", "utc http", "response final", "url https", "march", "execution", "falcon sandbox", "pattern match", "changelog", "header", "layer", "data", "ipv4", "function", "file", "et tor", "known tor", "meta", "monitoring", "date", "body", "form", "august", "june", "friendly", "main", "footer", "unknown", "hybrid", "general", "click", "strings", "class", "generator", "error", "pe resource", "redline stealer", "april", "lockbit", "emotet", "hacktool", "apple", "tsara brashears", "tmobile", "pyinstaller", "password", "dns poisoning", "domains", "abuse", "kiannas law", "cyber security", "cisco umbrella", "site", "malware site", "malicious site", "safe site", "alexa top", "million", "phishing site", "team phishing", "exploit", "download", "unruy", "alexa", "riskware", "back", "azorult", "phishing", "service", "runescape", "facebook", "bank", "team", "cutwail", "adload", "maltiverse", "kryptik", "united", "cyber threat", "engineering", "bambernek", "strike", "zbot", "suppobox", "malicious", "ransomware", "virut", "bandoo", "matsnu", "iframe", "zeus", "agent", "steam", "nymaim", "citadel", "heur", "covid19", "simda", "artemis", "bradesco", "pony", "pykspa", "sodinokibi", "betabot", "virustotal", "tinba", "domaiq", "ave maria", "revil", "downloader", "tofsee", "vawtrak", "hotmail", "dnspionage", "nexus", "generic", "andromeda", "dropper", "crypt", "outbreak", "wacatac", "mimikatz", "trojanx", "astaroth", "keybase", "stealer", "radamant", "kovter", "unsafe", "win64", "conduit", "presenoker", "opencandy", "remcos", "miner", "agenttesla", "trojan", "detplock", "networm", "fusioncore", "acint", "installpack", "xtrat", "nircmd", "psexec", "occamy", "brontok", "zpevdo", "startpage", "nanocore", "keygen", "fareit", "secrisk", "fakealert", "filetour", "installcore", "floxif", "cleaner", "patcher", "kgs0", "kls0", "threat report", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist http", "samples", "blacklist" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Kryptik", "display_name": "Kryptik", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" } ], "industries": [ "Health" ], "TLP": "green", "cloned_from": null, "export_count": 82, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 518, "FileHash-SHA1": 507, "FileHash-SHA256": 10945, "URL": 19764, "domain": 5110, "hostname": 8668, "CIDR": 2, "CVE": 24 }, "indicator_count": 45538, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "872 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65401d5ee5a7359a5e815a6a", "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Target Tsara Brashears", "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org. I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of domain after being a verified AIG domain. Terrifying. Looks like the main target is the same. Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]", "modified": "2023-11-29T14:03:31.663000", "created": "2023-10-30T21:17:18.712000", "tags": [ "ssl certificate", "whois record", "contacted", "referrer", "communicating", "resolutions", "historical ssl", "whois whois", "http", "critical risk", "dark power", "cobalt strike", "malware", "core", "critical", "copy", "formbook", "submission", "sophos sophos", "xcitium verdict", "cloud xcitium", "verdict cloud", "history first", "analysis", "utc http", "response final", "url https", "march", "execution", "falcon sandbox", "pattern match", "changelog", "header", "layer", "data", "ipv4", "function", "file", "et tor", "known tor", "meta", "monitoring", "date", "body", "form", "august", "june", "friendly", "main", "footer", "unknown", "hybrid", "general", "click", "strings", "class", "generator", "error", "pe resource", "redline stealer", "april", "lockbit", "emotet", "hacktool", "apple", "tsara brashears", "tmobile", "pyinstaller", "password", "dns poisoning", "domains", "abuse", "kiannas law", "cyber security", "cisco umbrella", "site", "malware site", "malicious site", "safe site", "alexa top", "million", "phishing site", "team phishing", "exploit", "download", "unruy", "alexa", "riskware", "back", "azorult", "phishing", "service", "runescape", "facebook", "bank", "team", "cutwail", "adload", "maltiverse", "kryptik", "united", "cyber threat", "engineering", "bambernek", "strike", "zbot", "suppobox", "malicious", "ransomware", "virut", "bandoo", "matsnu", "iframe", "zeus", "agent", "steam", "nymaim", "citadel", "heur", "covid19", "simda", "artemis", "bradesco", "pony", "pykspa", "sodinokibi", "betabot", "virustotal", "tinba", "domaiq", "ave maria", "revil", "downloader", "tofsee", "vawtrak", "hotmail", "dnspionage", "nexus", "generic", "andromeda", "dropper", "crypt", "outbreak", "wacatac", "mimikatz", "trojanx", "astaroth", "keybase", "stealer", "radamant", "kovter", "unsafe", "win64", "conduit", "presenoker", "opencandy", "remcos", "miner", "agenttesla", "trojan", "detplock", "networm", "fusioncore", "acint", "installpack", "xtrat", "nircmd", "psexec", "occamy", "brontok", "zpevdo", "startpage", "nanocore", "keygen", "fareit", "secrisk", "fakealert", "filetour", "installcore", "floxif", "cleaner", "patcher", "kgs0", "kls0", "threat report", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist http", "samples", "blacklist" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Kryptik", "display_name": "Kryptik", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" } ], "industries": [ "Health" ], "TLP": "green", "cloned_from": null, "export_count": 82, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 518, "FileHash-SHA1": 507, "FileHash-SHA256": 10945, "URL": 19764, "domain": 5110, "hostname": 8668, "CIDR": 2, "CVE": 24 }, "indicator_count": 45538, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "872 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653db044432cdee91e2f5d1c", "name": "AIG Hacked or Spoofed website?", "description": "Extremely strange & disturbing report. Disruption under Cisco Umbrella hack may be linked to a matrix of DGA insurance domains. AIG.com. Unclear validity. Spoof Domain, a tool AIG uses? Targets Tsara Brashears. Tulach unlikely a person more likely a profile accessed by entities. Rogue attornoes, etc. Large smear campaign wild cover up including death threats. Reports assert target's been harassed & harmed for years. Is this a cybercrime? Example of malicious tools deployed against innocents.\nMissing STSH\nVerdict: Concerning potential for physical harm to Target or associates\nWhy: Avoid lawsuit and press / reputation \nWho: ?\nIP: 167.230.100.44\nHost: am1mxi05.aig.com\nRegistrar: CSC CORPORATE DOMAINS, INC.\nCreation date: 28 years ago", "modified": "2023-11-27T23:02:02.229000", "created": "2023-10-29T01:07:16.410000", "tags": [ "ssl certificate", "threat roundup", "contacted", "execution", "august", "march", "whois record", "contacted urls", "malware", "copy", "april", "crypto", "alive", "malicious", "ducktail", "ransomware", "dead", "skynet", "chinese", "october", "roundup", "february", "goldfinder", "sibot", "hacktool", "metro", "goldmax", "installer", "awful", "open", "android", "banker", "keylogger", "united", "maltiverse", "mail spammer", "phishing site", "cyber threat", "engineering", "emotet", "phishing", "spammer", "firehol", "bank", "azorult", "team", "mirai", "pony", "nanocore", "bradesco", "cobalt strike", "installcore", "nymaim", "suppobox", "download", "looquer", "domains", "cisco umbrella", "site", "heur", "alexa top", "million", "safe site", "adware", "malware site", "malicious site", "artemis", "opencandy", "riskware", "tofsee", "gandcrab", "trojanx", "trojan", "generic", "bankerx", "service", "runescape", "facebook", "exploit", "agent", "mimikatz", "unsafe", "alexa", "union", "webtoolbar", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist https", "dsp1", "noname057", "tag count", "sample", "samples", "blacklist", "tsara brashears", "alohatube", "trojan", "scanning_host", "Botnet", "malvertizing", "abuse", "cyber stalking", "defacement", "adult content", "threats", "silencing", "harassment", "target", "aig", "workers compensation", "severe", "attack", "hacking", "yixun tool", "spyware", "malware", "evasion", "malicious", "private investigator", "legal entities", "insurance company", "remote attack", "colorado", "tulach", "Attack origin: United States", "apple", "ios", "victim", "allegations", "assault", "revenge", "retaliation", "libel", "monitoring", "tracking", "pegatech", "bam.nr-data.net", "bam", "nr-data.net", "matrix", "data.net", "asp.net", "apple private data collection", "norad.mil", "norad tracker", "b.scope", "command_and_control", "pornhub", "alohatube", "sweetheart videos", "users voice", "interfacing", "social engineering", "BankerX", "law enforcement aware, complacent or complicit?", "NSA tool Tulach malaware", "metro tmobile", "AS 10975 (NET-AIG) US", "record type", "ttl value", "algorithm", "data", "v3 serial", "number", "cus ou", "entrust", "oentrust", "l1k validity", "cus stnew", "group", "info", "domain status", "server", "date", "registrar abuse", "new york", "postal code", "contact phone", "registrar url", "csc corporate", "code", "microsoft", "win32 exe", "files", "detections type", "name", "confed", "network", "label netaig", "registry arin", "country us", "continent na", "whois lookup", "no match", "google", "dns replication", "domain", "type name", "pine street", "whois database", "email", "registrar iana", "icann whois", "contact", "form", "tech", "iana id", "tech email", "admin country", "CVE-2017-0147", "CVE-2018-0802", "CVE-2017-17215", "CVE-2016-7255", "CVE-2017-11882", "CVE-2017-8570" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Singapore" ], "malware_families": [ { "id": "Chinese", "display_name": "Chinese", "target": null }, { "id": "Looquer", "display_name": "Looquer", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Mimikatz", "display_name": "Mimikatz", "target": null }, { "id": "HiddenTear", "display_name": "HiddenTear", "target": null }, { "id": "Neurovt", "display_name": "Neurovt", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "TrojanX", "display_name": "TrojanX", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Nymaim", "display_name": "Nymaim", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Trojan:Win32/InstallCore", "display_name": "Trojan:Win32/InstallCore", "target": "/malware/Trojan:Win32/InstallCore" }, { "id": "Yixun", "display_name": "Yixun", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax - S0588", "display_name": "GoldMax - S0588", "target": null }, { "id": "DUCKTAIL", "display_name": "DUCKTAIL", "target": null }, { "id": "Artemis", "display_name": "Artemis", "target": null }, { "id": "GandCrab", "display_name": "GandCrab", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "BlackNET", "display_name": "BlackNET", "target": null }, { "id": "Raccoon Stealer", "display_name": "Raccoon Stealer", "target": null }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "OpenCandy", "display_name": "OpenCandy", "target": null }, { "id": "FireHOL", "display_name": "FireHOL", "target": null }, { "id": "HackTool.BruteForce", "display_name": "HackTool.BruteForce", "target": null }, { "id": "HackTool.CheatEngine", "display_name": "HackTool.CheatEngine", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "NanoCore", "display_name": "NanoCore", "target": null }, { "id": "Immortal Stealer", "display_name": "Immortal Stealer", "target": null }, { "id": "WebToolBar", "display_name": "WebToolBar", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1497.002", "name": "User Activity Based Checks", "display_name": "T1497.002 - User Activity Based Checks" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0001", "name": "Initial Access", "display_name": "TA0001 - Initial Access" }, { "id": "T1523", "name": "Evade Analysis Environment", "display_name": "T1523 - Evade Analysis Environment" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1453", "name": "Abuse Accessibility Features", "display_name": "T1453 - Abuse Accessibility Features" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1415", "name": "URL Scheme Hijacking", "display_name": "T1415 - URL Scheme Hijacking" }, { "id": "T1184", "name": "SSH Hijacking", "display_name": "T1184 - SSH Hijacking" }, { "id": "T1134.001", "name": "Token Impersonation/Theft", "display_name": "T1134.001 - Token Impersonation/Theft" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1114.002", "name": "Remote Email Collection", "display_name": "T1114.002 - Remote Email Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 51, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5239, "FileHash-MD5": 929, "FileHash-SHA1": 500, "FileHash-SHA256": 3566, "domain": 1230, "hostname": 2051, "CVE": 6, "email": 5, "CIDR": 1 }, "indicator_count": 13527, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "873 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f21878bcd05f7d594ff86", "name": " AIG Hacked or Spoofed website?", "description": "", "modified": "2023-11-27T23:02:02.229000", "created": "2023-10-30T03:22:47.684000", "tags": [ "ssl certificate", "threat roundup", "contacted", "execution", "august", "march", "whois record", "contacted urls", "malware", "copy", "april", "crypto", "alive", "malicious", "ducktail", "ransomware", "dead", "skynet", "chinese", "october", "roundup", "february", "goldfinder", "sibot", "hacktool", "metro", "goldmax", "installer", "awful", "open", "android", "banker", "keylogger", "united", "maltiverse", "mail spammer", "phishing site", "cyber threat", "engineering", "emotet", "phishing", "spammer", "firehol", "bank", "azorult", "team", "mirai", "pony", "nanocore", "bradesco", "cobalt strike", "installcore", "nymaim", "suppobox", "download", "looquer", "domains", "cisco umbrella", "site", "heur", "alexa top", "million", "safe site", "adware", "malware site", "malicious site", "artemis", "opencandy", "riskware", "tofsee", "gandcrab", "trojanx", "trojan", "generic", "bankerx", "service", "runescape", "facebook", "exploit", "agent", "mimikatz", "unsafe", "alexa", "union", "webtoolbar", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist https", "dsp1", "noname057", "tag count", "sample", "samples", "blacklist", "tsara brashears", "alohatube", "trojan", "scanning_host", "Botnet", "malvertizing", "abuse", "cyber stalking", "defacement", "adult content", "threats", "silencing", "harassment", "target", "aig", "workers compensation", "severe", "attack", "hacking", "yixun tool", "spyware", "malware", "evasion", "malicious", "private investigator", "legal entities", "insurance company", "remote attack", "colorado", "tulach", "Attack origin: United States", "apple", "ios", "victim", "allegations", "assault", "revenge", "retaliation", "libel", "monitoring", "tracking", "pegatech", "bam.nr-data.net", "bam", "nr-data.net", "matrix", "data.net", "asp.net", "apple private data collection", "norad.mil", "norad tracker", "b.scope", "command_and_control", "pornhub", "alohatube", "sweetheart videos", "users voice", "interfacing", "social engineering", "BankerX", "law enforcement aware, complacent or complicit?", "NSA tool Tulach malaware", "metro tmobile", "AS 10975 (NET-AIG) US", "record type", "ttl value", "algorithm", "data", "v3 serial", "number", "cus ou", "entrust", "oentrust", "l1k validity", "cus stnew", "group", "info", "domain status", "server", "date", "registrar abuse", "new york", "postal code", "contact phone", "registrar url", "csc corporate", "code", "microsoft", "win32 exe", "files", "detections type", "name", "confed", "network", "label netaig", "registry arin", "country us", "continent na", "whois lookup", "no match", "google", "dns replication", "domain", "type name", "pine street", "whois database", "email", "registrar iana", "icann whois", "contact", "form", "tech", "iana id", "tech email", "admin country", "CVE-2017-0147", "CVE-2018-0802", "CVE-2017-17215", "CVE-2016-7255", "CVE-2017-11882", "CVE-2017-8570" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Singapore" ], "malware_families": [ { "id": "Chinese", "display_name": "Chinese", "target": null }, { "id": "Looquer", "display_name": "Looquer", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Mimikatz", "display_name": "Mimikatz", "target": null }, { "id": "HiddenTear", "display_name": "HiddenTear", "target": null }, { "id": "Neurovt", "display_name": "Neurovt", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "TrojanX", "display_name": "TrojanX", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Nymaim", "display_name": "Nymaim", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Trojan:Win32/InstallCore", "display_name": "Trojan:Win32/InstallCore", "target": "/malware/Trojan:Win32/InstallCore" }, { "id": "Yixun", "display_name": "Yixun", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax - S0588", "display_name": "GoldMax - S0588", "target": null }, { "id": "DUCKTAIL", "display_name": "DUCKTAIL", "target": null }, { "id": "Artemis", "display_name": "Artemis", "target": null }, { "id": "GandCrab", "display_name": "GandCrab", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "BlackNET", "display_name": "BlackNET", "target": null }, { "id": "Raccoon Stealer", "display_name": "Raccoon Stealer", "target": null }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "OpenCandy", "display_name": "OpenCandy", "target": null }, { "id": "FireHOL", "display_name": "FireHOL", "target": null }, { "id": "HackTool.BruteForce", "display_name": "HackTool.BruteForce", "target": null }, { "id": "HackTool.CheatEngine", "display_name": "HackTool.CheatEngine", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "NanoCore", "display_name": "NanoCore", "target": null }, { "id": "Immortal Stealer", "display_name": "Immortal Stealer", "target": null }, { "id": "WebToolBar", "display_name": "WebToolBar", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1497.002", "name": "User Activity Based Checks", "display_name": "T1497.002 - User Activity Based Checks" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0001", "name": "Initial Access", "display_name": "TA0001 - Initial Access" }, { "id": "T1523", "name": "Evade Analysis Environment", "display_name": "T1523 - Evade Analysis Environment" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1453", "name": "Abuse Accessibility Features", "display_name": "T1453 - Abuse Accessibility Features" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1415", "name": "URL Scheme Hijacking", "display_name": "T1415 - URL Scheme Hijacking" }, { "id": "T1184", "name": "SSH Hijacking", "display_name": "T1184 - SSH Hijacking" }, { "id": "T1134.001", "name": "Token Impersonation/Theft", "display_name": "T1134.001 - Token Impersonation/Theft" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1114.002", "name": "Remote Email Collection", "display_name": "T1114.002 - Remote Email Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "653db044432cdee91e2f5d1c", "export_count": 47, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5239, "FileHash-MD5": 929, "FileHash-SHA1": 500, "FileHash-SHA256": 3566, "domain": 1230, "hostname": 2051, "CVE": 6, "email": 5, "CIDR": 1 }, "indicator_count": 13527, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "873 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f05ff39b2dee54b89d17a", "name": "AIG Hacked or Spoofed website?", "description": "", "modified": "2023-11-27T23:02:02.229000", "created": "2023-10-30T01:25:19.036000", "tags": [ "ssl certificate", "threat roundup", "contacted", "execution", "august", "march", "whois record", "contacted urls", "malware", "copy", "april", "crypto", "alive", "malicious", "ducktail", "ransomware", "dead", "skynet", "chinese", "october", "roundup", "february", "goldfinder", "sibot", "hacktool", "metro", "goldmax", "installer", "awful", "open", "android", "banker", "keylogger", "united", "maltiverse", "mail spammer", "phishing site", "cyber threat", "engineering", "emotet", "phishing", "spammer", "firehol", "bank", "azorult", "team", "mirai", "pony", "nanocore", "bradesco", "cobalt strike", "installcore", "nymaim", "suppobox", "download", "looquer", "domains", "cisco umbrella", "site", "heur", "alexa top", "million", "safe site", "adware", "malware site", "malicious site", "artemis", "opencandy", "riskware", "tofsee", "gandcrab", "trojanx", "trojan", "generic", "bankerx", "service", "runescape", "facebook", "exploit", "agent", "mimikatz", "unsafe", "alexa", "union", "webtoolbar", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist https", "dsp1", "noname057", "tag count", "sample", "samples", "blacklist", "tsara brashears", "alohatube", "trojan", "scanning_host", "Botnet", "malvertizing", "abuse", "cyber stalking", "defacement", "adult content", "threats", "silencing", "harassment", "target", "aig", "workers compensation", "severe", "attack", "hacking", "yixun tool", "spyware", "malware", "evasion", "malicious", "private investigator", "legal entities", "insurance company", "remote attack", "colorado", "tulach", "Attack origin: United States", "apple", "ios", "victim", "allegations", "assault", "revenge", "retaliation", "libel", "monitoring", "tracking", "pegatech", "bam.nr-data.net", "bam", "nr-data.net", "matrix", "data.net", "asp.net", "apple private data collection", "norad.mil", "norad tracker", "b.scope", "command_and_control", "pornhub", "alohatube", "sweetheart videos", "users voice", "interfacing", "social engineering", "BankerX", "law enforcement aware, complacent or complicit?", "NSA tool Tulach malaware", "metro tmobile", "AS 10975 (NET-AIG) US", "record type", "ttl value", "algorithm", "data", "v3 serial", "number", "cus ou", "entrust", "oentrust", "l1k validity", "cus stnew", "group", "info", "domain status", "server", "date", "registrar abuse", "new york", "postal code", "contact phone", "registrar url", "csc corporate", "code", "microsoft", "win32 exe", "files", "detections type", "name", "confed", "network", "label netaig", "registry arin", "country us", "continent na", "whois lookup", "no match", "google", "dns replication", "domain", "type name", "pine street", "whois database", "email", "registrar iana", "icann whois", "contact", "form", "tech", "iana id", "tech email", "admin country", "CVE-2017-0147", "CVE-2018-0802", "CVE-2017-17215", "CVE-2016-7255", "CVE-2017-11882", "CVE-2017-8570" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Singapore" ], "malware_families": [ { "id": "Chinese", "display_name": "Chinese", "target": null }, { "id": "Looquer", "display_name": "Looquer", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Mimikatz", "display_name": "Mimikatz", "target": null }, { "id": "HiddenTear", "display_name": "HiddenTear", "target": null }, { "id": "Neurovt", "display_name": "Neurovt", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "TrojanX", "display_name": "TrojanX", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Nymaim", "display_name": "Nymaim", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Trojan:Win32/InstallCore", "display_name": "Trojan:Win32/InstallCore", "target": "/malware/Trojan:Win32/InstallCore" }, { "id": "Yixun", "display_name": "Yixun", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax - S0588", "display_name": "GoldMax - S0588", "target": null }, { "id": "DUCKTAIL", "display_name": "DUCKTAIL", "target": null }, { "id": "Artemis", "display_name": "Artemis", "target": null }, { "id": "GandCrab", "display_name": "GandCrab", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "BlackNET", "display_name": "BlackNET", "target": null }, { "id": "Raccoon Stealer", "display_name": "Raccoon Stealer", "target": null }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "OpenCandy", "display_name": "OpenCandy", "target": null }, { "id": "FireHOL", "display_name": "FireHOL", "target": null }, { "id": "HackTool.BruteForce", "display_name": "HackTool.BruteForce", "target": null }, { "id": "HackTool.CheatEngine", "display_name": "HackTool.CheatEngine", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "NanoCore", "display_name": "NanoCore", "target": null }, { "id": "Immortal Stealer", "display_name": "Immortal Stealer", "target": null }, { "id": "WebToolBar", "display_name": "WebToolBar", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1497.002", "name": "User Activity Based Checks", "display_name": "T1497.002 - User Activity Based Checks" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0001", "name": "Initial Access", "display_name": "TA0001 - Initial Access" }, { "id": "T1523", "name": "Evade Analysis Environment", "display_name": "T1523 - Evade Analysis Environment" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1453", "name": "Abuse Accessibility Features", "display_name": "T1453 - Abuse Accessibility Features" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1415", "name": "URL Scheme Hijacking", "display_name": "T1415 - URL Scheme Hijacking" }, { "id": "T1184", "name": "SSH Hijacking", "display_name": "T1184 - SSH Hijacking" }, { "id": "T1134.001", "name": "Token Impersonation/Theft", "display_name": "T1134.001 - Token Impersonation/Theft" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1114.002", "name": "Remote Email Collection", "display_name": "T1114.002 - Remote Email Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "653db0487ec8c7a4c0b1ef0e", "export_count": 47, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5239, "FileHash-MD5": 929, "FileHash-SHA1": 500, "FileHash-SHA256": 3566, "domain": 1230, "hostname": 2051, "CVE": 6, "email": 5, "CIDR": 1 }, "indicator_count": 13527, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "873 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f02c459cc8bcaa5ebeb7a", "name": "Targeted hacking via malicious DGA insurance domains AIGcom", "description": "", "modified": "2023-11-27T23:02:02.229000", "created": "2023-10-30T01:11:32.672000", "tags": [ "ssl certificate", "threat roundup", "contacted", "execution", "august", "march", "whois record", "contacted urls", "malware", "copy", "april", "crypto", "alive", "malicious", "ducktail", "ransomware", "dead", "skynet", "chinese", "october", "roundup", "february", "goldfinder", "sibot", "hacktool", "metro", "goldmax", "installer", "awful", "open", "android", "banker", "keylogger", "united", "maltiverse", "mail spammer", "phishing site", "cyber threat", "engineering", "emotet", "phishing", "spammer", "firehol", "bank", "azorult", "team", "mirai", "pony", "nanocore", "bradesco", "cobalt strike", "installcore", "nymaim", "suppobox", "download", "looquer", "domains", "cisco umbrella", "site", "heur", "alexa top", "million", "safe site", "adware", "malware site", "malicious site", "artemis", "opencandy", "riskware", "tofsee", "gandcrab", "trojanx", "trojan", "generic", "bankerx", "service", "runescape", "facebook", "exploit", "agent", "mimikatz", "unsafe", "alexa", "union", "webtoolbar", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist https", "dsp1", "noname057", "tag count", "sample", "samples", "blacklist", "tsara brashears", "alohatube", "trojan", "scanning_host", "Botnet", "malvertizing", "abuse", "cyber stalking", "defacement", "adult content", "threats", "silencing", "harassment", "target", "aig", "workers compensation", "severe", "attack", "hacking", "yixun tool", "spyware", "malware", "evasion", "malicious", "private investigator", "legal entities", "insurance company", "remote attack", "colorado", "tulach", "Attack origin: United States", "apple", "ios", "victim", "allegations", "assault", "revenge", "retaliation", "libel", "monitoring", "tracking", "pegatech", "bam.nr-data.net", "bam", "nr-data.net", "matrix", "data.net", "asp.net", "apple private data collection", "norad.mil", "norad tracker", "b.scope", "command_and_control", "pornhub", "alohatube", "sweetheart videos", "users voice", "interfacing", "social engineering", "BankerX", "law enforcement aware, complacent or complicit?", "NSA tool Tulach malaware", "metro tmobile", "AS 10975 (NET-AIG) US", "record type", "ttl value", "algorithm", "data", "v3 serial", "number", "cus ou", "entrust", "oentrust", "l1k validity", "cus stnew", "group", "info", "domain status", "server", "date", "registrar abuse", "new york", "postal code", "contact phone", "registrar url", "csc corporate", "code", "microsoft", "win32 exe", "files", "detections type", "name", "confed", "network", "label netaig", "registry arin", "country us", "continent na", "whois lookup", "no match", "google", "dns replication", "domain", "type name", "pine street", "whois database", "email", "registrar iana", "icann whois", "contact", "form", "tech", "iana id", "tech email", "admin country", "CVE-2017-0147", "CVE-2018-0802", "CVE-2017-17215", "CVE-2016-7255", "CVE-2017-11882", "CVE-2017-8570" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Singapore" ], "malware_families": [ { "id": "Chinese", "display_name": "Chinese", "target": null }, { "id": "Looquer", "display_name": "Looquer", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Mimikatz", "display_name": "Mimikatz", "target": null }, { "id": "HiddenTear", "display_name": "HiddenTear", "target": null }, { "id": "Neurovt", "display_name": "Neurovt", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "TrojanX", "display_name": "TrojanX", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Nymaim", "display_name": "Nymaim", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Trojan:Win32/InstallCore", "display_name": "Trojan:Win32/InstallCore", "target": "/malware/Trojan:Win32/InstallCore" }, { "id": "Yixun", "display_name": "Yixun", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax - S0588", "display_name": "GoldMax - S0588", "target": null }, { "id": "DUCKTAIL", "display_name": "DUCKTAIL", "target": null }, { "id": "Artemis", "display_name": "Artemis", "target": null }, { "id": "GandCrab", "display_name": "GandCrab", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "BlackNET", "display_name": "BlackNET", "target": null }, { "id": "Raccoon Stealer", "display_name": "Raccoon Stealer", "target": null }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "OpenCandy", "display_name": "OpenCandy", "target": null }, { "id": "FireHOL", "display_name": "FireHOL", "target": null }, { "id": "HackTool.BruteForce", "display_name": "HackTool.BruteForce", "target": null }, { "id": "HackTool.CheatEngine", "display_name": "HackTool.CheatEngine", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "NanoCore", "display_name": "NanoCore", "target": null }, { "id": "Immortal Stealer", "display_name": "Immortal Stealer", "target": null }, { "id": "WebToolBar", "display_name": "WebToolBar", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1497.002", "name": "User Activity Based Checks", "display_name": "T1497.002 - User Activity Based Checks" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0001", "name": "Initial Access", "display_name": "TA0001 - Initial Access" }, { "id": "T1523", "name": "Evade Analysis Environment", "display_name": "T1523 - Evade Analysis Environment" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1453", "name": "Abuse Accessibility Features", "display_name": "T1453 - Abuse Accessibility Features" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1415", "name": "URL Scheme Hijacking", "display_name": "T1415 - URL Scheme Hijacking" }, { "id": "T1184", "name": "SSH Hijacking", "display_name": "T1184 - SSH Hijacking" }, { "id": "T1134.001", "name": "Token Impersonation/Theft", "display_name": "T1134.001 - Token Impersonation/Theft" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1114.002", "name": "Remote Email Collection", "display_name": "T1114.002 - Remote Email Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": "653db32c6a6193714e513695", "export_count": 47, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5239, "FileHash-MD5": 929, "FileHash-SHA1": 500, "FileHash-SHA256": 3566, "domain": 1230, "hostname": 2051, "CVE": 6, "email": 5, "CIDR": 1 }, "indicator_count": 13527, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "873 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653db32c6a6193714e513695", "name": "Targeted hacking via malicious DGA insurance domains AIGcom | Host: am1mxi05.aig.com | IP: 167.230.100.44", "description": "Extremely strange & disturbing report. A disruption at root of Cisco hack may be linked to a matrix of DGA insurance domains. AIG.com. Unclear validity. Spoof Domain, a tool AIG uses? Targets Tsara Brashears. Tulach unlikely a person more likely a profile accessed by entities. Rogue attornoes, etc. Large smear campaign wild cover up including death threats. Reports assert target's been harassed & harmed for years. Is this a cybercrime? Example of malicious tools deployed against innocents.\nMissing STSH\nVerdict: Concerning potential for physical harm to Target or associates\nWhy: Avoid lawsuit and press / reputation \nWho: ?\nIP: 167.230.100.44\nHost: am1mxi05.aig.com\nRegistrar: CSC CORPORATE DOMAINS, INC.\nCreation date: 28 years ago\nHard to understand.", "modified": "2023-11-27T23:02:02.229000", "created": "2023-10-29T01:19:40.692000", "tags": [ "ssl certificate", "threat roundup", "contacted", "execution", "august", "march", "whois record", "contacted urls", "malware", "copy", "april", "crypto", "alive", "malicious", "ducktail", "ransomware", "dead", "skynet", "chinese", "october", "roundup", "february", "goldfinder", "sibot", "hacktool", "metro", "goldmax", "installer", "awful", "open", "android", "banker", "keylogger", "united", "maltiverse", "mail spammer", "phishing site", "cyber threat", "engineering", "emotet", "phishing", "spammer", "firehol", "bank", "azorult", "team", "mirai", "pony", "nanocore", "bradesco", "cobalt strike", "installcore", "nymaim", "suppobox", "download", "looquer", "domains", "cisco umbrella", "site", "heur", "alexa top", "million", "safe site", "adware", "malware site", "malicious site", "artemis", "opencandy", "riskware", "tofsee", "gandcrab", "trojanx", "trojan", "generic", "bankerx", "service", "runescape", "facebook", "exploit", "agent", "mimikatz", "unsafe", "alexa", "union", "webtoolbar", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist https", "dsp1", "noname057", "tag count", "sample", "samples", "blacklist", "tsara brashears", "alohatube", "trojan", "scanning_host", "Botnet", "malvertizing", "abuse", "cyber stalking", "defacement", "adult content", "threats", "silencing", "harassment", "target", "aig", "workers compensation", "severe", "attack", "hacking", "yixun tool", "spyware", "malware", "evasion", "malicious", "private investigator", "legal entities", "insurance company", "remote attack", "colorado", "tulach", "Attack origin: United States", "apple", "ios", "victim", "allegations", "assault", "revenge", "retaliation", "libel", "monitoring", "tracking", "pegatech", "bam.nr-data.net", "bam", "nr-data.net", "matrix", "data.net", "asp.net", "apple private data collection", "norad.mil", "norad tracker", "b.scope", "command_and_control", "pornhub", "alohatube", "sweetheart videos", "users voice", "interfacing", "social engineering", "BankerX", "law enforcement aware, complacent or complicit?", "NSA tool Tulach malaware", "metro tmobile", "AS 10975 (NET-AIG) US", "record type", "ttl value", "algorithm", "data", "v3 serial", "number", "cus ou", "entrust", "oentrust", "l1k validity", "cus stnew", "group", "info", "domain status", "server", "date", "registrar abuse", "new york", "postal code", "contact phone", "registrar url", "csc corporate", "code", "microsoft", "win32 exe", "files", "detections type", "name", "confed", "network", "label netaig", "registry arin", "country us", "continent na", "whois lookup", "no match", "google", "dns replication", "domain", "type name", "pine street", "whois database", "email", "registrar iana", "icann whois", "contact", "form", "tech", "iana id", "tech email", "admin country", "CVE-2017-0147", "CVE-2018-0802", "CVE-2017-17215", "CVE-2016-7255", "CVE-2017-11882", "CVE-2017-8570" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Singapore" ], "malware_families": [ { "id": "Chinese", "display_name": "Chinese", "target": null }, { "id": "Looquer", "display_name": "Looquer", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Mimikatz", "display_name": "Mimikatz", "target": null }, { "id": "HiddenTear", "display_name": "HiddenTear", "target": null }, { "id": "Neurovt", "display_name": "Neurovt", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "TrojanX", "display_name": "TrojanX", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Nymaim", "display_name": "Nymaim", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Trojan:Win32/InstallCore", "display_name": "Trojan:Win32/InstallCore", "target": "/malware/Trojan:Win32/InstallCore" }, { "id": "Yixun", "display_name": "Yixun", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax - S0588", "display_name": "GoldMax - S0588", "target": null }, { "id": "DUCKTAIL", "display_name": "DUCKTAIL", "target": null }, { "id": "Artemis", "display_name": "Artemis", "target": null }, { "id": "GandCrab", "display_name": "GandCrab", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "BlackNET", "display_name": "BlackNET", "target": null }, { "id": "Raccoon Stealer", "display_name": "Raccoon Stealer", "target": null }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "OpenCandy", "display_name": "OpenCandy", "target": null }, { "id": "FireHOL", "display_name": "FireHOL", "target": null }, { "id": "HackTool.BruteForce", "display_name": "HackTool.BruteForce", "target": null }, { "id": "HackTool.CheatEngine", "display_name": "HackTool.CheatEngine", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "NanoCore", "display_name": "NanoCore", "target": null }, { "id": "Immortal Stealer", "display_name": "Immortal Stealer", "target": null }, { "id": "WebToolBar", "display_name": "WebToolBar", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1497.002", "name": "User Activity Based Checks", "display_name": "T1497.002 - User Activity Based Checks" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0001", "name": "Initial Access", "display_name": "TA0001 - Initial Access" }, { "id": "T1523", "name": "Evade Analysis Environment", "display_name": "T1523 - Evade Analysis Environment" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1453", "name": "Abuse Accessibility Features", "display_name": "T1453 - Abuse Accessibility Features" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1415", "name": "URL Scheme Hijacking", "display_name": "T1415 - URL Scheme Hijacking" }, { "id": "T1184", "name": "SSH Hijacking", "display_name": "T1184 - SSH Hijacking" }, { "id": "T1134.001", "name": "Token Impersonation/Theft", "display_name": "T1134.001 - Token Impersonation/Theft" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1114.002", "name": "Remote Email Collection", "display_name": "T1114.002 - Remote Email Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 55, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5239, "FileHash-MD5": 929, "FileHash-SHA1": 500, "FileHash-SHA256": 3566, "domain": 1230, "hostname": 2051, "CVE": 6, "email": 5, "CIDR": 1 }, "indicator_count": 13527, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "873 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653db12d71978ca34e49e88e", "name": "Hacking stemming from malicious DGA Insurance domains under Cisco Umbrella", "description": "Extremely strange & disturbing report. A disruption at root of Cisco hack may be linked to a matrix of DGA insurance domains. AIG.com. Unclear validity. Spoof Domain, a tool AIG uses? Targets Tsara Brashears. Tulach unlikely a person more likely a profile accessed by entities. Rogue attornoes, etc. Large smear campaign wild cover up including death threats. Reports assert target's been harassed & harmed for years. Is this a cybercrime? Example of malicious tools deployed against innocents.\nMissing STSH\nVerdict: Concerning potential for physical harm to Target or associates\nWhy: Avoid lawsuit and press / reputation \nWho: ?\nIP: 167.230.100.44\nHost: am1mxi05.aig.com\nRegistrar: CSC CORPORATE DOMAINS, INC.\nCreation date: 28 years ago", "modified": "2023-11-27T23:02:02.229000", "created": "2023-10-29T01:11:09.672000", "tags": [ "ssl certificate", "threat roundup", "contacted", "execution", "august", "march", "whois record", "contacted urls", "malware", "copy", "april", "crypto", "alive", "malicious", "ducktail", "ransomware", "dead", "skynet", "chinese", "october", "roundup", "february", "goldfinder", "sibot", "hacktool", "metro", "goldmax", "installer", "awful", "open", "android", "banker", "keylogger", "united", "maltiverse", "mail spammer", "phishing site", "cyber threat", "engineering", "emotet", "phishing", "spammer", "firehol", "bank", "azorult", "team", "mirai", "pony", "nanocore", "bradesco", "cobalt strike", "installcore", "nymaim", "suppobox", "download", "looquer", "domains", "cisco umbrella", "site", "heur", "alexa top", "million", "safe site", "adware", "malware site", "malicious site", "artemis", "opencandy", "riskware", "tofsee", "gandcrab", "trojanx", "trojan", "generic", "bankerx", "service", "runescape", "facebook", "exploit", "agent", "mimikatz", "unsafe", "alexa", "union", "webtoolbar", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist https", "dsp1", "noname057", "tag count", "sample", "samples", "blacklist", "tsara brashears", "alohatube", "trojan", "scanning_host", "Botnet", "malvertizing", "abuse", "cyber stalking", "defacement", "adult content", "threats", "silencing", "harassment", "target", "aig", "workers compensation", "severe", "attack", "hacking", "yixun tool", "spyware", "malware", "evasion", "malicious", "private investigator", "legal entities", "insurance company", "remote attack", "colorado", "tulach", "Attack origin: United States", "apple", "ios", "victim", "allegations", "assault", "revenge", "retaliation", "libel", "monitoring", "tracking", "pegatech", "bam.nr-data.net", "bam", "nr-data.net", "matrix", "data.net", "asp.net", "apple private data collection", "norad.mil", "norad tracker", "b.scope", "command_and_control", "pornhub", "alohatube", "sweetheart videos", "users voice", "interfacing", "social engineering", "BankerX", "law enforcement aware, complacent or complicit?", "NSA tool Tulach malaware", "metro tmobile", "AS 10975 (NET-AIG) US", "record type", "ttl value", "algorithm", "data", "v3 serial", "number", "cus ou", "entrust", "oentrust", "l1k validity", "cus stnew", "group", "info", "domain status", "server", "date", "registrar abuse", "new york", "postal code", "contact phone", "registrar url", "csc corporate", "code", "microsoft", "win32 exe", "files", "detections type", "name", "confed", "network", "label netaig", "registry arin", "country us", "continent na", "whois lookup", "no match", "google", "dns replication", "domain", "type name", "pine street", "whois database", "email", "registrar iana", "icann whois", "contact", "form", "tech", "iana id", "tech email", "admin country", "CVE-2017-0147", "CVE-2018-0802", "CVE-2017-17215", "CVE-2016-7255", "CVE-2017-11882", "CVE-2017-8570", "defense entity fraud?" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Singapore" ], "malware_families": [ { "id": "Chinese", "display_name": "Chinese", "target": null }, { "id": "Looquer", "display_name": "Looquer", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Mimikatz", "display_name": "Mimikatz", "target": null }, { "id": "HiddenTear", "display_name": "HiddenTear", "target": null }, { "id": "Neurovt", "display_name": "Neurovt", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "TrojanX", "display_name": "TrojanX", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Nymaim", "display_name": "Nymaim", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Trojan:Win32/InstallCore", "display_name": "Trojan:Win32/InstallCore", "target": "/malware/Trojan:Win32/InstallCore" }, { "id": "Yixun", "display_name": "Yixun", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax - S0588", "display_name": "GoldMax - S0588", "target": null }, { "id": "DUCKTAIL", "display_name": "DUCKTAIL", "target": null }, { "id": "Artemis", "display_name": "Artemis", "target": null }, { "id": "GandCrab", "display_name": "GandCrab", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "BlackNET", "display_name": "BlackNET", "target": null }, { "id": "Raccoon Stealer", "display_name": "Raccoon Stealer", "target": null }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "OpenCandy", "display_name": "OpenCandy", "target": null }, { "id": "FireHOL", "display_name": "FireHOL", "target": null }, { "id": "HackTool.BruteForce", "display_name": "HackTool.BruteForce", "target": null }, { "id": "HackTool.CheatEngine", "display_name": "HackTool.CheatEngine", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "NanoCore", "display_name": "NanoCore", "target": null }, { "id": "Immortal Stealer", "display_name": "Immortal Stealer", "target": null }, { "id": "WebToolBar", "display_name": "WebToolBar", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1497.002", "name": "User Activity Based Checks", "display_name": "T1497.002 - User Activity Based Checks" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0001", "name": "Initial Access", "display_name": "TA0001 - Initial Access" }, { "id": "T1523", "name": "Evade Analysis Environment", "display_name": "T1523 - Evade Analysis Environment" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1453", "name": "Abuse Accessibility Features", "display_name": "T1453 - Abuse Accessibility Features" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1415", "name": "URL Scheme Hijacking", "display_name": "T1415 - URL Scheme Hijacking" }, { "id": "T1184", "name": "SSH Hijacking", "display_name": "T1184 - SSH Hijacking" }, { "id": "T1134.001", "name": "Token Impersonation/Theft", "display_name": "T1134.001 - Token Impersonation/Theft" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1114.002", "name": "Remote Email Collection", "display_name": "T1114.002 - Remote Email Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 53, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5239, "FileHash-MD5": 929, "FileHash-SHA1": 500, "FileHash-SHA256": 3566, "domain": 1230, "hostname": 2051, "CVE": 6, "email": 5, "CIDR": 1 }, "indicator_count": 13527, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "873 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653db0487ec8c7a4c0b1ef0e", "name": "AIG Hacked or Spoofed website?", "description": "Extremely strange & disturbing report. Disruption under Cisco Umbrella hack may be linked to a matrix of DGA insurance domains. AIG.com. Unclear validity. Spoof Domain, a tool AIG uses? Targets Tsara Brashears. Tulach unlikely a person more likely a profile accessed by entities. Rogue attornoes, etc. Large smear campaign wild cover up including death threats. Reports assert target's been harassed & harmed for years. Is this a cybercrime? Example of malicious tools deployed against innocents.\nMissing STSH\nVerdict: Concerning potential for physical harm to Target or associates\nWhy: Avoid lawsuit and press / reputation \nWho: ?\nIP: 167.230.100.44\nHost: am1mxi05.aig.com\nRegistrar: CSC CORPORATE DOMAINS, INC.\nCreation date: 28 years ago", "modified": "2023-11-27T23:02:02.229000", "created": "2023-10-29T01:07:20.916000", "tags": [ "ssl certificate", "threat roundup", "contacted", "execution", "august", "march", "whois record", "contacted urls", "malware", "copy", "april", "crypto", "alive", "malicious", "ducktail", "ransomware", "dead", "skynet", "chinese", "october", "roundup", "february", "goldfinder", "sibot", "hacktool", "metro", "goldmax", "installer", "awful", "open", "android", "banker", "keylogger", "united", "maltiverse", "mail spammer", "phishing site", "cyber threat", "engineering", "emotet", "phishing", "spammer", "firehol", "bank", "azorult", "team", "mirai", "pony", "nanocore", "bradesco", "cobalt strike", "installcore", "nymaim", "suppobox", "download", "looquer", "domains", "cisco umbrella", "site", "heur", "alexa top", "million", "safe site", "adware", "malware site", "malicious site", "artemis", "opencandy", "riskware", "tofsee", "gandcrab", "trojanx", "trojan", "generic", "bankerx", "service", "runescape", "facebook", "exploit", "agent", "mimikatz", "unsafe", "alexa", "union", "webtoolbar", "ip summary", "url summary", "summary", "urls", "detection list", "blacklist https", "dsp1", "noname057", "tag count", "sample", "samples", "blacklist", "tsara brashears", "alohatube", "trojan", "scanning_host", "Botnet", "malvertizing", "abuse", "cyber stalking", "defacement", "adult content", "threats", "silencing", "harassment", "target", "aig", "workers compensation", "severe", "attack", "hacking", "yixun tool", "spyware", "malware", "evasion", "malicious", "private investigator", "legal entities", "insurance company", "remote attack", "colorado", "tulach", "Attack origin: United States", "apple", "ios", "victim", "allegations", "assault", "revenge", "retaliation", "libel", "monitoring", "tracking", "pegatech", "bam.nr-data.net", "bam", "nr-data.net", "matrix", "data.net", "asp.net", "apple private data collection", "norad.mil", "norad tracker", "b.scope", "command_and_control", "pornhub", "alohatube", "sweetheart videos", "users voice", "interfacing", "social engineering", "BankerX", "law enforcement aware, complacent or complicit?", "NSA tool Tulach malaware", "metro tmobile", "AS 10975 (NET-AIG) US", "record type", "ttl value", "algorithm", "data", "v3 serial", "number", "cus ou", "entrust", "oentrust", "l1k validity", "cus stnew", "group", "info", "domain status", "server", "date", "registrar abuse", "new york", "postal code", "contact phone", "registrar url", "csc corporate", "code", "microsoft", "win32 exe", "files", "detections type", "name", "confed", "network", "label netaig", "registry arin", "country us", "continent na", "whois lookup", "no match", "google", "dns replication", "domain", "type name", "pine street", "whois database", "email", "registrar iana", "icann whois", "contact", "form", "tech", "iana id", "tech email", "admin country", "CVE-2017-0147", "CVE-2018-0802", "CVE-2017-17215", "CVE-2016-7255", "CVE-2017-11882", "CVE-2017-8570" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Singapore" ], "malware_families": [ { "id": "Chinese", "display_name": "Chinese", "target": null }, { "id": "Looquer", "display_name": "Looquer", "target": null }, { "id": "Inmortal", "display_name": "Inmortal", "target": null }, { "id": "Domains", "display_name": "Domains", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Mimikatz", "display_name": "Mimikatz", "target": null }, { "id": "HiddenTear", "display_name": "HiddenTear", "target": null }, { "id": "Neurovt", "display_name": "Neurovt", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "TrojanX", "display_name": "TrojanX", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Nymaim", "display_name": "Nymaim", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Sibot", "display_name": "Sibot", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Trojan:Win32/InstallCore", "display_name": "Trojan:Win32/InstallCore", "target": "/malware/Trojan:Win32/InstallCore" }, { "id": "Yixun", "display_name": "Yixun", "target": null }, { "id": "GoldFinder", "display_name": "GoldFinder", "target": null }, { "id": "GoldMax - S0588", "display_name": "GoldMax - S0588", "target": null }, { "id": "DUCKTAIL", "display_name": "DUCKTAIL", "target": null }, { "id": "Artemis", "display_name": "Artemis", "target": null }, { "id": "GandCrab", "display_name": "GandCrab", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "BlackNET", "display_name": "BlackNET", "target": null }, { "id": "Raccoon Stealer", "display_name": "Raccoon Stealer", "target": null }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "OpenCandy", "display_name": "OpenCandy", "target": null }, { "id": "FireHOL", "display_name": "FireHOL", "target": null }, { "id": "HackTool.BruteForce", "display_name": "HackTool.BruteForce", "target": null }, { "id": "HackTool.CheatEngine", "display_name": "HackTool.CheatEngine", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "NanoCore", "display_name": "NanoCore", "target": null }, { "id": "Immortal Stealer", "display_name": "Immortal Stealer", "target": null }, { "id": "WebToolBar", "display_name": "WebToolBar", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1497.002", "name": "User Activity Based Checks", "display_name": "T1497.002 - User Activity Based Checks" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1491", "name": "Defacement", "display_name": "T1491 - Defacement" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0001", "name": "Initial Access", "display_name": "TA0001 - Initial Access" }, { "id": "T1523", "name": "Evade Analysis Environment", "display_name": "T1523 - Evade Analysis Environment" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1453", "name": "Abuse Accessibility Features", "display_name": "T1453 - Abuse Accessibility Features" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1415", "name": "URL Scheme Hijacking", "display_name": "T1415 - URL Scheme Hijacking" }, { "id": "T1184", "name": "SSH Hijacking", "display_name": "T1184 - SSH Hijacking" }, { "id": "T1134.001", "name": "Token Impersonation/Theft", "display_name": "T1134.001 - Token Impersonation/Theft" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1114.002", "name": "Remote Email Collection", "display_name": "T1114.002 - Remote Email Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 51, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5239, "FileHash-MD5": 929, "FileHash-SHA1": 500, "FileHash-SHA256": 3566, "domain": 1230, "hostname": 2051, "CVE": 6, "email": 5, "CIDR": 1 }, "indicator_count": 13527, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "873 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "csh.cshrc", "MAAutoAsset_Scheduler_History_05.log", "usermanagerd_logs.log", "mobile_installation.log.1", "AOSKit.tbd", "ivars->fChannelSwitchDictionary[0].xml", "MAAutoAsset_Stager_History_07.log", "MAAutoAsset_Scheduler_History_08.log", "kernel.csv", "BDC_SBC_version2.6_2024-09-11_00:27:57.csv", "master.cf.proto", "csh.logout", "DE90FBA8603371B106DDEC727E696D.rtf", "launchagents.txt", "WiFi.log", "MAAutoAsset_Filesystem_History_08.log", "pf.conf", "MAAutoAsset_Secure_History_03.log", "interfaceAddrs.csv", "lockdownd.log", "SiriTextToSpeech.log", "canonical", "MediaserverdBlockageTailspins.log", "MAAutoAsset_Error_History_08.log", "Admin.tbd", "ntp.conf", "http://bjdclub.ru/out.phtml?www.skyxxxgals.info/feet-licking-porn/", "BDC_SBC_version2.6_2024-09-08_17:52:28.csv", "BDC_SBC_version2.6_2024-08-29_00:19:16.csv", "asptool_snapshot.log", "[2024-09-29_22,12,56.477273]-AppleBCMWLAN_Logs-001.txt", "https://ww9.0123movie.net/icons/apple-touch-icon.png", "bluetooth_status.txt", "bind.html", "MAAutoAsset_Secure_History_05.log", "SoC_Registers.xml", "dbd_xsh.h", "syslog.log", "http://watchhers.net/index.php", "NanoRegistry.log", "version", "MAAutoAsset_Secure_History_06.log", "coreaudio_reporting.log", "MAAutoAsset_Stager_History.txt", "BDC_SBC_version2.6_2024-09-13_02:10:48.csv", "disks.txt", "MAAutoAsset_Error_History_06.log", "ProtectedCloudStorage.log", "mobileactivationd.log.0", "DataMigration.log", "https://hyundaibariavungtau3s.com/vehicle/new-hyundai-venue", "master.cf", "diskEncryption.csv", "https://delivery-mp-microsoft.dvrx.dn3.n-helix.com \u2022 https://dnsplay.dn2.n-helix.com", "CodeResources", "BDC_Daily_version2.6_2024-08-29_00:19:16.csv", "BDC_SBC_version2.8_2024-09-21_13:45:07.csv", "[2024-09-29_22,12,56.457960]-AppleOLYHAL_log-001.txt", "BDC_SBC_version2.6_2024-09-03_11:48:00.csv", "MAAutoAsset_Stager_History_00.log", "MAAutoAsset_Locker_History.txt", "tailspin-info-ts.log", "BDC_Daily_version2.8_2024-09-21_13:45:08.csv", "wifi_datapath-POST.txt", "MAAutoAsset_Secure_History_00.log", "OTAUpdateLogs.log", "diagnostics-environment.txt", "CommanderState.txt", "LivabilityApp.log", "MAAutoAsset_Scheduler_History_00.log", "managedPolicies.csv", "appinstallation.log", "Harmony.log", "configuring.html", "tailspin-history.log", "ThermalLogs.log", "process_proxied_device_logs.log", "MAAutoAsset_Scheduler_History_01.log", "BDC_SBC_version2.6_2024-09-12_02:07:40.csv", "wifi_datapath-PRE.txt", "akd_dcrt_baa_response.txt", "971A5878D635EB8B262FF791353234.rtf", "time-sensitive-stackshot.log", "MobileSlideShowPrivateData.log", "diagnostics-connectivity.txt", "https://hyundaibariavungtau3s.com/vehicle/ioniq-5", "usbDevices.csv", "BDC_OBC_version2.6_2024-09-13_16:25:59.csv", "index.html.en", "BDC_OBC_version2.8_2024-09-14_13:32:02.csv", "BDC_SmartCharging_version2.6_2024-09-04_13:19:02.csv", "awdl_status.txt", "ondemandd.log", "CoreCapture.log", "awdl0_PrintState_IO80211AWDLPeerManager.txt", "LICENSE", "MCPeerID.h", "com.apple.wifi.recent-networks.json", "security.txt", "virtual", "https://iptv.cameraddns.net/kodi/zips/plugin.video.iptvjson]", "LogStreamFilter.log", "MemoryExceptions.log", "MAAutoAsset_Scheduler_History_09.log", "BDC_OBC_version2.8_2024-09-14_00:28:48.csv", "MAAutoAsset_Locker_History_02.log", "MCNearbyServiceAdvertiser.h", "module.modulemap", "MAAutoAsset_Error_History_02.log", "kern_loader.conf", "apfs_stats.txt", "2B553D16843D7B9CD7A4504A96CF2F.rtf", "RecentHangTracerTailspins.log", "makedefs.out", "etcHosts.csv", "BDC_SBC_version2.8_2024-09-22_05:55:57.csv", "[2024-09-29_22,12,56.591747]-Interface_AirLink_0-001.txt", "system.rtf", "MAAutoAsset_Filesystem_History_05.log", "LocalAuthentication.tbd", "crashes.csv", "StoreServices.log", "BDC_SBC_version2.8_2024-09-23_19:56:36.csv", "MultipeerConnectivity.tbd", "HangTracerTailspins.log", "BDC_SBC_version2.8_2024-09-14_13:32:04.csv", "BTPHY.log", "http://www.yayabay.com/forum/adclick.php?url=http%3a%2f%2fhkprice.info%2fpornstars%2f22466", "FindMyDevice.log", "https://hyundaibariavungtau3s.com/vehicle/new-hyundai-palisade", "com.apple.wifi.syncable-networks.legacy.plist", "Buddy.log", "MAAutoAsset_Scheduler_History_04.log", "https://hyundaibariavungtau3s.com/vehicle/hyundai-custin", "https://foundry2-lbl.dvr.dn2.n-helix.com/ \u2022 https://node8-serve.dvrx.dn3.n-helix.com \u2022 https://sfbambi-tel.dn2.n-helix.com \u2022 https://softlayer3.dn2.n-helix.com", "manpaths", "MobileLockdown.log", "hook_op_check.h", "https://hyundaibariavungtau3s.com/wp-content/themes/flatsome/inc/extensions/flatsome-live-search/", "BatteryUIPlist.log", "DBIXS.h", "netstat-POST.txt", "zalo.me | href | Binary File | ATT&CK ID T1566.002", "MAAutoAsset_Stager_History_01.log", "ps_thread.txt", "GEAvailability.log", "BDC_SBC_version2.8_2024-09-24_19:36:33.csv", "https://hybrid-analysis.com/sample/6f4fb33ffb44474e86928549ef3f1a51d0f3e9e8c8d7a08b71b2b59b5921d311", "hpmDiagnose.txt", "access", "WindowServerHangs.log", "BDC_OBC_version2.8_2024-09-13_23:35:57.csv", "MAAutoAsset_Scheduler_History_06.log", "main.cf", "MAAutoAsset_Locker_History_00.log", "UARP_Packet_Capture.log", "MAAutoAsset_Filesystem_History_00.log", "ghb-unoadsrv-com.geodns.me.1.1.11cec3ef.roksit.net", "BDC_SmartCharging_version2.6_2024-09-03_11:48:07.csv", "BDC_Daily_version2.6_2024-09-04_12:00:11.csv", "https://s3.rexdl.com/android/game/Desktop-Dungeons-v11-Mod-www.Rexdl.com.apk", "MAAutoAsset_Error_History_07.log", "InterfaceState_skywalkinfra.txt", "MAAutoAsset_Locker_History_08.log", "MAAutoAsset_Atomic_History_01.log", "BDC_Once_version2.8_2024-09-13_17:49:16.csv", "MAAutoAsset_Stager_History_06.log", "MAAutoAsset_Atomic_History_05.log", "tailspin-info.txt", "BUILDING", "custom-error.html", "ASPSnapshots.log", "cs001.informativeremail-apple.zoom.com.cn", "CommandAndControl.log", "BDC_SmartCharging_version2.6_2024-09-02_20:25:09.csv", "594CB14E19331E8CFB5365144D46C4.rtf", "AUDeveloperSettings.log", "UARPEndpointPacketCaptures.log", "feedback-pa.clients6.google.com/v1/survey/trigger/", "rc.common", "joebiden.com", "unnamed_tasks.log", "mobilewifitool.txt", "BluetoothAccessory.log", "lber.h", "quackbot? Qbot qakbot positive", "This is all too strange! Corruption or Spoofed?", "Siri.log", "rc.netboot", "com.apple.networkextension.necp.rtf", "location.search", "MobileInstallation.log", "CacheDeleteHistory.log", "watchdogd_ddts.log", "NSURLSession_logs.log", "DeviceInfo.xml", "MCUCoreDumps.log", "sudo_lecture", "profile", "MSU.log", "bashrc_Apple_Terminal", "diagnostic_summary.log", "apple-identifiant.info", "LowLatencyTxCompRing", "passwd", "mobile_installation.log.0", "network_status.txt", "MAAutoAsset_Secure_History_07.log", "MAAutoAsset_Stager_History_08.log", "ConfigManagerState.txt", "Networking.log", "LowLatencyRxCompRing", "MAAutoAsset_Error_History_00.log", "disk_structure.txt", "AirPlayReceiver.tbd", "master.cf.default", "UnifiedAsset.log", "BDC_SBC_version2.6_2024-09-02_20:27:16.csv", "https://thehackernews.com/2023/10/quasar-rat-leverages-dll-side-loading.html?m=1", "https://autodiscover.socket.net/Autodiscover/DEADJOE", "MobileObliteration.log", "mounts.csv", "systemInfo.csv", "MAAutoAsset_Atomic_History_03.log", "InterfaceState_apsta.txt", "process_list.txt", "0-courier.push.apple.com", "security-sysdiagnose.txt", "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/", "BDC_SBC_version2.6_2024-09-04_12:00:11.csv", "MCAdvertiserAssistant.h", "asptool_snapshot_timesensitive.log", "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/", "BDC_SBC_version2.6_2024-09-04_13:21:06.csv", "Mobile_Demo.log", "https://urlscan.io", "BDC_SBC_version2.8_2024-09-23_21:27:40.csv", "https://twitter.com/sheriffspurlock?lang=en", "familyhandyman.com", "[2024-09-29_22,12,56.122877]-Interface_LowLatency_0-001.txt", "DarwinInit.log", "MobileActivation.log", "https://www.anyxxxtube.net/media/favicon/apple", "leaky_ap_stats.txt", "olddsc.log", "shells", "ivars->fChannelSwitchDictionary[1].xml", "[2024-09-29_22,12,45.966405]-LQMLogging-001.txt", "MAAutoAsset_Scheduler_History.txt", "BatteryBDC.log", "Personalization.log", "SystemVersion.log", "afpovertcp.cfg", "MAAutoAsset_Stager_History_02.log", "MobileSlideShow.log", "MAAutoAsset_Locker_History_07.log", "BDC_SBC_version2.6_2024-09-03_00:11:37.csv", "preferences.rtf", "zprofile", "ap1_PrintState_IO80211PeerManager.txt", "APConfigurationSystem.tbd", "https://remote.goeaston.net", "nr-data.net", "syslog.conf", "MAAutoAsset_Locker_History_03.log", "https://hyundaibariavungtau3s.com/vehicle/stargazer", "MobileKeybagLogs.log", "BDC_SBC_version2.8_2024-09-14_00:28:50.csv", "BusState.txt", "History.txt", "awdl0_AllPeersVerbose_IO80211AWDLPeerManager.txt", "https://feedback-pa.clients6.google.com/v1/survey/trigger/trigger_anonymous?key=AIzaSyD3LJeW4Q6gtdgJlyeFZUp-GhpIoc6EUeg", "BDC_SBC_version2.8_2024-09-18_23:12:15.csv", "com.apple.networkextension.rtf", "CoreState.txt", "com.apple.screensharing.agent.launchd", "generic", "ATVUpdateLog.log", "copySpringBoardStateDump.log", "command_args.json", "pf.os", "MAAutoAsset_Atomic_History_06.log", "NetworkRelay.log", "mounts.txt", "smcDiagnose.txt", "TetheredRestore.log", "x86_64-apple-ios-macabi.swiftinterface", "BDC_SBC_version2.8_2024-09-13_17:49:18.csv", "BDC_Daily_version2.8_2024-09-13_17:49:14.csv", "group", "MAAutoAsset_Filesystem_History.txt", "xtab", "BASEBAND_TS_TRIGGER.log", "NetManagerState.txt", "FDRDiagnosticReport.plist", "BDC_SBC_version2.8_2024-09-18_03:20:38.csv", "mobile_installation_helper.log.0", "LaunchServices.log", "CompanionSync.log", "Preferences.log", "spindump-meta-collection.log", "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source", "SiriAnalytics.log", "BatteryIntelligence.log", "rtadvd.conf", "drive.google.com/", "battery.csv", "ifconfig.txt", "MAAutoAsset_Filesystem_History_06.log", "InterfaceState_prox.txt", "message.htm.com", "[2024-09-29_22,12,45.960131]-Interface_SoftAP_0-001.txt", "locate.rc", "69.197.153.180", "anonsecbotnet.cameraddns.net \u2022 cameraddns.net \u2022 http://iptv.cameraddns.net/cotich/ \u2022 http://iptv.cameraddns.net/cotichC \u2022", "BDC_Once_version2.6_2024-08-29_00:19:16.csv", "debug-log.txt", "fileproviderctl_check.log", "fsck.log", "GenerativeExperiences.log", "MAAutoAsset_Locker_History_05.log", "[2024-09-29_22,12,56.815468]-Interface_Infrastructure_0-001.txt", "MAAutoAsset_Stager_History_05.log", "cpcalendars.hyundaibariavungtau3s.com \u2022 cpcontacts.hyundaibariavungtau3s.com", "HomePodSetUp.log", "dbi_sql.h", "MAAutoAsset_Filesystem_History_03.log", "MCState.log", "InterfaceState_llw.txt", "notify.conf", "deadlineday.twitter.com", "custom_header_checks", "AddFileList.txt", "MobileBackup.log", "MAAutoAsset_Atomic_History.txt", "hidfw-crashlogs.log", "taskSummary.csv", "brctl.log", "autofs.conf", "BDC_OBC_version2.8_2024-09-29_15:16:41.csv", "AppleFirmwareUpdate.tbd", "MAAutoAsset_Secure_History_09.log", "aig.com", "MCSession.h", "Resource_Exhaustion.log", "sharedFolders.csv", "BDC_SmartCharging_version2.6_2024-09-03_00:11:44.csv", "MAAutoAsset_Stager_History_09.log", "MAAutoAsset_Filesystem_History_07.log", "ScanManagerState.txt", "ForceResetTailspins.log", "applications.csv", "launchD.csv", "BDC_SBC_version2.6_2024-09-13_17:07:26.csv", "https://hybrid-analysis.com/sample/a728fc352e13fa39c7490ddcfff86b0919b3de6ea5786cf48b22095e0607bde9/6593b386f70b45c7c70419c8", "ldap.h", "AVConference.log", "MAAutoAsset_Filesystem_History_01.log", "apfs_boot_mount.tbd", "content-negotiation.html", "BDC_SBC_version2.8_2024-09-14_01:16:12.csv", "SleepCycler.log", "chromeExtensions.csv", "MultipeerConnectivity.apinotes", "Sentry.log", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/d334c3220573f98da1a0eef13be9c8b0053447519b3a6ace3728bcffa10b99b6", "MatchTailspins.log", "bounce.cf.default", "VideoProcessing.log", "vm_stat.txt", "MAAutoAsset_Filesystem_History_09.log", "BDC_SBC_version2.6_2024-09-13_16:26:54.csv", "com.apple.networkextension.uuidcache.rtf", "BridgeActivation.log", "networks", "wifi_scan.txt", "header_checks", "astro.log", "SUCoreSplunkHistory.log", "Frametracer.log", "atcrtcomm.txt", "MAAutoAsset_Secure_History_01.log", "rmtab", "BDC_OBC_version2.6_2024-08-29_00:19:14.csv", "security_status.txt", "sudoers", "[2024-09-29_22,12,56.327440]-uartFirmwareLogs-001.txt", "https://www.slatergordon.com.au/blog/revenge-porn-laws", "FaultReportState.txt", "TLS_LICENSE", "com.apple.networkextension.cache.rtf", "coremediacapture-afdebug.log", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "version.plist", "capture.rtf", "newsyslog.conf", "MAAutoAsset_Atomic_History_08.log", "tzDataVersion.log", "sharingPreferences.csv", "SplunkHistory.log", "MAAutoAsset_Secure_History_08.log", "main.cf.proto", "MAAutoAsset_Atomic_History_09.log", "transparency.log", "zshrc_Apple_Terminal", "postfix-files", "https://dnss2.dn2.n-helix.com \u2022 https://dnssounib.dn2.n-helix.com/", "MAAutoAsset_Stager_History_04.log", "find.codes", "launchdLogs.log", "nfs.conf", "relocated", "user_launchagents.txt", "arp.txt", "MAAutoAsset_Locker_History_04.log", "anonsecbotnet.cameraddns.net \u2022 http://anonsecbotnet.cameraddns.net \u2022 https://anonsecbotnet.cameraddns.net", "mail.rc", "BDC_OBC_version2.8_2024-09-18_23:12:12.csv", "com.apple.wifi.syncable-networks.plist", "MailErrorConditions.log", "bashrc", "IOSADiagnose.log", "watchdog.log", "Driver_xst.h", "https://account.helix.com/activate/start", "Trial.log", "keyboard_cache.log", "oslog_archive_error.log", "hidutil.plist", "SpaceAttributionTelemetry.log", "model_manager_dump.json", "ntp_opendirectory.conf", "MultipeerConnectivity.h", "Terse Unencrypted Request for Google - Likely Connectivity Check", "ttys", "en0_PrintState_IO80211PeerManager.txt", "akd_dcrt_baa_request.txt", "HCI.log", "CMCaptureTailspins.log", "HIDCrashlogs.log", "MAAutoAsset_Atomic_History_04.log", "MAAutoAsset_Error_History_09.log", "MobileAssetHistory.log", "BDC_SBC_version2.6_2024-09-13_16:16:55.csv", "wifi_logarchive.log", "ap1_AllPeersVerbose_IO80211PeerManager.txt", "MAAutoAsset_Scheduler_History_02.log", "com.apple.networkextension.control.rtf", "remotectl_dumpstate.txt", "BDC_SBC_version2.8_2024-09-17_01:27:03.csv", "Splat_Versioning.log", "AlishaLogs.log", "Proximity.log", "MCBrowserViewController.h", "resolv.conf", "CacheDeletePurgeHistory.txt", "MMIO_Log.txt", "TimezoneDB.log", "kexts.txt", "MobileStoreDemo.log", "MAAutoAsset_Secure_History_04.log", "smb.conf", "Entity_2024-09-29 22:12:50.359_Blacklist.csv", "MCError.h", "itunesstored.log", "AppSupport.log", "MAAutoAsset_Error_History_04.log", "aliases", "certificates.csv", "Burnin.log", "BDC_SmartCharging_version2.6_2024-08-29_00:21:46.csv", "m.pornsexer.xxx.3.1.adiosfil.roksit.net", "main.cf.default", "launchdaemons.txt", "MAAutoAsset_Stager_History_03.log", "ProactiveInputPredictions.log", "protocols", "https://ww11.0123movie.net/icons/apple-touch-icon.png", "sipConfig.csv", "acLog.plist", "dbivport.h", "https://foundry2-lbl.dvr.dn2.n-helix.com/", "B730B951A932F5AE2648F478FDDA81.rtf", "C1ACD227FD3CE992C115DD95BD2B42.rtf", "parsecd.log", "MAAutoAsset_Filesystem_History_02.log", "zshrc", "auto_home", "MAAutoAsset_Atomic_History_00.log", "0-i-0.xyz", "users.csv", "SUInfo.log", "crashes_and_spins.log", "CalendarPreferences.log", "demod.log", "x86_64-apple-macos.swiftinterface", "wifi_scan_cache.txt", "CoreLocation.log", "systemControls.csv", "powerlogs.log", "RunningBoard.log", "preboot_archive_errors.log", "CoreCaptureBT.log", "BDC_SmartCharging_version2.6_2024-09-03_04:09:12.csv", "MAAutoAsset_Error_History_05.log", "arm64e-apple-ios-macabi.swiftinterface", "ftpusers", "MapsSyncJournal.log", "microstackshots.log", "wifi_status.txt", "csh.login", "sysdiagnose.log", "transport", "MAAutoAsset_Locker_History_01.log", "atcrtcomm.log", "BluetoothCoreDump.log", "BDC_Daily_version2.8_2024-09-22_16:06:26.csv", "MAAutoAsset_Secure_History.txt", "cts.log", "BDC_SBC_version2.8_2024-09-13_17:54:28.csv", "remoteaccess.aig.com", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7aa2b182b17cfb5efb3367e0bc7b36e7088ab43a8fb21a772a0f8f90b7329d9", "Panics.log", "BDC_SmartCharging_version2.6_2024-09-04_12:00:20.csv", "BridgeReporting.log", "man.conf", "MCNearbyServiceBrowser.h", "dbixs_rev.h", "en0_AllPeersVerbose_IO80211PeerManager.txt", "OSEligibility.log", "asl.conf", "Recoverylogd.log", "https://asianleak.com/videos/8120/sg-cousin-showering-spy-cam", "auto_master", "arm64e-apple-macos.swiftinterface", "SensorKit.log", "irbrc", "netstat-PRE.txt", "fileproviderctl.log", "MAAutoAsset_Scheduler_History_07.log", "interfaceDetails.csv", "model_catalog_dump.txt", "Contacts.log", "caching.html", "OTA.log", "Info.plist", "diagnostics-configuration.txt", "BatteryHealth.log", "paths", "MAAutoAsset_Filesystem_History_04.log", "rpc", "AppConduit.log", "FDR.log", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "window.location.search", "MAAutoAsset_Error_History.txt", "MAAutoAsset_Locker_History_09.log", "MAAutoAsset_Atomic_History_02.log", "stackshots.log", "MAAutoAsset_Scheduler_History_03.log", "NetworkInterfaces.rtf", "SocialLayerPlist.log", "convenience.map", "LDAP.tbd", "gettytab", "MAAutoAsset_Locker_History_06.log", "JoinManagerState.txt", "NanoPreferencesSync.log", "E7B80B551D34E4BCDBC1E47D6AB627.rtf", "avconferenced-embedded.log" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "American International", "DragonForce Malaysia Hacker Group" ], "malware_families": [ "", "Goldfinder", "Quackbot", "Kryptik", "Win.trojan.generic-9801687-0", "Mimikatz", "Backdoor:msil/bladabindi.aj", "Win.virus.virlock-6804475-0", "Trojan:win32/floxif.e", "Trojanspy", "Ransomexx", "Ransomware", "Mirai", "Maltiverse", "Win.trojan.generic-6417450-0", "Alf:backdoor:msil/noancooe.ka", "Goldmax - s0588", "Win.dropper.njrat-10015886-0", "American international", "Tofsee", "Sibot", "Win.packed.generic-9795615-0\t.", "Trojan:msil/ranos.a", "Trojan:win32/installcore", "Raccoon stealer", "Skynet", "Immortal stealer", "Tinynote", "Lastname", "Emotet", "Win.packed.generic-9795615-0", "Win.packed.fecn-7077459-0", "Hacktool", "Gandcrab", "Nymaim", "Nanocore", "Artemis", "Nid", "Qbot", "Inmortal", "Azorult", "Backdoor:msil/bladabindi.aj gc!", "Ducktail", "Blacknet", "Firehol", "Hacktool.cheatengine", "Hacktool.bruteforce", "Comspec", "Neurovt", "Win.malware.bzub-6727003-0", "Trojanx", "Firstname", "Cobalt strike - s0154", "Win.packed.msilperseus-9956592-0", "Domains", "Yixun", "Hiddentear", "Looquer", "Opencandy", "Trojan:msil/clipbanker", "Quasar rat", "Chinese", "Webtoolbar", "Other malware", "Zerobot" ], "industries": [ "Health", "Reinsurance", "Travel" ], "unique_indicators": 167156 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/aogg.top", "whois": "http://whois.domaintools.com/aogg.top", "domain": "aogg.top", "hostname": "gy.aogg.top" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 33, "pulses": [ { "id": "692d02f096f3ec8b5b507496", "name": "Google Drive: Share Files Online with Secure Cloud Storage | Google Workspace", "description": "nJRAT | Corrupted Google Drive sent to targets former device. Years long social engineering may have been involved. All\nIoC\u2019s Appears to involve years of social engineering. Google\ndrive service in question is a storage service based in Vietnam. | \n\nBotnet / Check-ins / Spyware / Cams. [Anon Sec Botnet subdomain name pulsed. Close directly related to zalo.me\nand tbtteams.com]\nRequires further research.\n\nThis pulse is a bit confusing due where and who it originated from.", "modified": "2025-12-31T02:01:50.101000", "created": "2025-12-01T02:52:32.483000", "tags": [ "business", "enterprise", "drive", "english", "google drive", "try drive", "business small", "workspace", "sign", "strong", "find", "life", "tools", "protect", "cloud", "simple", "android", "indonesia", "video", "mb download", "shared may", "shared", "learn", "drive drive", "name date", "javascript", "dynamicloader", "medium", "minimal headers", "high", "observed get", "get http", "united", "yara rule", "http", "write", "guard", "malware", "read c", "ms windows", "intel", "png image", "rgba", "pe32", "get na", "explorer", "music", "virlock", "media", "ho chi", "minh city", "viet nam", "storage company", "limited", "google", "address as", "luutruso", "cloudflar", "domain", "asn15169", "asn56153", "asn13335", "cisco", "umbrella rank", "apex domain", "url https", "kb stylesheet", "kb font", "kb image", "image", "kb script", "november", "resource path", "size", "type mimetype", "primary request", "redirect chain", "kb document", "urls", "ck id", "name tactics", "suspicious", "informative", "adversaries", "command", "defense evasion", "spawns", "t1590 gather", "windir", "openurl c", "prefetch2", "tor analysis", "dns requests", "domain address", "rsdsq jfu", "ollydbg ollydbg", "wireshark", "external", "binary file", "mitre att", "ck matrix", "aaaa", "cong ty", "co phan", "code", "province hcm", "files", "ip address", "request", "flag", "country", "contacted hosts", "process details", "link initial", "t1480 execution", "domains", "moved", "gmt content", "all ipv4", "url analysis", "location viet", "title", "error", "problem", "url add", "related nids", "files location", "flag united", "development att", "name server", "markmonitor", "localappdata", "programfiles", "edge", "hyundai", "social engineering", ".mil", "hackers", "phishing eml", "summary", "cisco umbrella", "google safe", "browsing", "current dns", "a record", "ip information", "ipasns ip", "detail domain", "domain tree", "links apex", "transfer", "b script", "b stylesheet", "frame b830", "b document", "value", "december", "degurafregistry", "gat object", "jsl object", "gapijstiming", "iframe function", "domainpath name", "nid value", "source level", "files domain", "files related", "tags", "related tags", "virustotal", "foundry", "pulse otx", "dark", "vietnam", "present aug", "present nov", "present jul", "present sep", "unknown aaaa", "search", "name servers", "present oct", "trojan", "data upload", "extraction", "se https", "include review", "exclude sugges", "find s", "failed", "typ don", "faith", "study", "romeo\u2019s", "juliettes", "femme fatales", "strategy", "honey pot", "honey traps", "spy", "helix", "anons", "passive dns", "pulse pulses", "files ip", "address", "location united", "asn as400519", "whois registrar", "ms defender", "files matching", "number", "sample analysis", "hide samples", "date hash", "cameras", "cams", "spycam", "botnet", "vietnam", "company limited", "dnssec", "status", "india unknown", "present may", "espionage", "hostname add", "generic", "cnc activity", "backdoor", "ipv4", "anonsecbotnet", "iptv" ], "references": [ "drive.google.com/", "https://foundry2-lbl.dvr.dn2.n-helix.com/", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7aa2b182b17cfb5efb3367e0bc7b36e7088ab43a8fb21a772a0f8f90b7329d9", "zalo.me | href | Binary File | ATT&CK ID T1566.002", "https://account.helix.com/activate/start", "anonsecbotnet.cameraddns.net \u2022 cameraddns.net \u2022 http://iptv.cameraddns.net/cotich/ \u2022 http://iptv.cameraddns.net/cotichC \u2022", "https://iptv.cameraddns.net/kodi/zips/plugin.video.iptvjson]", "Terse Unencrypted Request for Google - Likely Connectivity Check", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7aa2b182b17cfb5efb3367e0bc7b36e7088ab43a8fb21a772a0f8f90b7329d9", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/d334c3220573f98da1a0eef13be9c8b0053447519b3a6ace3728bcffa10b99b6", "cpcalendars.hyundaibariavungtau3s.com \u2022 cpcontacts.hyundaibariavungtau3s.com", "https://hyundaibariavungtau3s.com/vehicle/stargazer", "https://hyundaibariavungtau3s.com/vehicle/ioniq-5", "https://hyundaibariavungtau3s.com/vehicle/new-hyundai-venue", "https://hyundaibariavungtau3s.com/vehicle/new-hyundai-palisade", "https://hyundaibariavungtau3s.com/vehicle/hyundai-custin", "https://hyundaibariavungtau3s.com/wp-content/themes/flatsome/inc/extensions/flatsome-live-search/", "https://delivery-mp-microsoft.dvrx.dn3.n-helix.com \u2022 https://dnsplay.dn2.n-helix.com", "https://dnss2.dn2.n-helix.com \u2022 https://dnssounib.dn2.n-helix.com/", "https://foundry2-lbl.dvr.dn2.n-helix.com/ \u2022 https://node8-serve.dvrx.dn3.n-helix.com \u2022 https://sfbambi-tel.dn2.n-helix.com \u2022 https://softlayer3.dn2.n-helix.com", "http://bjdclub.ru/out.phtml?www.skyxxxgals.info/feet-licking-porn/", "http://www.yayabay.com/forum/adclick.php?url=http%3a%2f%2fhkprice.info%2fpornstars%2f22466", "https://asianleak.com/videos/8120/sg-cousin-showering-spy-cam", "feedback-pa.clients6.google.com/v1/survey/trigger/", "https://feedback-pa.clients6.google.com/v1/survey/trigger/trigger_anonymous?key=AIzaSyD3LJeW4Q6gtdgJlyeFZUp-GhpIoc6EUeg", "anonsecbotnet.cameraddns.net \u2022 http://anonsecbotnet.cameraddns.net \u2022 https://anonsecbotnet.cameraddns.net" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Virus.Virlock-6804475-0", "display_name": "Win.Virus.Virlock-6804475-0", "target": null }, { "id": "Win.Malware.Bzub-6727003-0", "display_name": "Win.Malware.Bzub-6727003-0", "target": null }, { "id": "Win.Trojan.Generic-9801687-0", "display_name": "Win.Trojan.Generic-9801687-0", "target": null }, { "id": "NID", "display_name": "NID", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null }, { "id": "Trojan:Win32/Floxif.E", "display_name": "Trojan:Win32/Floxif.E", "target": "/malware/Trojan:Win32/Floxif.E" }, { "id": "Win.Dropper.njRAT-10015886-0", "display_name": "Win.Dropper.njRAT-10015886-0", "target": null }, { "id": "Win.Packed.Generic-9795615-0", "display_name": "Win.Packed.Generic-9795615-0", "target": null }, { "id": "Backdoor:MSIL/Bladabindi.AJ GC!", "display_name": "Backdoor:MSIL/Bladabindi.AJ GC!", "target": "/malware/Backdoor:MSIL/Bladabindi.AJ GC!" }, { "id": "Win.Packed.Generic-9795615-0\t.", "display_name": "Win.Packed.Generic-9795615-0\t.", "target": null }, { "id": "Backdoor:MSIL/Bladabindi.AJ", "display_name": "Backdoor:MSIL/Bladabindi.AJ", "target": "/malware/Backdoor:MSIL/Bladabindi.AJ" }, { "id": "Win.Packed.Fecn-7077459-0", "display_name": "Win.Packed.Fecn-7077459-0", "target": null }, { "id": "Trojan:MSIL/Ranos.A", "display_name": "Trojan:MSIL/Ranos.A", "target": "/malware/Trojan:MSIL/Ranos.A" }, { "id": "Win.Trojan.Generic-6417450-0", "display_name": "Win.Trojan.Generic-6417450-0", "target": null }, { "id": "ALF:Backdoor:MSIL/Noancooe.KA", "display_name": "ALF:Backdoor:MSIL/Noancooe.KA", "target": null }, { "id": "Win.Packed.Msilperseus-9956592-0", "display_name": "Win.Packed.Msilperseus-9956592-0", "target": null }, { "id": "Trojan:MSIL/ClipBanker", "display_name": "Trojan:MSIL/ClipBanker", "target": "/malware/Trojan:MSIL/ClipBanker" } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1194", "name": "Spearphishing via Service", "display_name": "T1194 - Spearphishing via Service" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1039", "name": "Data from Network Shared Drive", "display_name": "T1039 - Data from Network Shared Drive" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "display_name": "T1036.004 - Masquerade Task or Service" }, { "id": "T1444", "name": "Masquerade as Legitimate Application", "display_name": "T1444 - Masquerade as Legitimate Application" }, { "id": "T1567.002", "name": "Exfiltration to Cloud Storage", "display_name": "T1567.002 - Exfiltration to Cloud Storage" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1911, "hostname": 714, "FileHash-SHA256": 1304, "FileHash-MD5": 159, "FileHash-SHA1": 71, "SSLCertFingerprint": 2, "domain": 421, "CVE": 1, "email": 4 }, "indicator_count": 4587, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "109 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67fe9f3c682800301b89c556", "name": "Sitemap This page shows the most recent scans (manual, API, automatic) to be picked up by spiders.", "description": "https://urlscan.io/sitemap/", "modified": "2025-09-01T08:05:18.611000", "created": "2025-04-15T18:02:36.693000", "tags": [ "new run", "key pointing", "run key", "roth", "nextron", "markus neis", "sander wiebing", "public", "imagestartswith", "delnoderundll32", "vhash", "imphash", "rich pe", "ssdeep", "data sheetfinal", "wbn1", "mobil ip", "hsotu tin", "firmar", "statement", "ebook", "uwaaj moesz" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 168, "FileHash-MD5": 106, "FileHash-SHA1": 101, "FileHash-SHA256": 415, "hostname": 63, "domain": 61, "CVE": 1 }, "indicator_count": 915, "is_author": false, "is_subscribing": null, "subscriber_count": 122, "modified_text": "230 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68629f622fe936e3141a1ed0", "name": "APT33 (by ilyailya)", "description": "", "modified": "2025-06-30T14:29:54.892000", "created": "2025-06-30T14:29:54.892000", "tags": [ "apfs encryption", "adguard extra", "jumpcloud go", "chrome web", "store", "privacy badger", "safety checker", "stay", "mywot", "flowcrypt", "encrypt gmail", "simple", "facebook", "apollo", "future", "assistant", "excbreakpoint", "sigtrap", "excguard", "renderer", "vallumes", "excbadaccess", "sigsegv", "helper", "chrome helper", "exccrash", "rave scout", "cookies", "public folder", "browsersignin", "denyactivation", "disableoverride", "loginwindowtext", "jumpcloud", "disableairdrop", "enablefirewall", "macos14action", "macos13action", "showfullname", "arm64e", "apple m2", "mac142", "kjqqtw7pqt", "yubico", "daemon", "service", "server", "open directory", "account", "kerberos admin", "kerberos change", "io daemon", "device daemon", "network", "bridge", "desktop", "installer", "calendar", "screensaver", "agent", "adaptive", "interactive", "background", "standard", "launchd sandbox", "s mdworker", "command line", "cloud", "remote assist", "aesxtsarm", "aesecbarm", "darwin kernel", "version", "fri apr", "sha512vngarmhw", "sha384vngarmhw", "sha256vngarm", "sha1vngarm", "user", "coregraphics", "quartzcore", "dock", "corefoundation", "cgimage", "cgcolorspace", "load address", "identifier", "build info", "code type" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6816697e166bba8972d8d4a3", "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 125, "hostname": 402, "FileHash-SHA256": 38, "URL": 582, "CVE": 1 }, "indicator_count": 1148, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "293 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6816697e166bba8972d8d4a3", "name": "APT33", "description": "APT33", "modified": "2025-06-02T18:02:26.651000", "created": "2025-05-03T19:07:42.325000", "tags": [ "apfs encryption", "adguard extra", "jumpcloud go", "chrome web", "store", "privacy badger", "safety checker", "stay", "mywot", "flowcrypt", "encrypt gmail", "simple", "facebook", "apollo", "future", "assistant", "excbreakpoint", "sigtrap", "excguard", "renderer", "vallumes", "excbadaccess", "sigsegv", "helper", "chrome helper", "exccrash", "rave scout", "cookies", "public folder", "browsersignin", "denyactivation", "disableoverride", "loginwindowtext", "jumpcloud", "disableairdrop", "enablefirewall", "macos14action", "macos13action", "showfullname", "arm64e", "apple m2", "mac142", "kjqqtw7pqt", "yubico", "daemon", "service", "server", "open directory", "account", "kerberos admin", "kerberos change", "io daemon", "device daemon", "network", "bridge", "desktop", "installer", "calendar", "screensaver", "agent", "adaptive", "interactive", "background", "standard", "launchd sandbox", "s mdworker", "command line", "cloud", "remote assist", "aesxtsarm", "aesecbarm", "darwin kernel", "version", "fri apr", "sha512vngarmhw", "sha384vngarmhw", "sha256vngarm", "sha1vngarm", "user", "coregraphics", "quartzcore", "dock", "corefoundation", "cgimage", "cgcolorspace", "load address", "identifier", "build info", "code type" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 125, "hostname": 402, "FileHash-SHA256": 38, "URL": 582, "CVE": 1 }, "indicator_count": 1148, "is_author": false, "is_subscribing": null, "subscriber_count": 31, "modified_text": "320 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67f5555b6ce863d998e83e26", "name": "macOS Threat Infrastructure Leveraging Remote Agents via remotewd.com and rtmsprod.net", "description": "This pulse identifies an actively observed macOS-focused remote access infrastructure abusing trusted native Apple agents (ARDAgent.app, SSMenuAgent.app) and communicating with a distributed network of C2-like endpoints under domains such as remotewd.com, idsremoteurlconnectionagent.app, and rtmsprod.net.\n\nThe infrastructure is composed of dynamically generated subdomains \u2014 many in the form of device-.remotewd.com \u2014 indicative of automated deployment, system tracking, or per-host remote access configurations.\n\nAdditional indicators include HTTP/S URLs pointing directly to embedded binary paths within macOS agents, suggesting possible delivery vectors, staging, or persistence techniques.\n\nThis campaign shows signs of structured, programmatic targeting and is highly likely to be pre-operational infrastructure for wide-scale surveillance or access operations. All listed indicators should be considered high-risk. If observed in your environment, initiate a full forensic and IR process immediately.", "modified": "2025-05-11T19:03:59.885000", "created": "2025-04-08T16:56:59.641000", "tags": [ "generated from", "do not", "edit uri", "urls", "edit", "rewriteengine", "rewritecond", "rewriterule", "r301", "xml2encalias", "beralloct", "berbvarrayadd", "berbvarrayfree", "berbvdup", "berbvecadd", "berbvecfree", "berbvfree", "berdump", "berdup", "berdupbv", "laerrordomain", "laerrornoncekey", "lamechanismtree", "lacontext", "ladomainstate", "laenvironment", "lanotification", "laprivatekey", "lapublickey", "laright", "apple swift", "o librarylevel", "combine import", "foundation", "swift import", "mcpeerid", "mcsession", "property", "copyright", "protocol", "class", "bonjour", "ascii lowercase", "abc company", "section", "bonjour txt", "note", "ui element", "utf8 encoding", "nscopying", "nsdictionary", "nsstring", "mcextern", "attribute", "mcextern extern", "mcexternweak", "nsenum", "nsinteger", "mcerrorcode", "mcerrorunknown", "mcerrortimedout", "peer", "example", "bonjour apis", "stop", "tags", "session", "nsprogress", "nserror", "nsurl", "nsarray", "create", "nsuinteger", "notifies", "mcsession api", "interface", "dbictrace", "dbivporth", "dbictracelevel", "dbdtffoo", "dbihseterrchar", "dbicstate", "dbictraceflags", "provides macros", "dbi release", "only", "sqlsuccess", "odbc", "sqlok", "tim bunce", "england", "sql cli", "sql datatype", "sqlguid", "sqlwlongvarchar", "main", "beware", "sv sth", "sv dbh", "impsth", "impdbh", "sv keysv", "sv params", "sv attr", "sv attribs", "sv drh", "void", "fri jul", "mixed", "dbixsrevision", "plsvundef", "license", "spagain", "perlioprintf", "dbiclogpio", "putback", "ireland", "gnu general", "super", "magic", "dbicflags", "dbis", "svrv", "null", "imp2com", "dbicactivekids", "dbicfiadestroy", "sv h", "dbicdbistate", "code", "copy", "refer", "trace", "error", "unknown", "hookopcheckh", "startexternc", "hookopcheckcb", "userdata", "endexternc", "isinternalbuild", "kickmcxdforuid", "loadappkit", "ardconfig", "authenticator", "dsauthenticator", "dsnode", "dsrecord", "group", "hostconfig", "apfsvolumelock", "apfsvolumerole", "aoskgetosinfo", "aoskgetuserinfo", "aosaddappleid", "aosdisablepcs", "aosenablepcs", "aoslog", "aoslogforce", "aosrelaycookie", "didfailcallback", "kaosaccountkey", "kapcsbundle", "kapcspath", "kjsonextension", "apcsbucketid", "apcsreports", "apconfiguration", "apversiondata", "apversionhelper", "systemvolumesvm", "name size", "identifier", "gb disk0s3", "devdisk3", "apfs container", "scheme", "physical store", "macintosh hd", "apfs snapshot", "preboot", "refs address", "size wired", "name", "version", "uuid", "linked against", "renderer", "helper", "chrome helper", "contains", "cloud ui", "macintosh", "khtml", "gecko", "ui helper", "plugin", "service", "good", "battery power", "apfs encryption", "jumpcloud go", "chrome web", "store", "privacy badger", "flowcrypt", "encrypt gmail", "simple", "google", "b2b phone", "number", "apollo", "future", "exccrash", "sigkill", "code signature", "invalid", "sigabrt", "protonvpn", "excguard", "excbreakpoint", "sigtrap", "excbadaccess", "appl", "english", "adobe crash", "adobe", "acrobat dcadobe", "processor", "uninstaller", "assistant", "install", "cloud", "dock", "calendar", "music", "terminal", "tips", "installer", "updater", "proton", "tools", "stub", "python", "clock", "powershell", "team", "rave scout", "cookies", "public folder", "key cert", "sign", "crl sign", "root ca", "authority", "public primary", "global root", "verisign", "academic", "premium", "adaptive", "interactive", "background", "standard", "launchd sandbox", "s mdworker", "agent", "command line", "progress", "yubico", "macos13action", "disableoverride", "disableairdrop", "denyactivation", "enable", "loginwindowtext", "jumpcloud", "autoupdate", "loggingoption", "enablefirewall", "arm64e", "apple m2", "mac142", "kjqqtw7pqt", "daemon", "server", "open directory", "user", "account", "kerberos admin", "kerberos change", "device daemon", "network", "desktop", "screensaver", "bridge", "aesxtsarm", "aesecbarm", "sha512vngarmhw", "sha384vngarmhw", "sha256vngarm", "sha1vngarm", "darwin kernel", "wed mar", "wkarraycreate", "wkbooleancreate", "wkcontextcreate", "wkdatacreate", "wkdatagettypeid", "wkdoublecreate", "wkframecopyurl", "wkgettypeid", "wkimagecreate", "wkpagecandelete", "webview", "notice", "this software", "including", "but not", "limited to", "redistribution", "is provided", "by apple", "direct", "damage", "apiavailable", "webkit", "nsswiftname", "document", "a block", "as is", "hasinclude", "wkdownload", "abstract", "wkerrorcode", "wkerrorunknown", "discussion", "bool", "whether", "wkcontentworld", "wkwebview", "javascript", "nsunavailable", "vaargs", "nsswiftasync", "wkswiftasync", "wkcookiepolicy", "wkswiftuiactor", "nshttpcookie", "targetosiphone", "wknavigation", "decides", "boolean value", "apideprecated", "methodkind", "wkerrordomain", "wkscriptmessage", "promise", "fulfill", "const", "url scheme", "mark", "wkuserscript", "targetosvision", "param", "wkframeinfo", "targetosios", "pass", "window", "mime type", "link", "nsimage", "returns", "nsset", "checks", "matches", "a boolean", "defaults", "wkwebextension", "cgsize", "uiimage", "apis", "nsdate", "wkcontentmode", "wkextern", "possible", "cgfloat", "media", "cgrect", "apiunavailable", "framework", "nsswiftuiactor", "targetoswatch", "confirms", "apple upgrade", "nsstring user", "nsobject", "provider", "apple", "password", "uicontrol", "nscontrol", "asuseragerange", "check", "opaque user", "apple id", "initiate", "asauthorization", "operation", "state", "nserrorenum", "nsdata", "relying party", "asapiavailable", "perform", "realm", "http response", "authorization", "http", "oauth", "saml", "a byte", "nsdata userid", "relying", "a string", "nsdata readdata", "bool didwrite", "a cose", "nsdata first", "nsdata second", "nsstring name", "bool appid", "targetosxr", "nsstring appid", "bluetooth", "mdm profile", "nsurl url", "returns yes", "a state", "a json", "web token", "private seckeys", "enables", "keychain", "asswiftsendable", "cose algorithm", "ecdsa", "sha256", "cose curve", "p256", "nullable", "bool success", "remove", "call", "complete", "initializes", "time code", "extensions", "asextern extern", "asextern", "nsswiftsendable", "prepare", "list", "nsextension", "attempt", "nsstring label", "creates", "nsstring code", "a key", "webauthn", "nssecurecoding", "input", "output", "initialize", "nsinteger rank", "json", "inputs", "hash", "nsstring origin", "settings app", "extension", "https urls", "safari", "cancel", "nsuuid uuid", "r uftpexu", "nsmutabledata", "vnsdate", "mprcjy", "postfix", "domain", "canonical", "tables", "ldap", "post", "replace user", "address", "wietse venema", "bugs", "mail", "aliases", "postfix version", "restrict", "sample", "person", "basic system", "general", "reject empty", "postfix smtp", "ipv6 host", "reject", "reply", "access", "prior", "hold", "info", "mail delivery", "charset", "system", "report", "postfix dsn", "mail returned", "this", "generic", "smtp", "isp mail", "mime", "headerchecks", "readme files", "filters while", "posix", "empty", "body", "write", "date", "smtp server", "specify", "mx host", "unix password", "user unknown", "pathbin", "postfix queue", "unix", "cyrus", "path", "uucp", "shell", "local", "program", "agreement", "contributor", "recipient", "contribution", "the program", "corporation", "contributors", "product x", "as expressly", "arch", "arch x8664", "pipe wall", "wimplicit", "ranlib", "warn", "switch", "start", "systype", "outlook", "postfix master", "begin", "server admin", "mail backend", "modern smtp", "iana", "many", "postfix pipe", "recent cyrus", "amos gouaux", "old example", "or even", "lutz jaenicke", "technology", "cottbus", "germany", "openssl package", "openssl project", "europe", "remember that", "use of", "file", "update", "usrsbin", "file format", "no group", "daemondirectory", "deliver mail", "transport", "description", "result format", "virtual", "virtual alias", "redirect mail", "relocated", "matches user", "synopsis", "lastname", "firstname", "apple computer", "tcpip", "supported", "quantum", "facility", "level", "level info", "broadcast", "ignore", "rules", "sender", "automounter map", "use directory", "get home", "home autohome", "true", "t option", "mount", "force", "environment", "automountdenv", "promptcommand", "shellsessiondir", "histfile", "histfilesize", "myvar", "histtimeformat", "arrange", "bashrematch", "tell", "ps1h", "make bash", "s checkwinsize", "etcbashrc", "termprogram", "inpck", "nnnbaud", "berkeley", "parity", "pc entry", "pass8", "parenb istrip", "fixed speed", "entry", "clocal mode", "maxhistsize", "promptmode", "verbose end", "etcirbrcloaded", "default", "setup", "history file", "kernel", "readline", "jabber", "group database", "dovecot", "postfix scsd", "networkd", "searchpaths", "freebsd", "tmpdir", "fcodes", "prunepaths", "vartmp", "prunedirs", "filesystems", "nroff", "manpath", "uncomment", "manpager", "whatispager", "manlocale", "every", "manpath optman", "maybe", "troff", "status mailfrom", "returnpath via", "pidfile", "flags", "bcgjnuwz", "bin usrsbin", "sbin", "default pf", "care", "audio", "user database", "unix copy", "gate daemon", "bashno", "r etcbashrc", "rfc1323", "m1460", "macos x", "signature", "linux", "opera", "xp sp1", "windows sp1", "nmap syn", "m265", "synack", "mind", "macos", "warp", "ipv6", "internet", "icmp", "cisco", "monitoring", "argus", "chaos", "rsvp", "encapsulation", "aris", "isis", "netbootmount", "netbootshadow", "computername", "localonly", "localnetbootdir", "netboot", "define", "purpose", "networkonly", "waiting", "networkup", "term", "devnull", "common setup", "configure", "set command", "dns hostname", "dns query", "see also", "kame", "sunnet manager", "rpcsrc", "netlicense", "ftpd", "bindash binksh", "binsh bintcsh", "jumpcloud ldap", "smb2", "security", "workgroup", "standalone", "samba server", "enforce", "smb3", "example share", "improper use", "ctrlc", "none", "fax reception", "hardwired", "0007", "must", "visudo", "blocksize", "charset lang", "language lcall", "lines columns", "lscolors", "sshauthsock", "orion", "setup user", "home", "zdotdir", "delete", "beep", "vendor", "kf10", "kf11", "kf12", "kf13", "backspace", "insert", "resume", "termsessionid", "savehist", "sharehistory", "h do", "volume", "de l", "l uuid", "m tra", "n est", "suuid", "prfen", "fusion", "syst", "look", "executant", "alla", "over", "test", "overie", "zapis", "rapid", "disco usa", "de macos", "nie s", "i denne", "adgjmpsvx", "diskgthis disk", "01k8x j", "34disk", "levy kytt", "dict", "array", "plist", "apple root", "code signing", "inode64r", "xofkoxzh", "integer", "doctype", "brain", "abcd", "ogwo", "boaw", "cobwa", "uhawavauatsh", "ip bitmap", "foewdc", "could", "ip block", "funcs", "cogwo", "trash", "double", "hunt", "affa", "carr", "crypto", "docwbac", "q1b0", "q1 0", "h h5", "docwbag", "slice", "format", "zero", "alfa", "hera", "lelei", "hehe", "hisp", "fail", "katy", "zakk", "eodwcbgao", "hhk8di", "alma", "topo", "open", "huhk", "piper", "hehx", "eh ui", "h20hph", "hif h", "hmhhihqhyla hq", "r11b0", "target", "uus10u", "hifh", "loghookfailed", "loghook", "hell", "q1b 0", "f duh", "aqw1", "1160" ], "references": [ "index.html.en", "bind.html", "caching.html", "BUILDING", "configuring.html", "content-negotiation.html", "custom-error.html", "convenience.map", "LDAP.tbd", "lber.h", "ldap.h", "LocalAuthentication.tbd", "arm64e-apple-macos.swiftinterface", "x86_64-apple-ios-macabi.swiftinterface", "arm64e-apple-ios-macabi.swiftinterface", "x86_64-apple-macos.swiftinterface", "MultipeerConnectivity.tbd", "module.modulemap", "MCNearbyServiceAdvertiser.h", "MCPeerID.h", "MCError.h", "MCNearbyServiceBrowser.h", "MCAdvertiserAssistant.h", "MultipeerConnectivity.apinotes", "MultipeerConnectivity.h", "MCSession.h", "MCBrowserViewController.h", "dbivport.h", "dbi_sql.h", "dbd_xsh.h", "dbixs_rev.h", "Driver_xst.h", "DBIXS.h", "hook_op_check.h", "Admin.tbd", "AirPlayReceiver.tbd", "apfs_boot_mount.tbd", "AOSKit.tbd", "APConfigurationSystem.tbd", "AppleFirmwareUpdate.tbd", "launchdaemons.txt", "preboot_archive_errors.log", "mounts.txt", "launchagents.txt", "disk_structure.txt", "user_launchagents.txt", "security_status.txt", "kexts.txt", "process_list.txt", "battery.csv", "diskEncryption.csv", "chromeExtensions.csv", "crashes.csv", "interfaceAddrs.csv", "kernel.csv", "interfaceDetails.csv", "etcHosts.csv", "applications.csv", "mounts.csv", "sharedFolders.csv", "certificates.csv", "sharingPreferences.csv", "launchD.csv", "usbDevices.csv", "managedPolicies.csv", "systemInfo.csv", "users.csv", "sipConfig.csv", "systemControls.csv", "canonical", "aliases", "custom_header_checks", "access", "bounce.cf.default", "generic", "header_checks", "main.cf.default", "LICENSE", "makedefs.out", "main.cf", "master.cf.default", "main.cf.proto", "master.cf.proto", "master.cf", "TLS_LICENSE", "postfix-files", "transport", "virtual", "relocated", "afpovertcp.cfg", "asl.conf", "auto_home", "auto_master", "autofs.conf", "bashrc_Apple_Terminal", "com.apple.screensharing.agent.launchd", "bashrc", "command_args.json", "csh.cshrc", "csh.login", "find.codes", "csh.logout", "ftpusers", "gettytab", "irbrc", "kern_loader.conf", "group", "locate.rc", "man.conf", "mail.rc", "manpaths", "networks", "nfs.conf", "newsyslog.conf", "ntp_opendirectory.conf", "ntp.conf", "notify.conf", "paths", "pf.conf", "passwd", "profile", "pf.os", "protocols", "rc.netboot", "rc.common", "rmtab", "resolv.conf", "rtadvd.conf", "rpc", "shells", "smb.conf", "sudo_lecture", "ttys", "syslog.conf", "xtab", "sudoers", "zprofile", "zshrc", "zshrc_Apple_Terminal", "CodeResources", "version.plist", "Info.plist" ], "public": 1, "adversary": "DragonForce Malaysia Hacker Group", "targeted_countries": [], "malware_families": [ { "id": "Lastname", "display_name": "Lastname", "target": null }, { "id": "Firstname", "display_name": "Firstname", "target": null } ], "attack_ids": [ { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 66, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 4449, "domain": 3847, "URL": 14263, "FileHash-SHA256": 2356, "FileHash-MD5": 223, "FileHash-SHA1": 523, "email": 223, "CVE": 40, "CIDR": 12, "SSLCertFingerprint": 302 }, "indicator_count": 26238, "is_author": false, "is_subscribing": null, "subscriber_count": 35, "modified_text": "342 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6783747341bbde9b111920d8", "name": "SP10 \u2013 Szko\u0142a Podstawowa nr 10 im. Marii Sk\u0142odowskiej-Curie w Jeleniej G\u00f3rze", "description": "CVE-2024-1975\nHere is a full list of annotations and links to the work of the University ofzechoslovakia's research team, which has been working on the topic for the past two years. \u00c2\u00a31.", "modified": "2025-02-11T07:03:07.817000", "created": "2025-01-12T07:51:13.989000", "tags": [ "user", "datamodule info", "sha256", "ssdeep", "hashes cape", "sandbox", "zenbox", "file system", "color space", "cache c", "shell" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "FileHash-MD5": 9, "FileHash-SHA1": 1, "FileHash-SHA256": 4, "URL": 248, "hostname": 39, "CVE": 2 }, "indicator_count": 331, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "432 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66fae0cea9dbd082c30e30ea", "name": "The Jane Syndrome Files: Espionage-Grade Apple iPhone Infiltration", "description": "Here is a full list of details about Apple's latest operating system (OS) and the services it offers: DNS poisonings, network insecurities, malware, malicious script injections.", "modified": "2024-10-30T16:01:07.364000", "created": "2024-09-30T17:33:02.318000", "tags": [ "disabled awdl", "awdl", "status ipv6", "mode", "off awdl", "auto", "discovery", "disabled", "status power", "mac address", "f5 discoverable", "scanning", "current network", "wifi", "security", "wpa2 personal", "legacy", "ipv6", "count", "interval", "timestamp name", "open", "begin", "d71ff", "status", "begin wifi", "collect", "end wifi", "logs", "dump", "end corecapture", "cache", "stats", "cfnetwork", "could", "could ping", "dns server", "duration result", "description", "reach apple", "ping lan", "resolve dns", "number", "guard period", "errors summary", "report guard", "scan psf", "period ranges", "aw errors", "summary", "ap stats", "ap status", "period", "i en0", "airport sync", "airport network", "rave scout", "salman", "scout iphone", "guest agrp", "guest mdat", "items", "status primary", "ipv4", "interface", "nonpsc", "active", "address", "method", "supported", "status mac", "ssid", "bssid", "rssi", "tx rate", "mbps security", "congested wifi", "channel", "current channel", "ht40", "networks", "ht40 network", "wifi cc", "mcastaesccm", "mcasttkip", "fiosd8f6r", "jparadise", "bradstevens", "hazelnuthut", "karen dave", "fios", "brookleyroad", "mobile", "gator", "mach virtual", "memory", "never", "command", "execution time", "timeout", "max rss", "o user", "o ppid", "usrbintaskinfo", "a registry", "ioservice", "state", "executing task", "cpu time", "child process", "cpuwall", "cputimeout", "task container", "handshake", "tmpoutputdir", "executing", "phase", "locker", "atomic", "error", "companion", "savage", "demo", "trigger", "caller", "autounlock", "macbook air", "leaflifetime", "evaluationtime", "afterctflagday", "anchorsource", "validstatus", "numberscts", "mmcs", "unknown", "lmdc", "fssnapshot", "fpck", "fpsnapshot", "fpckrunreason", "iphone", "version", "product type", "os build", "appleinternal", "cpuarchitecture", "chipid", "hwmodel", "d53gap", "hassep", "ap1i", "ap1p", "ap1v", "b0ti", "d1pt", "iq0b", "iq1b", "mbse", "adce", "aopc", "bupt", "chcc", "chif", "upof", "waps", "warp", "wass", "default filters", "size limit", "mb on", "done enforcing", "file", "candidate", "filters", "enforcing size", "limit", "added", "predicate not", "file past", "beginswith", "endswith", "excresource", "analytics", "predicate", "not self", "contains", "max size", "matches", "osvalueobject", "ioport", "ioregistryentry", "iopower", "ioaccessory", "iousb", "iodevicetree", "root", "class", "wcfb", "gtd0x0 dtb", "rfrs", "adfh", "adhf", "vbwr", "vbrr", "cfdwc", "cfdrc", "dlwd", "gcrd", "gccan1 gcmust0", "gccan0 gcmust0", "erase quantile", "bad blocks", "max band", "eol erase", "user partition", "indpoolfree", "key1242", "timestamp", "weightedra", "qmax0", "cyclecount", "timeathighsoc", "chargingvoltage", "bhserviceflags", "04430", "familycode", "vacvoltagelimit", "53685452100", "53685452811", "1284430", "53685452411", "04410", "11524410", "53685452401", "1284410", "10244410", "11534410", "11524430", "10244430", "11534430", "53685451811", "53685451911", "chemid", "algochemid", "eeee", "designcapacity", "presentdod0", "currentcapacity", "ischarging", "temperature", "amperage", "instantamperage", "voltage", "stateofcharge", "chargeaccum", "chargingstate", "inflowstate", "chargelimit", "checkpoint", "decisionmaker", "modeofoperation", "af96b", "begin bluetooth", "b590b", "e97d3", "e1306", "certificate", "start", "status code", "sameorigin body", "xsannwhh5zixhy", "debug", "sun sep", "thu sep", "notice", "fri sep", "unbrick", "dcrt reissue", "commcenter fri", "sat sep", "commcenter sun", "data", "plist", "dict", "post useragent", "dcrt", "body", "doctype", "public", "pkitruststore", "download", "autolocker", "autojob", "data container", "installing", "ls save", "ls operation", "customer", "lsinstalltype", "miinstaller", "staging", "update", "consumed", "missingvalue", "raptor certs", "full service", "pinged configd", "cachedata", "cacheextra", "gmt4", "boot session", "bonjour", "f0fs24 cf0", "xml version", "appledtd plist", "adapter", "sen097", "wairport97", "t3gpp u8721", "u960 u8747", "bae69693u8719", "c2cb", "f1f49791page", "c4 e8", "page", "xethernet97", "sen1u8260", "u8721 u8719", "u8805 a5u8706", "a5u8706 u8721", "u8719 u960", "u8800 c6d8u8734", "b1u8804 u8805", "u8747 aabau937", "u64258 u8800", "u8747 u8776", "u64257 u64258", "u305 u8710", "u63743", "u8260", "u8805 u8706", "u731 u711", "u731", "u733", "time", "time secs", "uuid", "osversion", "lqmlogging", "su ms", "nb nrs", "na cm", "ex tf", "ffp mret", "highband", "ghz sep", "noise 88", "capture", "interfacelogs", "disabledatapath", "role lowlatency", "enabledatapath", "tx submission", "queue sep", "disablesync", "txsubq sep", "datapath", "printdatapath", "txsub disable", "txsub enable", "awdl prox", "awdl interface", "appleolyhal", "iopcidevice", "iopcidevice sep", "appleolyhallog", "pktsec", "mbitssec", "txreported", "u0 m0", "rxmacst", "monitor0 vif", "ff input", "pmopen", "rssi 100", "flushed", "rssi threshold", "service", "p2p concurrency", "allowed", "multicast", "unicast", "p2p interface", "off configured", "host edge", "awdl0", "awdl state", "configured", "d12c2680", "monitor18 vif", "transition", "wait", "device sleep", "device wake", "device active", "pending", "pnd0", "exit", "int state", "tx power", "cap config", "device tree", "ps params", "dtim", "motion profile", "womp disabled", "region info", "lla prefer", "prefer", "moving", "logic", "config", "wlcgetbssinfo", "queue", "check que", "wd scheduled1", "curr", "configure wd", "history", "wlcsetlrl", "wlcgetcountry", "debuggable", "eventbitfield", "fwid 01b0ec0e2e", "d53gap build", "device serial", "file name", "wme acm", "frequestiotx", "busytags", "peer", "u409224", "u527236 m103198", "monitor2827", "totaldropped0", "queue status", "totalflushed0", "tx completion", "rx completion", "fault report", "logging rx", "join mgr", "backpl", "85 85", "fl2 rt601", "bsside2", "rssi avg", "41 48", "44 42", "46 48", "43 42", "io80211 scan", "updated", "mpdus", "chanspec", "roam candidate", "logtransition", "cache channels", "scan home", "infra", "filesystem size", "avail capacity", "devdisk1s1", "dev devdisk1s6", "devdisk1s3", "calls", "file defrag", "metadata", "write", "object cache", "read", "fx defrag", "vnopallocate", "vnopblktooff", "meta", "user pid", "cpu stat", "pri stime", "utime command", "ppid f", "mem pri", "ni vsz", "rss wchan", "started time", "wd scheduled0", "e666293574", "monitor38 vif", "u2642957", "u4321860 m8433", "monitor9744", "b7c5a", "fl2 rt3505", "43 43", "bssid00", "lightphoneii", "43 44", "44 44", "rx data", "f4e0wf", "session", "cached", "access", "integer not", "null default", "null", "text not", "from", "text unique", "where", "order by", "not null", "bool not", "expected t", "nsdata", "unique", "integer primary", "array", "hard", "u63743 fceae8" ], "references": [ "awdl_status.txt", "arp.txt", "bluetooth_status.txt", "com.apple.wifi.syncable-networks.legacy.plist", "com.apple.wifi.syncable-networks.plist", "diagnostics-configuration.txt", "debug-log.txt", "diagnostics-connectivity.txt", "com.apple.wifi.recent-networks.json", "ifconfig.txt", "leaky_ap_stats.txt", "netstat-POST.txt", "mobilewifitool.txt", "security.txt", "netstat-PRE.txt", "network_status.txt", "wifi_datapath-PRE.txt", "wifi_scan_cache.txt", "wifi_logarchive.log", "wifi_datapath-POST.txt", "wifi_status.txt", "diagnostics-environment.txt", "wifi_scan.txt", "vm_stat.txt", "transparency.log", "tzDataVersion.log", "tailspin-info.txt", "taskSummary.csv", "sysdiagnose.log", "security-sysdiagnose.txt", "fileproviderctl_check.log", "hpmDiagnose.txt", "fileproviderctl.log", "hidutil.plist", "remotectl_dumpstate.txt", "smcDiagnose.txt", "BridgeReporting.log", "BridgeActivation.log", "AppConduit.log", "appinstallation.log", "AlishaLogs.log", "ASPSnapshots.log", "AppSupport.log", "astro.log", "AUDeveloperSettings.log", "ATVUpdateLog.log", "AVConference.log", "atcrtcomm.log", "BatteryBDC.log", "avconferenced-embedded.log", "BatteryIntelligence.log", "BluetoothAccessory.log", "BluetoothCoreDump.log", "BatteryHealth.log", "BatteryUIPlist.log", "brctl.log", "BASEBAND_TS_TRIGGER.log", "BTPHY.log", "Burnin.log", "Buddy.log", "CacheDeleteHistory.log", "CalendarPreferences.log", "CMCaptureTailspins.log", "CompanionSync.log", "CommandAndControl.log", "Contacts.log", "coreaudio_reporting.log", "CoreCapture.log", "copySpringBoardStateDump.log", "CoreLocation.log", "CoreCaptureBT.log", "crashes_and_spins.log", "cts.log", "coremediacapture-afdebug.log", "DarwinInit.log", "demod.log", "DataMigration.log", "FDR.log", "diagnostic_summary.log", "ForceResetTailspins.log", "Frametracer.log", "fsck.log", "FindMyDevice.log", "HangTracerTailspins.log", "GenerativeExperiences.log", "Harmony.log", "HIDCrashlogs.log", "HCI.log", "HomePodSetUp.log", "hidfw-crashlogs.log", "itunesstored.log", "LivabilityApp.log", "keyboard_cache.log", "LaunchServices.log", "MailErrorConditions.log", "MapsSyncJournal.log", "MatchTailspins.log", "MCState.log", "MCUCoreDumps.log", "MediaserverdBlockageTailspins.log", "MemoryExceptions.log", "MobileActivation.log", "microstackshots.log", "LogStreamFilter.log", "Mobile_Demo.log", "MobileInstallation.log", "MobileBackup.log", "MobileKeybagLogs.log", "MobileAssetHistory.log", "launchdLogs.log", "MobileSlideShow.log", "MobileLockdown.log", "MobileObliteration.log", "MobileSlideShowPrivateData.log", "MSU.log", "MobileStoreDemo.log", "NanoPreferencesSync.log", "NanoRegistry.log", "NSURLSession_logs.log", "Networking.log", "NetworkRelay.log", "ondemandd.log", "olddsc.log", "OTA.log", "OSEligibility.log", "OTAUpdateLogs.log", "Panics.log", "Personalization.log", "parsecd.log", "powerlogs.log", "process_proxied_device_logs.log", "ProactiveInputPredictions.log", "Preferences.log", "Proximity.log", "ProtectedCloudStorage.log", "RecentHangTracerTailspins.log", "RunningBoard.log", "Recoverylogd.log", "Resource_Exhaustion.log", "SensorKit.log", "SiriTextToSpeech.log", "Sentry.log", "Siri.log", "SiriAnalytics.log", "SleepCycler.log", "SocialLayerPlist.log", "spindump-meta-collection.log", "SplunkHistory.log", "stackshots.log", "SUInfo.log", "StoreServices.log", "SystemVersion.log", "Splat_Versioning.log", "syslog.log", "tailspin-history.log", "ThermalLogs.log", "tailspin-info-ts.log", "Trial.log", "UARP_Packet_Capture.log", "TetheredRestore.log", "UnifiedAsset.log", "time-sensitive-stackshot.log", "TimezoneDB.log", "unnamed_tasks.log", "UARPEndpointPacketCaptures.log", "SpaceAttributionTelemetry.log", "usermanagerd_logs.log", "VideoProcessing.log", "watchdog.log", "WindowServerHangs.log", "WiFi.log", "watchdogd_ddts.log", "asptool_snapshot_timesensitive.log", "asptool_snapshot.log", "acLog.plist", "atcrtcomm.txt", "BDC_Daily_version2.6_2024-08-29_00:19:16.csv", "BDC_Daily_version2.8_2024-09-22_16:06:26.csv", "BDC_Daily_version2.8_2024-09-13_17:49:14.csv", "BDC_Daily_version2.6_2024-09-04_12:00:11.csv", "BDC_Daily_version2.8_2024-09-21_13:45:08.csv", "BDC_OBC_version2.6_2024-08-29_00:19:14.csv", "BDC_OBC_version2.6_2024-09-13_16:25:59.csv", "BDC_OBC_version2.8_2024-09-18_23:12:12.csv", "BDC_OBC_version2.8_2024-09-14_00:28:48.csv", "BDC_OBC_version2.8_2024-09-13_23:35:57.csv", "BDC_OBC_version2.8_2024-09-14_13:32:02.csv", "BDC_OBC_version2.8_2024-09-29_15:16:41.csv", "BDC_Once_version2.6_2024-08-29_00:19:16.csv", "BDC_Once_version2.8_2024-09-13_17:49:16.csv", "BDC_SBC_version2.6_2024-09-02_20:27:16.csv", "BDC_SBC_version2.6_2024-08-29_00:19:16.csv", "BDC_SBC_version2.6_2024-09-03_11:48:00.csv", "BDC_SBC_version2.6_2024-09-11_00:27:57.csv", "BDC_SBC_version2.6_2024-09-04_13:21:06.csv", "BDC_SBC_version2.6_2024-09-04_12:00:11.csv", "BDC_SBC_version2.6_2024-09-03_00:11:37.csv", "BDC_SBC_version2.6_2024-09-13_16:26:54.csv", "BDC_SBC_version2.6_2024-09-13_16:16:55.csv", "BDC_SBC_version2.6_2024-09-08_17:52:28.csv", "BDC_SBC_version2.6_2024-09-13_02:10:48.csv", "BDC_SBC_version2.6_2024-09-12_02:07:40.csv", "BDC_SBC_version2.8_2024-09-13_17:54:28.csv", "BDC_SBC_version2.6_2024-09-13_17:07:26.csv", "BDC_SBC_version2.8_2024-09-13_17:49:18.csv", "BDC_SBC_version2.8_2024-09-14_00:28:50.csv", "BDC_SBC_version2.8_2024-09-18_03:20:38.csv", "BDC_SBC_version2.8_2024-09-18_23:12:15.csv", "BDC_SBC_version2.8_2024-09-14_13:32:04.csv", "BDC_SBC_version2.8_2024-09-21_13:45:07.csv", "BDC_SBC_version2.8_2024-09-22_05:55:57.csv", "BDC_SBC_version2.8_2024-09-23_19:56:36.csv", "BDC_SBC_version2.8_2024-09-17_01:27:03.csv", "BDC_SBC_version2.8_2024-09-23_21:27:40.csv", "BDC_SBC_version2.8_2024-09-24_19:36:33.csv", "BDC_SBC_version2.8_2024-09-14_01:16:12.csv", "BDC_SmartCharging_version2.6_2024-09-02_20:25:09.csv", "BDC_SmartCharging_version2.6_2024-08-29_00:21:46.csv", "BDC_SmartCharging_version2.6_2024-09-03_04:09:12.csv", "BDC_SmartCharging_version2.6_2024-09-03_11:48:07.csv", "BDC_SmartCharging_version2.6_2024-09-03_00:11:44.csv", "BDC_SmartCharging_version2.6_2024-09-04_12:00:20.csv", "BDC_SmartCharging_version2.6_2024-09-04_13:19:02.csv", "CacheDeletePurgeHistory.txt", "FDRDiagnosticReport.plist", "GEAvailability.log", "IOSADiagnose.log", "version", "akd_dcrt_baa_response.txt", "mobileactivationd.log.0", "akd_dcrt_baa_request.txt", "MAAutoAsset_Atomic_History_00.log", "MAAutoAsset_Atomic_History_02.log", "MAAutoAsset_Atomic_History_01.log", "MAAutoAsset_Atomic_History_03.log", "MAAutoAsset_Atomic_History_05.log", "MAAutoAsset_Atomic_History_04.log", "MAAutoAsset_Atomic_History_09.log", "MAAutoAsset_Atomic_History.txt", "MAAutoAsset_Atomic_History_08.log", "MAAutoAsset_Error_History_00.log", "MAAutoAsset_Atomic_History_06.log", "MAAutoAsset_Error_History_02.log", "MAAutoAsset_Error_History_04.log", "MAAutoAsset_Error_History_05.log", "MAAutoAsset_Error_History_08.log", "MAAutoAsset_Error_History.txt", "MAAutoAsset_Filesystem_History_01.log", "MAAutoAsset_Error_History_06.log", "MAAutoAsset_Error_History_09.log", "MAAutoAsset_Error_History_07.log", "MAAutoAsset_Filesystem_History_03.log", "MAAutoAsset_Filesystem_History_02.log", "MAAutoAsset_Filesystem_History_04.log", "MAAutoAsset_Filesystem_History_05.log", "MAAutoAsset_Filesystem_History_08.log", "MAAutoAsset_Filesystem_History_09.log", "MAAutoAsset_Filesystem_History_06.log", "MAAutoAsset_Filesystem_History_00.log", "MAAutoAsset_Filesystem_History_07.log", "MAAutoAsset_Filesystem_History.txt", "MAAutoAsset_Locker_History_00.log", "MAAutoAsset_Locker_History_01.log", "MAAutoAsset_Locker_History_03.log", "MAAutoAsset_Locker_History_06.log", "MAAutoAsset_Locker_History_02.log", "MAAutoAsset_Locker_History_04.log", "MAAutoAsset_Locker_History_05.log", "MAAutoAsset_Locker_History_07.log", "MAAutoAsset_Scheduler_History_00.log", "MAAutoAsset_Locker_History.txt", "MAAutoAsset_Locker_History_08.log", "MAAutoAsset_Scheduler_History_03.log", "MAAutoAsset_Scheduler_History_02.log", "MAAutoAsset_Scheduler_History_04.log", "MAAutoAsset_Scheduler_History_01.log", "MAAutoAsset_Locker_History_09.log", "MAAutoAsset_Scheduler_History_07.log", "MAAutoAsset_Scheduler_History_08.log", "MAAutoAsset_Scheduler_History_05.log", "MAAutoAsset_Scheduler_History_06.log", "MAAutoAsset_Scheduler_History.txt", "MAAutoAsset_Scheduler_History_09.log", "MAAutoAsset_Secure_History_01.log", "MAAutoAsset_Secure_History_00.log", "MAAutoAsset_Secure_History_04.log", "MAAutoAsset_Secure_History_05.log", "MAAutoAsset_Secure_History_03.log", "MAAutoAsset_Secure_History_07.log", "MAAutoAsset_Secure_History_08.log", "MAAutoAsset_Secure_History_06.log", "MAAutoAsset_Secure_History_09.log", "MAAutoAsset_Stager_History_01.log", "MAAutoAsset_Stager_History_02.log", "MAAutoAsset_Stager_History_00.log", "MAAutoAsset_Secure_History.txt", "MAAutoAsset_Stager_History_03.log", "MAAutoAsset_Stager_History_05.log", "MAAutoAsset_Stager_History_07.log", "MAAutoAsset_Stager_History_04.log", "MAAutoAsset_Stager_History_08.log", "MAAutoAsset_Stager_History_06.log", "MAAutoAsset_Stager_History_09.log", "MAAutoAsset_Stager_History.txt", "mobile_installation.log.0", "mobile_installation.log.1", "mobile_installation_helper.log.0", "lockdownd.log", "SUCoreSplunkHistory.log", "model_catalog_dump.txt", "model_manager_dump.json", "com.apple.networkextension.necp.rtf", "preferences.rtf", "NetworkInterfaces.rtf", "com.apple.networkextension.rtf", "com.apple.networkextension.uuidcache.rtf", "com.apple.networkextension.cache.rtf", "com.apple.networkextension.control.rtf", "Entity_2024-09-29 22:12:50.359_Blacklist.csv", "capture.rtf", "system.rtf", "[2024-09-29_22,12,45.966405]-LQMLogging-001.txt", "[2024-09-29_22,12,45.960131]-Interface_SoftAP_0-001.txt", "[2024-09-29_22,12,56.122877]-Interface_LowLatency_0-001.txt", "[2024-09-29_22,12,56.815468]-Interface_Infrastructure_0-001.txt", "[2024-09-29_22,12,56.591747]-Interface_AirLink_0-001.txt", "[2024-09-29_22,12,56.327440]-uartFirmwareLogs-001.txt", "[2024-09-29_22,12,56.457960]-AppleOLYHAL_log-001.txt", "AddFileList.txt", "ap1_AllPeersVerbose_IO80211PeerManager.txt", "awdl0_PrintState_IO80211AWDLPeerManager.txt", "awdl0_AllPeersVerbose_IO80211AWDLPeerManager.txt", "BusState.txt", "ConfigManagerState.txt", "CommanderState.txt", "CoreState.txt", "DeviceInfo.xml", "en0_AllPeersVerbose_IO80211PeerManager.txt", "en0_PrintState_IO80211PeerManager.txt", "InterfaceState_apsta.txt", "ap1_PrintState_IO80211PeerManager.txt", "FaultReportState.txt", "History.txt", "InterfaceState_prox.txt", "ivars->fChannelSwitchDictionary[0].xml", "InterfaceState_llw.txt", "JoinManagerState.txt", "ivars->fChannelSwitchDictionary[1].xml", "InterfaceState_skywalkinfra.txt", "ScanManagerState.txt", "LowLatencyRxCompRing", "MMIO_Log.txt", "SoC_Registers.xml", "LowLatencyTxCompRing", "NetManagerState.txt", "[2024-09-29_22,12,56.477273]-AppleBCMWLAN_Logs-001.txt", "disks.txt", "apfs_stats.txt", "oslog_archive_error.log", "ps_thread.txt", "971A5878D635EB8B262FF791353234.rtf", "B730B951A932F5AE2648F478FDDA81.rtf", "E7B80B551D34E4BCDBC1E47D6AB627.rtf", "2B553D16843D7B9CD7A4504A96CF2F.rtf", "594CB14E19331E8CFB5365144D46C4.rtf", "DE90FBA8603371B106DDEC727E696D.rtf", "C1ACD227FD3CE992C115DD95BD2B42.rtf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 105, "domain": 71, "hostname": 211, "URL": 125, "email": 2, "FileHash-MD5": 14, "FileHash-SHA1": 212 }, "indicator_count": 740, "is_author": false, "is_subscribing": null, "subscriber_count": 30, "modified_text": "536 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66fae0d0177ccf5dfc5c1fb0", "name": "The Jane Syndrome Files: Espionage-Grade Apple iPhone Infiltration", "description": "Here is a full list of details about Apple's latest operating system (OS) and the services it offers: DNS poisonings, network insecurities, malware, malicious script injections.", "modified": "2024-10-30T16:01:07.364000", "created": "2024-09-30T17:33:04.581000", "tags": [ "disabled awdl", "awdl", "status ipv6", "mode", "off awdl", "auto", "discovery", "disabled", "status power", "mac address", "f5 discoverable", "scanning", "current network", "wifi", "security", "wpa2 personal", "legacy", "ipv6", "count", "interval", "timestamp name", "open", "begin", "d71ff", "status", "begin wifi", "collect", "end wifi", "logs", "dump", "end corecapture", "cache", "stats", "cfnetwork", "could", "could ping", "dns server", "duration result", "description", "reach apple", "ping lan", "resolve dns", "number", "guard period", "errors summary", "report guard", "scan psf", "period ranges", "aw errors", "summary", "ap stats", "ap status", "period", "i en0", "airport sync", "airport network", "rave scout", "salman", "scout iphone", "guest agrp", "guest mdat", "items", "status primary", "ipv4", "interface", "nonpsc", "active", "address", "method", "supported", "status mac", "ssid", "bssid", "rssi", "tx rate", "mbps security", "congested wifi", "channel", "current channel", "ht40", "networks", "ht40 network", "wifi cc", "mcastaesccm", "mcasttkip", "fiosd8f6r", "jparadise", "bradstevens", "hazelnuthut", "karen dave", "fios", "brookleyroad", "mobile", "gator", "mach virtual", "memory", "never", "command", "execution time", "timeout", "max rss", "o user", "o ppid", "usrbintaskinfo", "a registry", "ioservice", "state", "executing task", "cpu time", "child process", "cpuwall", "cputimeout", "task container", "handshake", "tmpoutputdir", "executing", "phase", "locker", "atomic", "error", "companion", "savage", "demo", "trigger", "caller", "autounlock", "macbook air", "leaflifetime", "evaluationtime", "afterctflagday", "anchorsource", "validstatus", "numberscts", "mmcs", "unknown", "lmdc", "fssnapshot", "fpck", "fpsnapshot", "fpckrunreason", "iphone", "version", "product type", "os build", "appleinternal", "cpuarchitecture", "chipid", "hwmodel", "d53gap", "hassep", "ap1i", "ap1p", "ap1v", "b0ti", "d1pt", "iq0b", "iq1b", "mbse", "adce", "aopc", "bupt", "chcc", "chif", "upof", "waps", "warp", "wass", "default filters", "size limit", "mb on", "done enforcing", "file", "candidate", "filters", "enforcing size", "limit", "added", "predicate not", "file past", "beginswith", "endswith", "excresource", "analytics", "predicate", "not self", "contains", "max size", "matches", "osvalueobject", "ioport", "ioregistryentry", "iopower", "ioaccessory", "iousb", "iodevicetree", "root", "class", "wcfb", "gtd0x0 dtb", "rfrs", "adfh", "adhf", "vbwr", "vbrr", "cfdwc", "cfdrc", "dlwd", "gcrd", "gccan1 gcmust0", "gccan0 gcmust0", "erase quantile", "bad blocks", "max band", "eol erase", "user partition", "indpoolfree", "key1242", "timestamp", "weightedra", "qmax0", "cyclecount", "timeathighsoc", "chargingvoltage", "bhserviceflags", "04430", "familycode", "vacvoltagelimit", "53685452100", "53685452811", "1284430", "53685452411", "04410", "11524410", "53685452401", "1284410", "10244410", "11534410", "11524430", "10244430", "11534430", "53685451811", "53685451911", "chemid", "algochemid", "eeee", "designcapacity", "presentdod0", "currentcapacity", "ischarging", "temperature", "amperage", "instantamperage", "voltage", "stateofcharge", "chargeaccum", "chargingstate", "inflowstate", "chargelimit", "checkpoint", "decisionmaker", "modeofoperation", "af96b", "begin bluetooth", "b590b", "e97d3", "e1306", "certificate", "start", "status code", "sameorigin body", "xsannwhh5zixhy", "debug", "sun sep", "thu sep", "notice", "fri sep", "unbrick", "dcrt reissue", "commcenter fri", "sat sep", "commcenter sun", "data", "plist", "dict", "post useragent", "dcrt", "body", "doctype", "public", "pkitruststore", "download", "autolocker", "autojob", "data container", "installing", "ls save", "ls operation", "customer", "lsinstalltype", "miinstaller", "staging", "update", "consumed", "missingvalue", "raptor certs", "full service", "pinged configd", "cachedata", "cacheextra", "gmt4", "boot session", "bonjour", "f0fs24 cf0", "xml version", "appledtd plist", "adapter", "sen097", "wairport97", "t3gpp u8721", "u960 u8747", "bae69693u8719", "c2cb", "f1f49791page", "c4 e8", "page", "xethernet97", "sen1u8260", "u8721 u8719", "u8805 a5u8706", "a5u8706 u8721", "u8719 u960", "u8800 c6d8u8734", "b1u8804 u8805", "u8747 aabau937", "u64258 u8800", "u8747 u8776", "u64257 u64258", "u305 u8710", "u63743", "u8260", "u8805 u8706", "u731 u711", "u731", "u733", "time", "time secs", "uuid", "osversion", "lqmlogging", "su ms", "nb nrs", "na cm", "ex tf", "ffp mret", "highband", "ghz sep", "noise 88", "capture", "interfacelogs", "disabledatapath", "role lowlatency", "enabledatapath", "tx submission", "queue sep", "disablesync", "txsubq sep", "datapath", "printdatapath", "txsub disable", "txsub enable", "awdl prox", "awdl interface", "appleolyhal", "iopcidevice", "iopcidevice sep", "appleolyhallog", "pktsec", "mbitssec", "txreported", "u0 m0", "rxmacst", "monitor0 vif", "ff input", "pmopen", "rssi 100", "flushed", "rssi threshold", "service", "p2p concurrency", "allowed", "multicast", "unicast", "p2p interface", "off configured", "host edge", "awdl0", "awdl state", "configured", "d12c2680", "monitor18 vif", "transition", "wait", "device sleep", "device wake", "device active", "pending", "pnd0", "exit", "int state", "tx power", "cap config", "device tree", "ps params", "dtim", "motion profile", "womp disabled", "region info", "lla prefer", "prefer", "moving", "logic", "config", "wlcgetbssinfo", "queue", "check que", "wd scheduled1", "curr", "configure wd", "history", "wlcsetlrl", "wlcgetcountry", "debuggable", "eventbitfield", "fwid 01b0ec0e2e", "d53gap build", "device serial", "file name", "wme acm", "frequestiotx", "busytags", "peer", "u409224", "u527236 m103198", "monitor2827", "totaldropped0", "queue status", "totalflushed0", "tx completion", "rx completion", "fault report", "logging rx", "join mgr", "backpl", "85 85", "fl2 rt601", "bsside2", "rssi avg", "41 48", "44 42", "46 48", "43 42", "io80211 scan", "updated", "mpdus", "chanspec", "roam candidate", "logtransition", "cache channels", "scan home", "infra", "filesystem size", "avail capacity", "devdisk1s1", "dev devdisk1s6", "devdisk1s3", "calls", "file defrag", "metadata", "write", "object cache", "read", "fx defrag", "vnopallocate", "vnopblktooff", "meta", "user pid", "cpu stat", "pri stime", "utime command", "ppid f", "mem pri", "ni vsz", "rss wchan", "started time", "wd scheduled0", "e666293574", "monitor38 vif", "u2642957", "u4321860 m8433", "monitor9744", "b7c5a", "fl2 rt3505", "43 43", "bssid00", "lightphoneii", "43 44", "44 44", "rx data", "f4e0wf", "session", "cached", "access", "integer not", "null default", "null", "text not", "from", "text unique", "where", "order by", "not null", "bool not", "expected t", "nsdata", "unique", "integer primary", "array", "hard", "u63743 fceae8" ], "references": [ "awdl_status.txt", "arp.txt", "bluetooth_status.txt", "com.apple.wifi.syncable-networks.legacy.plist", "com.apple.wifi.syncable-networks.plist", "diagnostics-configuration.txt", "debug-log.txt", "diagnostics-connectivity.txt", "com.apple.wifi.recent-networks.json", "ifconfig.txt", "leaky_ap_stats.txt", "netstat-POST.txt", "mobilewifitool.txt", "security.txt", "netstat-PRE.txt", "network_status.txt", "wifi_datapath-PRE.txt", "wifi_scan_cache.txt", "wifi_logarchive.log", "wifi_datapath-POST.txt", "wifi_status.txt", "diagnostics-environment.txt", "wifi_scan.txt", "vm_stat.txt", "transparency.log", "tzDataVersion.log", "tailspin-info.txt", "taskSummary.csv", "sysdiagnose.log", "security-sysdiagnose.txt", "fileproviderctl_check.log", "hpmDiagnose.txt", "fileproviderctl.log", "hidutil.plist", "remotectl_dumpstate.txt", "smcDiagnose.txt", "BridgeReporting.log", "BridgeActivation.log", "AppConduit.log", "appinstallation.log", "AlishaLogs.log", "ASPSnapshots.log", "AppSupport.log", "astro.log", "AUDeveloperSettings.log", "ATVUpdateLog.log", "AVConference.log", "atcrtcomm.log", "BatteryBDC.log", "avconferenced-embedded.log", "BatteryIntelligence.log", "BluetoothAccessory.log", "BluetoothCoreDump.log", "BatteryHealth.log", "BatteryUIPlist.log", "brctl.log", "BASEBAND_TS_TRIGGER.log", "BTPHY.log", "Burnin.log", "Buddy.log", "CacheDeleteHistory.log", "CalendarPreferences.log", "CMCaptureTailspins.log", "CompanionSync.log", "CommandAndControl.log", "Contacts.log", "coreaudio_reporting.log", "CoreCapture.log", "copySpringBoardStateDump.log", "CoreLocation.log", "CoreCaptureBT.log", "crashes_and_spins.log", "cts.log", "coremediacapture-afdebug.log", "DarwinInit.log", "demod.log", "DataMigration.log", "FDR.log", "diagnostic_summary.log", "ForceResetTailspins.log", "Frametracer.log", "fsck.log", "FindMyDevice.log", "HangTracerTailspins.log", "GenerativeExperiences.log", "Harmony.log", "HIDCrashlogs.log", "HCI.log", "HomePodSetUp.log", "hidfw-crashlogs.log", "itunesstored.log", "LivabilityApp.log", "keyboard_cache.log", "LaunchServices.log", "MailErrorConditions.log", "MapsSyncJournal.log", "MatchTailspins.log", "MCState.log", "MCUCoreDumps.log", "MediaserverdBlockageTailspins.log", "MemoryExceptions.log", "MobileActivation.log", "microstackshots.log", "LogStreamFilter.log", "Mobile_Demo.log", "MobileInstallation.log", "MobileBackup.log", "MobileKeybagLogs.log", "MobileAssetHistory.log", "launchdLogs.log", "MobileSlideShow.log", "MobileLockdown.log", "MobileObliteration.log", "MobileSlideShowPrivateData.log", "MSU.log", "MobileStoreDemo.log", "NanoPreferencesSync.log", "NanoRegistry.log", "NSURLSession_logs.log", "Networking.log", "NetworkRelay.log", "ondemandd.log", "olddsc.log", "OTA.log", "OSEligibility.log", "OTAUpdateLogs.log", "Panics.log", "Personalization.log", "parsecd.log", "powerlogs.log", "process_proxied_device_logs.log", "ProactiveInputPredictions.log", "Preferences.log", "Proximity.log", "ProtectedCloudStorage.log", "RecentHangTracerTailspins.log", "RunningBoard.log", "Recoverylogd.log", "Resource_Exhaustion.log", "SensorKit.log", "SiriTextToSpeech.log", "Sentry.log", "Siri.log", "SiriAnalytics.log", "SleepCycler.log", "SocialLayerPlist.log", "spindump-meta-collection.log", "SplunkHistory.log", "stackshots.log", "SUInfo.log", "StoreServices.log", "SystemVersion.log", "Splat_Versioning.log", "syslog.log", "tailspin-history.log", "ThermalLogs.log", "tailspin-info-ts.log", "Trial.log", "UARP_Packet_Capture.log", "TetheredRestore.log", "UnifiedAsset.log", "time-sensitive-stackshot.log", "TimezoneDB.log", "unnamed_tasks.log", "UARPEndpointPacketCaptures.log", "SpaceAttributionTelemetry.log", "usermanagerd_logs.log", "VideoProcessing.log", "watchdog.log", "WindowServerHangs.log", "WiFi.log", "watchdogd_ddts.log", "asptool_snapshot_timesensitive.log", "asptool_snapshot.log", "acLog.plist", "atcrtcomm.txt", "BDC_Daily_version2.6_2024-08-29_00:19:16.csv", "BDC_Daily_version2.8_2024-09-22_16:06:26.csv", "BDC_Daily_version2.8_2024-09-13_17:49:14.csv", "BDC_Daily_version2.6_2024-09-04_12:00:11.csv", "BDC_Daily_version2.8_2024-09-21_13:45:08.csv", "BDC_OBC_version2.6_2024-08-29_00:19:14.csv", "BDC_OBC_version2.6_2024-09-13_16:25:59.csv", "BDC_OBC_version2.8_2024-09-18_23:12:12.csv", "BDC_OBC_version2.8_2024-09-14_00:28:48.csv", "BDC_OBC_version2.8_2024-09-13_23:35:57.csv", "BDC_OBC_version2.8_2024-09-14_13:32:02.csv", "BDC_OBC_version2.8_2024-09-29_15:16:41.csv", "BDC_Once_version2.6_2024-08-29_00:19:16.csv", "BDC_Once_version2.8_2024-09-13_17:49:16.csv", "BDC_SBC_version2.6_2024-09-02_20:27:16.csv", "BDC_SBC_version2.6_2024-08-29_00:19:16.csv", "BDC_SBC_version2.6_2024-09-03_11:48:00.csv", "BDC_SBC_version2.6_2024-09-11_00:27:57.csv", "BDC_SBC_version2.6_2024-09-04_13:21:06.csv", "BDC_SBC_version2.6_2024-09-04_12:00:11.csv", "BDC_SBC_version2.6_2024-09-03_00:11:37.csv", "BDC_SBC_version2.6_2024-09-13_16:26:54.csv", "BDC_SBC_version2.6_2024-09-13_16:16:55.csv", "BDC_SBC_version2.6_2024-09-08_17:52:28.csv", "BDC_SBC_version2.6_2024-09-13_02:10:48.csv", "BDC_SBC_version2.6_2024-09-12_02:07:40.csv", "BDC_SBC_version2.8_2024-09-13_17:54:28.csv", "BDC_SBC_version2.6_2024-09-13_17:07:26.csv", "BDC_SBC_version2.8_2024-09-13_17:49:18.csv", "BDC_SBC_version2.8_2024-09-14_00:28:50.csv", "BDC_SBC_version2.8_2024-09-18_03:20:38.csv", "BDC_SBC_version2.8_2024-09-18_23:12:15.csv", "BDC_SBC_version2.8_2024-09-14_13:32:04.csv", "BDC_SBC_version2.8_2024-09-21_13:45:07.csv", "BDC_SBC_version2.8_2024-09-22_05:55:57.csv", "BDC_SBC_version2.8_2024-09-23_19:56:36.csv", "BDC_SBC_version2.8_2024-09-17_01:27:03.csv", "BDC_SBC_version2.8_2024-09-23_21:27:40.csv", "BDC_SBC_version2.8_2024-09-24_19:36:33.csv", "BDC_SBC_version2.8_2024-09-14_01:16:12.csv", "BDC_SmartCharging_version2.6_2024-09-02_20:25:09.csv", "BDC_SmartCharging_version2.6_2024-08-29_00:21:46.csv", "BDC_SmartCharging_version2.6_2024-09-03_04:09:12.csv", "BDC_SmartCharging_version2.6_2024-09-03_11:48:07.csv", "BDC_SmartCharging_version2.6_2024-09-03_00:11:44.csv", "BDC_SmartCharging_version2.6_2024-09-04_12:00:20.csv", "BDC_SmartCharging_version2.6_2024-09-04_13:19:02.csv", "CacheDeletePurgeHistory.txt", "FDRDiagnosticReport.plist", "GEAvailability.log", "IOSADiagnose.log", "version", "akd_dcrt_baa_response.txt", "mobileactivationd.log.0", "akd_dcrt_baa_request.txt", "MAAutoAsset_Atomic_History_00.log", "MAAutoAsset_Atomic_History_02.log", "MAAutoAsset_Atomic_History_01.log", "MAAutoAsset_Atomic_History_03.log", "MAAutoAsset_Atomic_History_05.log", "MAAutoAsset_Atomic_History_04.log", "MAAutoAsset_Atomic_History_09.log", "MAAutoAsset_Atomic_History.txt", "MAAutoAsset_Atomic_History_08.log", "MAAutoAsset_Error_History_00.log", "MAAutoAsset_Atomic_History_06.log", "MAAutoAsset_Error_History_02.log", "MAAutoAsset_Error_History_04.log", "MAAutoAsset_Error_History_05.log", "MAAutoAsset_Error_History_08.log", "MAAutoAsset_Error_History.txt", "MAAutoAsset_Filesystem_History_01.log", "MAAutoAsset_Error_History_06.log", "MAAutoAsset_Error_History_09.log", "MAAutoAsset_Error_History_07.log", "MAAutoAsset_Filesystem_History_03.log", "MAAutoAsset_Filesystem_History_02.log", "MAAutoAsset_Filesystem_History_04.log", "MAAutoAsset_Filesystem_History_05.log", "MAAutoAsset_Filesystem_History_08.log", "MAAutoAsset_Filesystem_History_09.log", "MAAutoAsset_Filesystem_History_06.log", "MAAutoAsset_Filesystem_History_00.log", "MAAutoAsset_Filesystem_History_07.log", "MAAutoAsset_Filesystem_History.txt", "MAAutoAsset_Locker_History_00.log", "MAAutoAsset_Locker_History_01.log", "MAAutoAsset_Locker_History_03.log", "MAAutoAsset_Locker_History_06.log", "MAAutoAsset_Locker_History_02.log", "MAAutoAsset_Locker_History_04.log", "MAAutoAsset_Locker_History_05.log", "MAAutoAsset_Locker_History_07.log", "MAAutoAsset_Scheduler_History_00.log", "MAAutoAsset_Locker_History.txt", "MAAutoAsset_Locker_History_08.log", "MAAutoAsset_Scheduler_History_03.log", "MAAutoAsset_Scheduler_History_02.log", "MAAutoAsset_Scheduler_History_04.log", "MAAutoAsset_Scheduler_History_01.log", "MAAutoAsset_Locker_History_09.log", "MAAutoAsset_Scheduler_History_07.log", "MAAutoAsset_Scheduler_History_08.log", "MAAutoAsset_Scheduler_History_05.log", "MAAutoAsset_Scheduler_History_06.log", "MAAutoAsset_Scheduler_History.txt", "MAAutoAsset_Scheduler_History_09.log", "MAAutoAsset_Secure_History_01.log", "MAAutoAsset_Secure_History_00.log", "MAAutoAsset_Secure_History_04.log", "MAAutoAsset_Secure_History_05.log", "MAAutoAsset_Secure_History_03.log", "MAAutoAsset_Secure_History_07.log", "MAAutoAsset_Secure_History_08.log", "MAAutoAsset_Secure_History_06.log", "MAAutoAsset_Secure_History_09.log", "MAAutoAsset_Stager_History_01.log", "MAAutoAsset_Stager_History_02.log", "MAAutoAsset_Stager_History_00.log", "MAAutoAsset_Secure_History.txt", "MAAutoAsset_Stager_History_03.log", "MAAutoAsset_Stager_History_05.log", "MAAutoAsset_Stager_History_07.log", "MAAutoAsset_Stager_History_04.log", "MAAutoAsset_Stager_History_08.log", "MAAutoAsset_Stager_History_06.log", "MAAutoAsset_Stager_History_09.log", "MAAutoAsset_Stager_History.txt", "mobile_installation.log.0", "mobile_installation.log.1", "mobile_installation_helper.log.0", "lockdownd.log", "SUCoreSplunkHistory.log", "model_catalog_dump.txt", "model_manager_dump.json", "com.apple.networkextension.necp.rtf", "preferences.rtf", "NetworkInterfaces.rtf", "com.apple.networkextension.rtf", "com.apple.networkextension.uuidcache.rtf", "com.apple.networkextension.cache.rtf", "com.apple.networkextension.control.rtf", "Entity_2024-09-29 22:12:50.359_Blacklist.csv", "capture.rtf", "system.rtf", "[2024-09-29_22,12,45.966405]-LQMLogging-001.txt", "[2024-09-29_22,12,45.960131]-Interface_SoftAP_0-001.txt", "[2024-09-29_22,12,56.122877]-Interface_LowLatency_0-001.txt", "[2024-09-29_22,12,56.815468]-Interface_Infrastructure_0-001.txt", "[2024-09-29_22,12,56.591747]-Interface_AirLink_0-001.txt", "[2024-09-29_22,12,56.327440]-uartFirmwareLogs-001.txt", "[2024-09-29_22,12,56.457960]-AppleOLYHAL_log-001.txt", "AddFileList.txt", "ap1_AllPeersVerbose_IO80211PeerManager.txt", "awdl0_PrintState_IO80211AWDLPeerManager.txt", "awdl0_AllPeersVerbose_IO80211AWDLPeerManager.txt", "BusState.txt", "ConfigManagerState.txt", "CommanderState.txt", "CoreState.txt", "DeviceInfo.xml", "en0_AllPeersVerbose_IO80211PeerManager.txt", "en0_PrintState_IO80211PeerManager.txt", "InterfaceState_apsta.txt", "ap1_PrintState_IO80211PeerManager.txt", "FaultReportState.txt", "History.txt", "InterfaceState_prox.txt", "ivars->fChannelSwitchDictionary[0].xml", "InterfaceState_llw.txt", "JoinManagerState.txt", "ivars->fChannelSwitchDictionary[1].xml", "InterfaceState_skywalkinfra.txt", "ScanManagerState.txt", "LowLatencyRxCompRing", "MMIO_Log.txt", "SoC_Registers.xml", "LowLatencyTxCompRing", "NetManagerState.txt", "[2024-09-29_22,12,56.477273]-AppleBCMWLAN_Logs-001.txt", "disks.txt", "apfs_stats.txt", "oslog_archive_error.log", "ps_thread.txt", "971A5878D635EB8B262FF791353234.rtf", "B730B951A932F5AE2648F478FDDA81.rtf", "E7B80B551D34E4BCDBC1E47D6AB627.rtf", "2B553D16843D7B9CD7A4504A96CF2F.rtf", "594CB14E19331E8CFB5365144D46C4.rtf", "DE90FBA8603371B106DDEC727E696D.rtf", "C1ACD227FD3CE992C115DD95BD2B42.rtf" ], "public": 1, "adversary": "DragonForce Malaysia Hacker Group", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "", "display_name": "", "target": null } ], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1088", "name": "Bypass User Account Control", "display_name": "T1088 - Bypass User Account Control" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1546.004", "name": "Unix Shell Configuration Modification", "display_name": "T1546.004 - Unix Shell Configuration Modification" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1213", "name": "Data from Information Repositories", "display_name": "T1213 - Data from Information Repositories" }, { "id": "T1070.002", "name": "Clear Linux or Mac System Logs", "display_name": "T1070.002 - Clear Linux or Mac System Logs" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1445", "name": "Abuse of iOS Enterprise App Signing Key", "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1404", "name": "Exploit OS Vulnerability", "display_name": "T1404 - Exploit OS Vulnerability" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 105, "domain": 70, "hostname": 211, "URL": 125, "email": 2, "FileHash-MD5": 14, "FileHash-SHA1": 212 }, "indicator_count": 739, "is_author": false, "is_subscribing": null, "subscriber_count": 31, "modified_text": "536 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65aab954f5f03a1f2906b39c", "name": "Zerobot", "description": "", "modified": "2024-10-12T07:01:26.973000", "created": "2024-01-19T18:03:00.966000", "tags": [ "ssl certificate", "whois record", "referrer", "historical ssl", "resolutions", "whois whois", "communicating", "subdomains", "contacted", "c1on", "cmdwget http", "metro", "zerobot", "execution", "skynet", "june" ], "references": [ "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ZeroBot", "display_name": "ZeroBot", "target": null }, { "id": "Skynet", "display_name": "Skynet", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "65aa168aeddea4851fc47cc3", "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 123, "FileHash-SHA1": 123, "FileHash-SHA256": 2498, "domain": 1600, "hostname": 2749, "URL": 6303, "CVE": 1 }, "indicator_count": 13397, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "554 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d32648280eb859dfca1c19", "name": "x.com - That's what friends are for!", "description": "Original pulses modified, unknown stealer, junk data stuffing sifted through. Careful notes have been taken regarding ultra significant pulses. I've done the best I can to analyze compare, compile from all record of original pulse. | Further analysis shows an effort to destroy quite a bit of pertinent evidence. | I consider the target, family and associates to be especially endangered. Target has become isolated from most people target associated with, mostly by force as not to spread the malicious vulnerabilities that ha e affected many.\nTarget & associated have been interacting with and work with \n, hiring (not everyone they know) those involved. | There has been significant modification and degradation of the origin of information collected. | Who can you report to if the perpetrator is the Law. | This has always been the reason. | Don't hire another hit. What's the point? To uphold a fake integrity as a legacy?", "modified": "2024-09-30T10:01:49.889000", "created": "2024-08-31T14:18:48.037000", "tags": [ "referrer", "historical ssl", "united", "as13414 twitter", "nxdomain", "whitelisted", "cname", "a nxdomain", "status", "aaaa", "as15133 verizon", "search", "date", "twitter", "spoofed", "qbot qakbot", "qbot", "information", "t1027", "files", "t1036", "t1041", "c2 channel", "t1056", "capture", "t1057", "discovery", "memcommit", "process32nextw", "regsetvalueexa", "regdword", "module load", "t1129", "show", "intel", "ms windows", "trojan", "copy", "write", "win64", "next", "url https", "qbot type", "indicator role", "title added", "active related", "pulses url", "url http", "showing", "entries", "msie", "windows nt", "formsecnen", "read", "read c", "russia as48848", "qmount", "unknown", "pecompact", "malware", "role title", "added active", "related pulses", "type indicator", "as44273 host", "name servers", "as47846", "germany unknown", "443 ma2592000", "scan endpoints", "passive dns", "urls", "creation date", "all scoreblue", "hostname", "filehashsha256", "filehashsha1", "filehashmd5", "months ago", "ipv4", "report spam", "tinynote", "cobalt strike", "ransomexx", "quackbot", "comspec", "prefetch8", "pattern match", "prefetch1", "mitre att", "ck id", "show technique", "ck matrix", "null", "path", "hybrid", "general", "click", "strings", "langchinese", "icmp traffic", "pe resource", "pe section", "companyname gm", "win32", "push", "fakedout threat", "analyzer paste", "iocs", "hostnames", "urls https", "overview ip", "address", "related nids", "files hostname", "files domain", "files related", "pulses none", "related tags", "virustotal", "china unknown", "as4837 china", "redacted for", "as4835 china", "douglas county", "co sheriff", "office", "pegasus attacks", "sa victim", "cve type", "cve cve20170147", "no expiration", "expiration", "domain", "create new", "subsys00000000", "as16625 akamai", "as20940", "as39960", "as6762 telecom", "united kingdom", "emails", "span", "created", "white", "formatpng feb", "refererparam", "classid1", "login0", "typeid1", "style1", "dynamicloader", "high", "yara rule", "neshta", "neshta virus", "myapp", "ids detections", "yara detections", "alerts", "worm", "delphi", "ip address", "files location", "china flag", "china domain", "pulses otx", "pulses", "as45102 alibaba", "japan unknown", "as32934", "as19679 dropbox", "pulse pulses", "google safe", "browsing", "hosting", "body", "as7018 att", "verdict vpn", "as9009 m247", "canada unknown", "as174 cogent", "israel unknown", "as12310", "romania unknown", "as48945", "as64286", "b3viles0 feb", "modified", "siteid290", "org7", "novno jan", "siteid289", "org4", "org9", "locuo", "siteid969", "https", "http", "rims https", "evader", "message", "jeffrey scott", "reimer dpt", "pegasus", "pinterest", "amadey", "quasar rat", "eternalblue", "service", "sahil", "andcustomer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Germany", "Netherlands", "Italy", "United Kingdom of Great Britain and Northern Ireland", "Japan", "Korea, Republic of", "France", "Malaysia" ], "malware_families": [ { "id": "Qbot", "display_name": "Qbot", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 39, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2161, "FileHash-SHA1": 2073, "FileHash-SHA256": 7032, "domain": 3959, "hostname": 7581, "email": 22, "URL": 17579, "SSLCertFingerprint": 3, "CVE": 2 }, "indicator_count": 40412, "is_author": false, "is_subscribing": null, "subscriber_count": 234, "modified_text": "566 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://gy.aogg.top", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://gy.aogg.top", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776618811.7230783 }