{ "type": "URL", "indicator": "https://hotmail-security.us/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://hotmail-security.us/", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3975545474, "indicator": "https://hotmail-security.us/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "66eeef55e2c1ec3a4fa60ef4", "name": "Android", "description": "", "modified": "2024-10-25T00:05:34.912000", "created": "2024-09-21T16:07:49.763000", "tags": [ "read c", "write c", "create c", "delete c", "process32nextw", "langchinese", "search", "regsetvalueexa", "medium", "show", "trojan", "malware", "copy", "write", "win32", "tools", "persistence", "execution", "local", "next", "count", "august", "scan endpoints", "all scoreblue", "url http", "pulse pulses", "http", "domain", "passive dns", "urls", "files related", "pulses otx", "unknown", "cname", "files", "ip address", "as16276", "spain unknown", "meta name", "frame src", "ok set", "cookie", "gmt date", "gmt content", "encrypt", "france", "nxdomain", "ns nxdomain", "aaaa nxdomain", "name servers", "soa nxdomain", "moved", "creation date", "date", "body", "aaaa", "asnone belgium", "united kingdom", "as16276 ovh", "sha256", "maltaterfb", "showing", "total", "read", "delete", "default", "systemroot", "high", "virtool", "virustotal", "hacktool", "drweb", "vipre", "panda", "et trojan", "msie", "windows nt", "entries", "ascii text", "intel", "ms windows", "salicode", "emails", "expiration date", "france unknown", "taskmail", "task3dmail", "capspdf1", "mboxinbox", "actionshow", "twitter", "canada unknown", "error", "ipv4", "backend", "alfper", "gmt contenttype", "gmt server", "apache", "exploit", "hostname", "dynamicloader", "yara rule", "delivery", "alpha criteria", "inno setup", "format", "june", "stack", "dummy", "overview domain", "pulses", "tags", "related tags", "google safe", "browsing", "record type", "ttl value", "status", "united", "asnone united", "record value", "trojanproxy", "servers", "as15169 google", "for privacy", "domains ii", "ransom", "checks", "bios", "cpu name", "dynamic", "filehash", "related nids", "files location", "ddos", "activity", "checkin", "win64", "mirai", "technology", "dns replication", "system label", "cloudflarenet", "apnic", "south brisbane", "asia pacific", "apnic whois", "po box", "cordelia st", "comment", "apnic research", "nethandle", "arin", "andariel", "yara detections", "malware traffic", "nids", "icmp traffic", "dns query", "tcp syn", "resolverror", "externalport", "internalport", "http headers", "home network", "pulse submit", "url analysis", "mitre att", "ta0002 shared", "modules t1129", "windows", "ta0004 access", "t1134", "defense evasion", "xor encrypt", "rc4 prga", "catalog tree", "analysis ob0001", "analysis ob0002", "command", "control ob0004", "ob0005 defense", "evasion ob0006", "file system", "oc0001 process", "oc0003 data", "hashes c2ae", "capa", "cape sandbox", "lastline", "microsoft", "memory pattern", "dns resolutions", "ip traffic", "urls tcp", "tiger rat", "hi", "helping sabey" ], "references": [ "Andariel Backdoor Activity (Checkin)", "IDS: WGET Command Specifying Output in HTTP Headers", "IDS: D-Link Devices Home Network Administration Protocol Command Execution", "Trojan.NukeSped./TigerRat | Trojan[APT]/Win32.Lazarus | Cited: Andariel group \u00bb state-sponsored threat actor & Defense media", "Mr. Telephone man. there js something wrong with her line when she tries to dial a number, she gets a freak every time..." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan:Win32/Tonmye", "display_name": "Trojan:Win32/Tonmye", "target": "/malware/Trojan:Win32/Tonmye" }, { "id": "Win32:Kamso", "display_name": "Win32:Kamso", "target": null }, { "id": "VirTool:Win32/CeeInject.GF", "display_name": "VirTool:Win32/CeeInject.GF", "target": "/malware/VirTool:Win32/CeeInject.GF" }, { "id": "ALFPER:PUA:Win32/InstallCore", "display_name": "ALFPER:PUA:Win32/InstallCore", "target": null }, { "id": "Trojan:Win32/Tonmye!rfn", "display_name": "Trojan:Win32/Tonmye!rfn", "target": "/malware/Trojan:Win32/Tonmye!rfn" }, { "id": "Ransom:Win32/Ako", "display_name": "Ransom:Win32/Ako", "target": "/malware/Ransom:Win32/Ako" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "ARIN", "display_name": "ARIN", "target": null }, { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null }, { "id": "Unix.Trojan.Mirai-6981169-0", "display_name": "Unix.Trojan.Mirai-6981169-0", "target": null }, { "id": "Trojan[APT]/Win32.Lazarus", "display_name": "Trojan[APT]/Win32.Lazarus", "target": null } ], "attack_ids": [ { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "white", "cloned_from": "66ebda7ebbe759bb12cebd4a", "export_count": 43, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "MayDay23", "id": "292773", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 889, "FileHash-SHA1": 817, "FileHash-SHA256": 3623, "domain": 755, "SSLCertFingerprint": 1, "URL": 396, "hostname": 732, "email": 14, "CVE": 3, "CIDR": 2 }, "indicator_count": 7232, "is_author": false, "is_subscribing": null, "subscriber_count": 10, "modified_text": "542 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67176428e4871c2726288178", "name": "Android", "description": "", "modified": "2024-10-25T00:05:34.912000", "created": "2024-10-22T08:36:56.514000", "tags": [ "read c", "write c", "create c", "delete c", "process32nextw", "langchinese", "search", "regsetvalueexa", "medium", "show", "trojan", "malware", "copy", "write", "win32", "tools", "persistence", "execution", "local", "next", "count", "august", "scan endpoints", "all scoreblue", "url http", "pulse pulses", "http", "domain", "passive dns", "urls", "files related", "pulses otx", "unknown", "cname", "files", "ip address", "as16276", "spain unknown", "meta name", "frame src", "ok set", "cookie", "gmt date", "gmt content", "encrypt", "france", "nxdomain", "ns nxdomain", "aaaa nxdomain", "name servers", "soa nxdomain", "moved", "creation date", "date", "body", "aaaa", "asnone belgium", "united kingdom", "as16276 ovh", "sha256", "maltaterfb", "showing", "total", "read", "delete", "default", "systemroot", "high", "virtool", "virustotal", "hacktool", "drweb", "vipre", "panda", "et trojan", "msie", "windows nt", "entries", "ascii text", "intel", "ms windows", "salicode", "emails", "expiration date", "france unknown", "taskmail", "task3dmail", "capspdf1", "mboxinbox", "actionshow", "twitter", "canada unknown", "error", "ipv4", "backend", "alfper", "gmt contenttype", "gmt server", "apache", "exploit", "hostname", "dynamicloader", "yara rule", "delivery", "alpha criteria", "inno setup", "format", "june", "stack", "dummy", "overview domain", "pulses", "tags", "related tags", "google safe", "browsing", "record type", "ttl value", "status", "united", "asnone united", "record value", "trojanproxy", "servers", "as15169 google", "for privacy", "domains ii", "ransom", "checks", "bios", "cpu name", "dynamic", "filehash", "related nids", "files location", "ddos", "activity", "checkin", "win64", "mirai", "technology", "dns replication", "system label", "cloudflarenet", "apnic", "south brisbane", "asia pacific", "apnic whois", "po box", "cordelia st", "comment", "apnic research", "nethandle", "arin", "andariel", "yara detections", "malware traffic", "nids", "icmp traffic", "dns query", "tcp syn", "resolverror", "externalport", "internalport", "http headers", "home network", "pulse submit", "url analysis", "mitre att", "ta0002 shared", "modules t1129", "windows", "ta0004 access", "t1134", "defense evasion", "xor encrypt", "rc4 prga", "catalog tree", "analysis ob0001", "analysis ob0002", "command", "control ob0004", "ob0005 defense", "evasion ob0006", "file system", "oc0001 process", "oc0003 data", "hashes c2ae", "capa", "cape sandbox", "lastline", "microsoft", "memory pattern", "dns resolutions", "ip traffic", "urls tcp", "tiger rat", "hi", "helping sabey" ], "references": [ "Andariel Backdoor Activity (Checkin)", "IDS: WGET Command Specifying Output in HTTP Headers", "IDS: D-Link Devices Home Network Administration Protocol Command Execution", "Trojan.NukeSped./TigerRat | Trojan[APT]/Win32.Lazarus | Cited: Andariel group \u00bb state-sponsored threat actor & Defense media", "Mr. Telephone man. there js something wrong with her line when she tries to dial a number, she gets a freak every time..." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan:Win32/Tonmye", "display_name": "Trojan:Win32/Tonmye", "target": "/malware/Trojan:Win32/Tonmye" }, { "id": "Win32:Kamso", "display_name": "Win32:Kamso", "target": null }, { "id": "VirTool:Win32/CeeInject.GF", "display_name": "VirTool:Win32/CeeInject.GF", "target": "/malware/VirTool:Win32/CeeInject.GF" }, { "id": "ALFPER:PUA:Win32/InstallCore", "display_name": "ALFPER:PUA:Win32/InstallCore", "target": null }, { "id": "Trojan:Win32/Tonmye!rfn", "display_name": "Trojan:Win32/Tonmye!rfn", "target": "/malware/Trojan:Win32/Tonmye!rfn" }, { "id": "Ransom:Win32/Ako", "display_name": "Ransom:Win32/Ako", "target": "/malware/Ransom:Win32/Ako" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "ARIN", "display_name": "ARIN", "target": null }, { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null }, { "id": "Unix.Trojan.Mirai-6981169-0", "display_name": "Unix.Trojan.Mirai-6981169-0", "target": null }, { "id": "Trojan[APT]/Win32.Lazarus", "display_name": "Trojan[APT]/Win32.Lazarus", "target": null } ], "attack_ids": [ { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "white", "cloned_from": "66eeef55e2c1ec3a4fa60ef4", "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": true, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "jefivnguyen", "id": "293031", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 889, "FileHash-SHA1": 817, "FileHash-SHA256": 3623, "domain": 755, "SSLCertFingerprint": 1, "URL": 396, "hostname": 732, "email": 14, "CVE": 3, "CIDR": 2 }, "indicator_count": 7232, "is_author": false, "is_subscribing": null, "subscriber_count": 37, "modified_text": "542 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66ebda7ebbe759bb12cebd4a", "name": "Andariel Backdoor Activity - Mirai found in Android", "description": "Andariel Backdoor Activity: Cited as a state sponsored threat group, this ET malware Check in) can be accessed by decent hackers. Found in a targets android device. \n\nDevice being used to attack , manipulate accounts , files and every CnC Botmaster task desired.\n\nNote:. Hack responsibly.. Stop attacking innocent civilians.", "modified": "2024-10-19T07:01:20.116000", "created": "2024-09-19T08:02:06.265000", "tags": [ "read c", "write c", "create c", "delete c", "process32nextw", "langchinese", "search", "regsetvalueexa", "medium", "show", "trojan", "malware", "copy", "write", "win32", "tools", "persistence", "execution", "local", "next", "count", "august", "scan endpoints", "all scoreblue", "url http", "pulse pulses", "http", "domain", "passive dns", "urls", "files related", "pulses otx", "unknown", "cname", "files", "ip address", "as16276", "spain unknown", "meta name", "frame src", "ok set", "cookie", "gmt date", "gmt content", "encrypt", "france", "nxdomain", "ns nxdomain", "aaaa nxdomain", "name servers", "soa nxdomain", "moved", "creation date", "date", "body", "aaaa", "asnone belgium", "united kingdom", "as16276 ovh", "sha256", "maltaterfb", "showing", "total", "read", "delete", "default", "systemroot", "high", "virtool", "virustotal", "hacktool", "drweb", "vipre", "panda", "et trojan", "msie", "windows nt", "entries", "ascii text", "intel", "ms windows", "salicode", "emails", "expiration date", "france unknown", "taskmail", "task3dmail", "capspdf1", "mboxinbox", "actionshow", "twitter", "canada unknown", "error", "ipv4", "backend", "alfper", "gmt contenttype", "gmt server", "apache", "exploit", "hostname", "dynamicloader", "yara rule", "delivery", "alpha criteria", "inno setup", "format", "june", "stack", "dummy", "overview domain", "pulses", "tags", "related tags", "google safe", "browsing", "record type", "ttl value", "status", "united", "asnone united", "record value", "trojanproxy", "servers", "as15169 google", "for privacy", "domains ii", "ransom", "checks", "bios", "cpu name", "dynamic", "filehash", "related nids", "files location", "ddos", "activity", "checkin", "win64", "mirai", "technology", "dns replication", "system label", "cloudflarenet", "apnic", "south brisbane", "asia pacific", "apnic whois", "po box", "cordelia st", "comment", "apnic research", "nethandle", "arin", "andariel", "yara detections", "malware traffic", "nids", "icmp traffic", "dns query", "tcp syn", "resolverror", "externalport", "internalport", "http headers", "home network", "pulse submit", "url analysis", "mitre att", "ta0002 shared", "modules t1129", "windows", "ta0004 access", "t1134", "defense evasion", "xor encrypt", "rc4 prga", "catalog tree", "analysis ob0001", "analysis ob0002", "command", "control ob0004", "ob0005 defense", "evasion ob0006", "file system", "oc0001 process", "oc0003 data", "hashes c2ae", "capa", "cape sandbox", "lastline", "microsoft", "memory pattern", "dns resolutions", "ip traffic", "urls tcp", "tiger rat", "hi", "helping sabey" ], "references": [ "Andariel Backdoor Activity (Checkin)", "IDS: WGET Command Specifying Output in HTTP Headers", "IDS: D-Link Devices Home Network Administration Protocol Command Execution", "Trojan.NukeSped./TigerRat | Trojan[APT]/Win32.Lazarus | Cited: Andariel group \u00bb state-sponsored threat actor & Defense media", "Mr. Telephone man. there js something wrong with her line when she tries to dial a number, she gets a freak every time..." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan:Win32/Tonmye", "display_name": "Trojan:Win32/Tonmye", "target": "/malware/Trojan:Win32/Tonmye" }, { "id": "Win32:Kamso", "display_name": "Win32:Kamso", "target": null }, { "id": "VirTool:Win32/CeeInject.GF", "display_name": "VirTool:Win32/CeeInject.GF", "target": "/malware/VirTool:Win32/CeeInject.GF" }, { "id": "ALFPER:PUA:Win32/InstallCore", "display_name": "ALFPER:PUA:Win32/InstallCore", "target": null }, { "id": "Trojan:Win32/Tonmye!rfn", "display_name": "Trojan:Win32/Tonmye!rfn", "target": "/malware/Trojan:Win32/Tonmye!rfn" }, { "id": "Ransom:Win32/Ako", "display_name": "Ransom:Win32/Ako", "target": "/malware/Ransom:Win32/Ako" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "ARIN", "display_name": "ARIN", "target": null }, { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null }, { "id": "Unix.Trojan.Mirai-6981169-0", "display_name": "Unix.Trojan.Mirai-6981169-0", "target": null }, { "id": "Trojan[APT]/Win32.Lazarus", "display_name": "Trojan[APT]/Win32.Lazarus", "target": null } ], "attack_ids": [ { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 889, "FileHash-SHA1": 817, "FileHash-SHA256": 3623, "domain": 755, "SSLCertFingerprint": 1, "URL": 396, "hostname": 732, "email": 14, "CVE": 3, "CIDR": 2 }, "indicator_count": 7232, "is_author": false, "is_subscribing": null, "subscriber_count": 234, "modified_text": "548 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66eb3ef6d765187a437767e4", "name": "Hijacked 'Operation Endgame' Tofsee Ransomware", "description": "This a project. A target has been put into different Operations: Project Hilo, Project Helix, Operation Endgame, The NSO Cellebrite Pegasus hit list. These are real and very serious serious threat. Severe Cyber issues made their way to her infected devices as well as the devices of family members. Death threats continue to come in. Several DoD IP addresses found in a PDF. It's unresearched at this time,, DoD via BGP HE has been questionable considering use gateway abuse by SWIPPER. \n\nStill no authority can confirm victim is a suspect. Must be a crazy high to help Jeffrey Scott Reiner PT. DPT get away with assault in such a ridiculous manner. Court report posted online by Trellis (BS) is of course a falsified , vulnerability filled 'made you click' document.. Faldif0, empty docmpty doc, citing it was refreshed in 2023. \nThere is no doubt these masqueraders mean to intimidate, humiliate, isolate & harm target. These people are not in China. False attribution is likely. Attack is disseminates from USA.", "modified": "2024-10-18T20:04:41.836000", "created": "2024-09-18T20:58:30.691000", "tags": [ "as8075", "united", "pid425870621", "tid700443057", "tpid425870621", "slot1", "mascore2", "bcnt1", "unid88000705", "nct1", "date", "china", "china unknown", "passive dns", "body xml", "error code", "requestid", "hostid ec", "server", "gmt content", "type", "registry", "intel", "ms windows", "show", "entries", "search", "high", "pe32", "high process", "injection t1055", "salicode", "worm", "copy", "tools", "service", "write", "win32", "persistence", "execution", "april", "urls", "http", "unique", "scan endpoints", "all scoreblue", "url http", "pulse pulses", "ip address", "related nids", "code", "as54113", "unknown", "body", "fastly error", "please", "sea p", "msil", "accept", "aaaa", "nxdomain", "whitelisted", "as15169 google", "status", "as44273 host", "as46691", "domain", "url https", "files location", "info", "script urls", "path max", "age86400 set", "cookie", "script domains", "javascript", "script script", "trojanspy", "cname", "emails", "servers", "all search", "related pulses", "file samples", "files matching", "creation date", "germany unknown", "yara detections", "filehash", "av detections", "ids detections", "alerts", "analysis date", "file score", "meta", "home welcome", "write c", "delete c", "query", "local", "hostname", "a domains", "lowfi", "content type", "record value", "suite", "showing", "asnone united", "as29873", "ipv4", "pulse submit", "url analysis", "files", "pe32 executable", "potential scan", "0pgtwhu", "t1045", "port", "infection", "recon", "malware", "june", "delphi", "taobao network", "as45102 alibaba", "as4812 china", "next", "expiration date", "name servers", "dynamicloader", "dynamic", "sha256", "dynamic link", "library exe", "adobe", "incorporated", "read", "yara rule", "delete", "binary file", "push", "malicious", "july", "iocs", "levelbluelabs", "jeff4son", "adversaries", "registry run", "flow t1574", "dll sideloading", "boot", "logon autostart", "execution t1547", "keys", "startup folder", "t1497 may", "encryption", "catalog tree", "analysis ob0001", "virtual machine", "detection b0009", "check registry", "analysis ob0002", "executable code", "stack strings", "control ob0004", "get http", "http requests", "dns resolutions", "ip traffic", "pattern domains", "memory pattern", "urls http", "request", "response", "connection", "trojan", "otx scoreblue", "windows", "embeddedwb", "medium", "shellexecuteexw", "msie", "windows nt", "displayname", "tofsee", "hashes", "vhash", "authentihash", "ssdeep", "win32 exe", "magic pe32", "trid win32", "library", "read c", "file guard", "rtversion", "langchinese", "legalcopyright", "reserved", "ransom", "moved", "media", "ascii text", "default", "upack", "mike", "contacted", "x87xe1x1d", "regsetvalueexa", "x95xd3xa4", "regbinary", "x84xa8xe8i", "x8dxb7xb7", "hx88x9ax1e", "mx81xd1r", "x92xac", "xc2x84", "stream", "swipper", "pdfcreator.sf.net", "botnet", "black mercedes", "please forgive me", "therahand thouroughhand" ], "references": [ "Project Endgame - pegausintel.com -Unsjre if related to NSO Group", "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean", "Yara Detections: compromised_site_redirector_fromcharcode , Cabinet_Archive , SFX_CAB", "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile", "P\u2019s Contacted: 93.184.221.240 3.33.130.190 | Domains Contacted: counterslocal.com", "compromised_site_redirector_fromcharcode fromCharCode", "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527", "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/", "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf", "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/", "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166", "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539", "Antivirus Detections Cryp_Xed-12 , Mal/Generic-S , Packed/Upack Yara Detections Upackv039finalDwing , UpackV037Dwing", "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Worm:Win32/Macoute.A", "display_name": "Worm:Win32/Macoute.A", "target": "/malware/Worm:Win32/Macoute.A" }, { "id": "TrojanDownloader:Win32/Nemucod", "display_name": "TrojanDownloader:Win32/Nemucod", "target": "/malware/TrojanDownloader:Win32/Nemucod" }, { "id": "TrojanSpy:Win32/Nivdort", "display_name": "TrojanSpy:Win32/Nivdort", "target": "/malware/TrojanSpy:Win32/Nivdort" }, { "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean", "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean", "target": null }, { "id": "Worm:Win32/Fesber.A", "display_name": "Worm:Win32/Fesber.A", "target": "/malware/Worm:Win32/Fesber.A" }, { "id": "Ransom:Win32/Eniqma.A", "display_name": "Ransom:Win32/Eniqma.A", "target": "/malware/Ransom:Win32/Eniqma.A" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "UpackV037Dwing", "display_name": "UpackV037Dwing", "target": null }, { "id": "Cryp_Xed-12", "display_name": "Cryp_Xed-12", "target": null }, { "id": "Mal/Generic-S", "display_name": "Mal/Generic-S", "target": null } ], "attack_ids": [ { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1096", "name": "NTFS File Attributes", "display_name": "T1096 - NTFS File Attributes" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1493, "FileHash-SHA1": 1393, "FileHash-SHA256": 5881, "URL": 1495, "domain": 1947, "hostname": 1360, "email": 18, "CVE": 1 }, "indicator_count": 13588, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "548 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66e94760a415fb970ab2dfdd", "name": "Pornhub Api connected to Targets phone via Remote Telegram install", "description": "Cyber attack named 'Project Endgame' by threat actors || Cyber criminal IMMEDIATELY remotely accessed targets device when it was new from manufacturer. Remote installation of telegram app, installed pornhub. Dumping, making all types of pornography appear to come from targets and associated persons devices. It's never ending. || Win32:PWSX-gen\\ [Trj]\n#Lowfi:HSTR:Win32/Exprio\nALF:Trojan:BAT/EnvVarCharReplacement\nBackdoor:Win32/Tofsee\nTrojan:Win32/Azorult\nTrojan:Win32/Danabot\nTrojan:Win32/Eqtonex\nTrojan:Win32/Meredrop\nTrojanDownloader:Win32/Tofsee\nVirTool:Win32/Obfuscator\nWin.Dropper.Tofsee-10023347-0", "modified": "2024-10-17T08:04:26.924000", "created": "2024-09-17T09:09:52.842000", "tags": [ "all scoreblue", "contacted", "telegram", "pornhub", "hostname", "domain", "iocs", "pdf report", "pcap", "stix", "openioc", "ck t1003", "os credential", "dumping t1005", "local system", "t1012", "registry t1018", "remote system", "discovery t1027", "files", "t1053", "whitelisted", "agent", "as13414 twitter", "as14061", "as15169 google", "as16552", "as16276", "as19679 dropbox", "as22612", "as25019", "as32934", "as35680", "as62597", "as54113", "as397241", "as397240", "nsone as63949", "as35819", "china unknown", "chrome", "code", "as16552 tiggee", "as2914 ntt", "as25019 saudi", "asnone hong", "as63949 linode", "as7303 telecom", "as8151", "as9318 sk", "asn as13414", "asn as48684", "cookie", "encrypt", "endgame", "emails", "cryp", "delphi", "dynamicloader", "dns", "grum", "germany unknown", "gmt max", "connection", "dns resolutions", "porn", "regsz", "langgeorgian", "sublangdefault", "rticon", "english", "regsetvalueexa", "regdword", "medium", "t1055", "win32", "malware", "copy", "updater", "generic", "delete c", "yara rule", "high", "search", "ms windows", "tofsee", "show", "windows", "russia as49505", "united", "grum", "write", "query", "contacted", "installs", "stream", "unknown", "as46606", "passive dns", "date", "scan endpoints", "pulse pulses", "urls", "as8151", "mexico unknown", "saudi arabia", "as25019 saudi", "china unknown", "as7303 telecom", "hungary unknown", "trojan", "msie", "body", "ransom", "icmp traffic", "pdb path", "filehash", "url http", "http", "address", "russia unknown", "privacy tools", "as396982 google", "as57416 llc", "div div", "span h3", "span div", "h3 p", "as24940 hetzner", "face", "delete", "yara detections", "sinkhole cookie", "value snkz", "pe32", "suspicious", "possible", "as56864 xeon", "ipv4", "pulse submit", "url analysis", "ip address", "location united", "next", "germany unknown", "method", "allowed server", "content length", "content type", "cookie", "registrar abuse", "explorer", "files matching", "homepage", "hungary unknown", "installs ip", "installs", "ip", "link", "mexico unknown", "pegasus", "operation endgame", "public key", "ransom", "twitter redirect", "Kong unknown", "script urls", "servers", "updater", "united kingdom unknown", "unique", "ukraine unknown", "trojan features", "trojan", "tofsee", "title telegram", "tags twitter", "twitter", "tags", "sublangdefault" ], "references": [ "Pornhub.com | Telegram https://t.me/login/36861 | loopprojects.t.me", "Cookie : stel_ssid b86d14460f22d8fea8_13386273115952986987", "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "https://www.pornhub.com/video/search?search=tsara+brashears", "ads.pornhub.com | ams-v61.pornhub.com | api-stage.pornhub.com", "api-stage.pornhub.com | abtesting.pornhub.com | pornhub.com | cms-stage20.pornhub.com | imgs.pornhub.com | http://tourcdn.girlsdoporn.com", "girlsdoporn.com | bar.pornhub.com | bar.pornhub.com | cdn-d-vid-embed.pornhub.com | http://pornhub.tv/Jena6599 | whatsapp.pornhub.com", "https://sslproxy.gatewayclient3.v.hikops.com", "api2ip.ua \u00bb External IP Lookup Service Domain", "83610e8d2924c9886b25ad530e8ad971.pornhub.com", "Win32:PWSX-gen\\ [Trj] IDS Detections Potential Dridex.Maldoc Minimal Executable Request External IP Address Lookup DNS Query (2ip .ua) Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Query to a *.top domain - Likely Hostile Suspicious User Agent (Microsoft Internet Explorer) SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 HTTP Request to a *.top domain Dotted Quad Host ZIP Request Possible EXE Download From Suspicious TLD TLS Handshake Failure ... Less", "IDS Detections: Potential Dridex.Maldoc Minimal Executable Request External IP Address Lookup DNS Query (2ip .ua)", "IDS Detections: Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Query to a *.top domain - Likely Hostile", "IDS Detections: Suspicious User Agent (Microsoft Internet Explorer) SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016", "Win32:RansomX-gen\\ [Ransom] Trojan:Win32/Neconyd.A" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia", "Brazil", "Singapore", "Netherlands", "Russian Federation", "Japan", "Malaysia", "Hong Kong", "Ireland", "Korea, Republic of", "France", "United Kingdom of Great Britain and Northern Ireland", "Argentina", "Austria", "China", "Canada", "Germany" ], "malware_families": [ { "id": "Backdoor:Win32/Tofsee", "display_name": "Backdoor:Win32/Tofsee", "target": "/malware/Backdoor:Win32/Tofsee" }, { "id": "TrojanDownloader:Win32/Tofsee", "display_name": "TrojanDownloader:Win32/Tofsee", "target": "/malware/TrojanDownloader:Win32/Tofsee" }, { "id": "Win32:PWSX-gen\\ [Trj]", "display_name": "Win32:PWSX-gen\\ [Trj]", "target": null }, { "id": "Win.Dropper.Tofsee-10023347-0", "display_name": "Win.Dropper.Tofsee-10023347-0", "target": null }, { "id": "#Lowfi:HSTR:Win32/Exprio", "display_name": "#Lowfi:HSTR:Win32/Exprio", "target": null }, { "id": "VirTool:Win32/Obfuscator", "display_name": "VirTool:Win32/Obfuscator", "target": "/malware/VirTool:Win32/Obfuscator" }, { "id": "Trojan:Win32/Meredrop", "display_name": "Trojan:Win32/Meredrop", "target": "/malware/Trojan:Win32/Meredrop" }, { "id": "Trojan:Win32/Eqtonex", "display_name": "Trojan:Win32/Eqtonex", "target": "/malware/Trojan:Win32/Eqtonex" }, { "id": "Trojan:Win32/Danabot", "display_name": "Trojan:Win32/Danabot", "target": "/malware/Trojan:Win32/Danabot" }, { "id": "Trojan:Win32/Azorult", "display_name": "Trojan:Win32/Azorult", "target": "/malware/Trojan:Win32/Azorult" }, { "id": "ALF:Trojan:BAT/EnvVarCharReplacement", "display_name": "ALF:Trojan:BAT/EnvVarCharReplacement", "target": null } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1428", "name": "Exploit Enterprise Resources", "display_name": "T1428 - Exploit Enterprise Resources" }, { "id": "T1443", "name": "Remotely Install Application", "display_name": "T1443 - Remotely Install Application" }, { "id": "T1478", "name": "Install Insecure or Malicious Configuration", "display_name": "T1478 - Install Insecure or Malicious Configuration" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1570, "FileHash-SHA1": 1301, "FileHash-SHA256": 3497, "URL": 3835, "domain": 1475, "hostname": 2405, "CIDR": 1, "email": 23 }, "indicator_count": 14107, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "550 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "api2ip.ua \u00bb External IP Lookup Service Domain", "83610e8d2924c9886b25ad530e8ad971.pornhub.com", "Cookie : stel_ssid b86d14460f22d8fea8_13386273115952986987", "https://sslproxy.gatewayclient3.v.hikops.com", "Trojan.NukeSped./TigerRat | Trojan[APT]/Win32.Lazarus | Cited: Andariel group \u00bb state-sponsored threat actor & Defense media", "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539", "ads.pornhub.com | ams-v61.pornhub.com | api-stage.pornhub.com", "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/", "IDS: WGET Command Specifying Output in HTTP Headers", "IDS: D-Link Devices Home Network Administration Protocol Command Execution", "https://www.pornhub.com/video/search?search=tsara+brashears", "Yara Detections: compromised_site_redirector_fromcharcode , Cabinet_Archive , SFX_CAB", "Win32:PWSX-gen\\ [Trj] IDS Detections Potential Dridex.Maldoc Minimal Executable Request External IP Address Lookup DNS Query (2ip .ua) Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Query to a *.top domain - Likely Hostile Suspicious User Agent (Microsoft Internet Explorer) SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 HTTP Request to a *.top domain Dotted Quad Host ZIP Request Possible EXE Download From Suspicious TLD TLS Handshake Failure ... Less", "compromised_site_redirector_fromcharcode fromCharCode", "girlsdoporn.com | bar.pornhub.com | bar.pornhub.com | cdn-d-vid-embed.pornhub.com | http://pornhub.tv/Jena6599 | whatsapp.pornhub.com", "Antivirus Detections Cryp_Xed-12 , Mal/Generic-S , Packed/Upack Yara Detections Upackv039finalDwing , UpackV037Dwing", "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile", "Project Endgame - pegausintel.com -Unsjre if related to NSO Group", "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean", "IDS Detections: Suspicious User Agent (Microsoft Internet Explorer) SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016", "Andariel Backdoor Activity (Checkin)", "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "IDS Detections: Potential Dridex.Maldoc Minimal Executable Request External IP Address Lookup DNS Query (2ip .ua)", "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166", "Win32:RansomX-gen\\ [Ransom] Trojan:Win32/Neconyd.A", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "Mr. Telephone man. there js something wrong with her line when she tries to dial a number, she gets a freak every time...", "P\u2019s Contacted: 93.184.221.240 3.33.130.190 | Domains Contacted: counterslocal.com", "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/", "api-stage.pornhub.com | abtesting.pornhub.com | pornhub.com | cms-stage20.pornhub.com | imgs.pornhub.com | http://tourcdn.girlsdoporn.com", "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527", "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/", "Pornhub.com | Telegram https://t.me/login/36861 | loopprojects.t.me", "IDS Detections: Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Query to a *.top domain - Likely Hostile", "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Arin", "Trojanspy:win32/nivdort", "Trojan:win32/tonmye!rfn", "Worm:win32/macoute.a", "Trojan:win32/meredrop", "Trojan:win32/azorult", "#lowfi:hstr:win32/exprio", "Trojandownloader:win32/nemucod", "Backdoor:win32/tofsee", "Tofsee", "Unix.trojan.mirai-6981169-0", "Trojandownloader:win32/tofsee", "Cryp_xed-12", "Virtool:win32/obfuscator", "Trojan[apt]/win32.lazarus", "Alf:trojan:bat/envvarcharreplacement", "Win32:kamso", "Trojan:win32/tonmye", "Elf:ddos-y\\ [trj]", "Trojan:win32/danabot", "Worm:win32/fesber.a", "Win32:pwsx-gen\\ [trj]", "Ransom:win32/ako", "Apnic", "Alf:heraklezeval:rogue:win32/fakerean", "Ransom:win32/eniqma.a", "Trojan:win32/eqtonex", "Mirai", "Win.dropper.tofsee-10023347-0", "Alfper:pua:win32/installcore", "Virtool:win32/ceeinject.gf", "Mal/generic-s", "Upackv037dwing" ], "industries": [], "unique_indicators": 36260 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/hotmail-security.us", "whois": "http://whois.domaintools.com/hotmail-security.us", "domain": "hotmail-security.us", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "66eeef55e2c1ec3a4fa60ef4", "name": "Android", "description": "", "modified": "2024-10-25T00:05:34.912000", "created": "2024-09-21T16:07:49.763000", "tags": [ "read c", "write c", "create c", "delete c", "process32nextw", "langchinese", "search", "regsetvalueexa", "medium", "show", "trojan", "malware", "copy", "write", "win32", "tools", "persistence", "execution", "local", "next", "count", "august", "scan endpoints", "all scoreblue", "url http", "pulse pulses", "http", "domain", "passive dns", "urls", "files related", "pulses otx", "unknown", "cname", "files", "ip address", "as16276", "spain unknown", "meta name", "frame src", "ok set", "cookie", "gmt date", "gmt content", "encrypt", "france", "nxdomain", "ns nxdomain", "aaaa nxdomain", "name servers", "soa nxdomain", "moved", "creation date", "date", "body", "aaaa", "asnone belgium", "united kingdom", "as16276 ovh", "sha256", "maltaterfb", "showing", "total", "read", "delete", "default", "systemroot", "high", "virtool", "virustotal", "hacktool", "drweb", "vipre", "panda", "et trojan", "msie", "windows nt", "entries", "ascii text", "intel", "ms windows", "salicode", "emails", "expiration date", "france unknown", "taskmail", "task3dmail", "capspdf1", "mboxinbox", "actionshow", "twitter", "canada unknown", "error", "ipv4", "backend", "alfper", "gmt contenttype", "gmt server", "apache", "exploit", "hostname", "dynamicloader", "yara rule", "delivery", "alpha criteria", "inno setup", "format", "june", "stack", "dummy", "overview domain", "pulses", "tags", "related tags", "google safe", "browsing", "record type", "ttl value", "status", "united", "asnone united", "record value", "trojanproxy", "servers", "as15169 google", "for privacy", "domains ii", "ransom", "checks", "bios", "cpu name", "dynamic", "filehash", "related nids", "files location", "ddos", "activity", "checkin", "win64", "mirai", "technology", "dns replication", "system label", "cloudflarenet", "apnic", "south brisbane", "asia pacific", "apnic whois", "po box", "cordelia st", "comment", "apnic research", "nethandle", "arin", "andariel", "yara detections", "malware traffic", "nids", "icmp traffic", "dns query", "tcp syn", "resolverror", "externalport", "internalport", "http headers", "home network", "pulse submit", "url analysis", "mitre att", "ta0002 shared", "modules t1129", "windows", "ta0004 access", "t1134", "defense evasion", "xor encrypt", "rc4 prga", "catalog tree", "analysis ob0001", "analysis ob0002", "command", "control ob0004", "ob0005 defense", "evasion ob0006", "file system", "oc0001 process", "oc0003 data", "hashes c2ae", "capa", "cape sandbox", "lastline", "microsoft", "memory pattern", "dns resolutions", "ip traffic", "urls tcp", "tiger rat", "hi", "helping sabey" ], "references": [ "Andariel Backdoor Activity (Checkin)", "IDS: WGET Command Specifying Output in HTTP Headers", "IDS: D-Link Devices Home Network Administration Protocol Command Execution", "Trojan.NukeSped./TigerRat | Trojan[APT]/Win32.Lazarus | Cited: Andariel group \u00bb state-sponsored threat actor & Defense media", "Mr. Telephone man. there js something wrong with her line when she tries to dial a number, she gets a freak every time..." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan:Win32/Tonmye", "display_name": "Trojan:Win32/Tonmye", "target": "/malware/Trojan:Win32/Tonmye" }, { "id": "Win32:Kamso", "display_name": "Win32:Kamso", "target": null }, { "id": "VirTool:Win32/CeeInject.GF", "display_name": "VirTool:Win32/CeeInject.GF", "target": "/malware/VirTool:Win32/CeeInject.GF" }, { "id": "ALFPER:PUA:Win32/InstallCore", "display_name": "ALFPER:PUA:Win32/InstallCore", "target": null }, { "id": "Trojan:Win32/Tonmye!rfn", "display_name": "Trojan:Win32/Tonmye!rfn", "target": "/malware/Trojan:Win32/Tonmye!rfn" }, { "id": "Ransom:Win32/Ako", "display_name": "Ransom:Win32/Ako", "target": "/malware/Ransom:Win32/Ako" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "ARIN", "display_name": "ARIN", "target": null }, { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null }, { "id": "Unix.Trojan.Mirai-6981169-0", "display_name": "Unix.Trojan.Mirai-6981169-0", "target": null }, { "id": "Trojan[APT]/Win32.Lazarus", "display_name": "Trojan[APT]/Win32.Lazarus", "target": null } ], "attack_ids": [ { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "white", "cloned_from": "66ebda7ebbe759bb12cebd4a", "export_count": 43, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "MayDay23", "id": "292773", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 889, "FileHash-SHA1": 817, "FileHash-SHA256": 3623, "domain": 755, "SSLCertFingerprint": 1, "URL": 396, "hostname": 732, "email": 14, "CVE": 3, "CIDR": 2 }, "indicator_count": 7232, "is_author": false, "is_subscribing": null, "subscriber_count": 10, "modified_text": "542 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67176428e4871c2726288178", "name": "Android", "description": "", "modified": "2024-10-25T00:05:34.912000", "created": "2024-10-22T08:36:56.514000", "tags": [ "read c", "write c", "create c", "delete c", "process32nextw", "langchinese", "search", "regsetvalueexa", "medium", "show", "trojan", "malware", "copy", "write", "win32", "tools", "persistence", "execution", "local", "next", "count", "august", "scan endpoints", "all scoreblue", "url http", "pulse pulses", "http", "domain", "passive dns", "urls", "files related", "pulses otx", "unknown", "cname", "files", "ip address", "as16276", "spain unknown", "meta name", "frame src", "ok set", "cookie", "gmt date", "gmt content", "encrypt", "france", "nxdomain", "ns nxdomain", "aaaa nxdomain", "name servers", "soa nxdomain", "moved", "creation date", "date", "body", "aaaa", "asnone belgium", "united kingdom", "as16276 ovh", "sha256", "maltaterfb", "showing", "total", "read", "delete", "default", "systemroot", "high", "virtool", "virustotal", "hacktool", "drweb", "vipre", "panda", "et trojan", "msie", "windows nt", "entries", "ascii text", "intel", "ms windows", "salicode", "emails", "expiration date", "france unknown", "taskmail", "task3dmail", "capspdf1", "mboxinbox", "actionshow", "twitter", "canada unknown", "error", "ipv4", "backend", "alfper", "gmt contenttype", "gmt server", "apache", "exploit", "hostname", "dynamicloader", "yara rule", "delivery", "alpha criteria", "inno setup", "format", "june", "stack", "dummy", "overview domain", "pulses", "tags", "related tags", "google safe", "browsing", "record type", "ttl value", "status", "united", "asnone united", "record value", "trojanproxy", "servers", "as15169 google", "for privacy", "domains ii", "ransom", "checks", "bios", "cpu name", "dynamic", "filehash", "related nids", "files location", "ddos", "activity", "checkin", "win64", "mirai", "technology", "dns replication", "system label", "cloudflarenet", "apnic", "south brisbane", "asia pacific", "apnic whois", "po box", "cordelia st", "comment", "apnic research", "nethandle", "arin", "andariel", "yara detections", "malware traffic", "nids", "icmp traffic", "dns query", "tcp syn", "resolverror", "externalport", "internalport", "http headers", "home network", "pulse submit", "url analysis", "mitre att", "ta0002 shared", "modules t1129", "windows", "ta0004 access", "t1134", "defense evasion", "xor encrypt", "rc4 prga", "catalog tree", "analysis ob0001", "analysis ob0002", "command", "control ob0004", "ob0005 defense", "evasion ob0006", "file system", "oc0001 process", "oc0003 data", "hashes c2ae", "capa", "cape sandbox", "lastline", "microsoft", "memory pattern", "dns resolutions", "ip traffic", "urls tcp", "tiger rat", "hi", "helping sabey" ], "references": [ "Andariel Backdoor Activity (Checkin)", "IDS: WGET Command Specifying Output in HTTP Headers", "IDS: D-Link Devices Home Network Administration Protocol Command Execution", "Trojan.NukeSped./TigerRat | Trojan[APT]/Win32.Lazarus | Cited: Andariel group \u00bb state-sponsored threat actor & Defense media", "Mr. Telephone man. there js something wrong with her line when she tries to dial a number, she gets a freak every time..." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan:Win32/Tonmye", "display_name": "Trojan:Win32/Tonmye", "target": "/malware/Trojan:Win32/Tonmye" }, { "id": "Win32:Kamso", "display_name": "Win32:Kamso", "target": null }, { "id": "VirTool:Win32/CeeInject.GF", "display_name": "VirTool:Win32/CeeInject.GF", "target": "/malware/VirTool:Win32/CeeInject.GF" }, { "id": "ALFPER:PUA:Win32/InstallCore", "display_name": "ALFPER:PUA:Win32/InstallCore", "target": null }, { "id": "Trojan:Win32/Tonmye!rfn", "display_name": "Trojan:Win32/Tonmye!rfn", "target": "/malware/Trojan:Win32/Tonmye!rfn" }, { "id": "Ransom:Win32/Ako", "display_name": "Ransom:Win32/Ako", "target": "/malware/Ransom:Win32/Ako" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "ARIN", "display_name": "ARIN", "target": null }, { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null }, { "id": "Unix.Trojan.Mirai-6981169-0", "display_name": "Unix.Trojan.Mirai-6981169-0", "target": null }, { "id": "Trojan[APT]/Win32.Lazarus", "display_name": "Trojan[APT]/Win32.Lazarus", "target": null } ], "attack_ids": [ { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "white", "cloned_from": "66eeef55e2c1ec3a4fa60ef4", "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": true, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "jefivnguyen", "id": "293031", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 889, "FileHash-SHA1": 817, "FileHash-SHA256": 3623, "domain": 755, "SSLCertFingerprint": 1, "URL": 396, "hostname": 732, "email": 14, "CVE": 3, "CIDR": 2 }, "indicator_count": 7232, "is_author": false, "is_subscribing": null, "subscriber_count": 37, "modified_text": "542 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66ebda7ebbe759bb12cebd4a", "name": "Andariel Backdoor Activity - Mirai found in Android", "description": "Andariel Backdoor Activity: Cited as a state sponsored threat group, this ET malware Check in) can be accessed by decent hackers. Found in a targets android device. \n\nDevice being used to attack , manipulate accounts , files and every CnC Botmaster task desired.\n\nNote:. Hack responsibly.. Stop attacking innocent civilians.", "modified": "2024-10-19T07:01:20.116000", "created": "2024-09-19T08:02:06.265000", "tags": [ "read c", "write c", "create c", "delete c", "process32nextw", "langchinese", "search", "regsetvalueexa", "medium", "show", "trojan", "malware", "copy", "write", "win32", "tools", "persistence", "execution", "local", "next", "count", "august", "scan endpoints", "all scoreblue", "url http", "pulse pulses", "http", "domain", "passive dns", "urls", "files related", "pulses otx", "unknown", "cname", "files", "ip address", "as16276", "spain unknown", "meta name", "frame src", "ok set", "cookie", "gmt date", "gmt content", "encrypt", "france", "nxdomain", "ns nxdomain", "aaaa nxdomain", "name servers", "soa nxdomain", "moved", "creation date", "date", "body", "aaaa", "asnone belgium", "united kingdom", "as16276 ovh", "sha256", "maltaterfb", "showing", "total", "read", "delete", "default", "systemroot", "high", "virtool", "virustotal", "hacktool", "drweb", "vipre", "panda", "et trojan", "msie", "windows nt", "entries", "ascii text", "intel", "ms windows", "salicode", "emails", "expiration date", "france unknown", "taskmail", "task3dmail", "capspdf1", "mboxinbox", "actionshow", "twitter", "canada unknown", "error", "ipv4", "backend", "alfper", "gmt contenttype", "gmt server", "apache", "exploit", "hostname", "dynamicloader", "yara rule", "delivery", "alpha criteria", "inno setup", "format", "june", "stack", "dummy", "overview domain", "pulses", "tags", "related tags", "google safe", "browsing", "record type", "ttl value", "status", "united", "asnone united", "record value", "trojanproxy", "servers", "as15169 google", "for privacy", "domains ii", "ransom", "checks", "bios", "cpu name", "dynamic", "filehash", "related nids", "files location", "ddos", "activity", "checkin", "win64", "mirai", "technology", "dns replication", "system label", "cloudflarenet", "apnic", "south brisbane", "asia pacific", "apnic whois", "po box", "cordelia st", "comment", "apnic research", "nethandle", "arin", "andariel", "yara detections", "malware traffic", "nids", "icmp traffic", "dns query", "tcp syn", "resolverror", "externalport", "internalport", "http headers", "home network", "pulse submit", "url analysis", "mitre att", "ta0002 shared", "modules t1129", "windows", "ta0004 access", "t1134", "defense evasion", "xor encrypt", "rc4 prga", "catalog tree", "analysis ob0001", "analysis ob0002", "command", "control ob0004", "ob0005 defense", "evasion ob0006", "file system", "oc0001 process", "oc0003 data", "hashes c2ae", "capa", "cape sandbox", "lastline", "microsoft", "memory pattern", "dns resolutions", "ip traffic", "urls tcp", "tiger rat", "hi", "helping sabey" ], "references": [ "Andariel Backdoor Activity (Checkin)", "IDS: WGET Command Specifying Output in HTTP Headers", "IDS: D-Link Devices Home Network Administration Protocol Command Execution", "Trojan.NukeSped./TigerRat | Trojan[APT]/Win32.Lazarus | Cited: Andariel group \u00bb state-sponsored threat actor & Defense media", "Mr. Telephone man. there js something wrong with her line when she tries to dial a number, she gets a freak every time..." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan:Win32/Tonmye", "display_name": "Trojan:Win32/Tonmye", "target": "/malware/Trojan:Win32/Tonmye" }, { "id": "Win32:Kamso", "display_name": "Win32:Kamso", "target": null }, { "id": "VirTool:Win32/CeeInject.GF", "display_name": "VirTool:Win32/CeeInject.GF", "target": "/malware/VirTool:Win32/CeeInject.GF" }, { "id": "ALFPER:PUA:Win32/InstallCore", "display_name": "ALFPER:PUA:Win32/InstallCore", "target": null }, { "id": "Trojan:Win32/Tonmye!rfn", "display_name": "Trojan:Win32/Tonmye!rfn", "target": "/malware/Trojan:Win32/Tonmye!rfn" }, { "id": "Ransom:Win32/Ako", "display_name": "Ransom:Win32/Ako", "target": "/malware/Ransom:Win32/Ako" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "ARIN", "display_name": "ARIN", "target": null }, { "id": "APNIC", "display_name": "APNIC", "target": null }, { "id": "ELF:DDoS-Y\\ [Trj]", "display_name": "ELF:DDoS-Y\\ [Trj]", "target": null }, { "id": "Unix.Trojan.Mirai-6981169-0", "display_name": "Unix.Trojan.Mirai-6981169-0", "target": null }, { "id": "Trojan[APT]/Win32.Lazarus", "display_name": "Trojan[APT]/Win32.Lazarus", "target": null } ], "attack_ids": [ { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 889, "FileHash-SHA1": 817, "FileHash-SHA256": 3623, "domain": 755, "SSLCertFingerprint": 1, "URL": 396, "hostname": 732, "email": 14, "CVE": 3, "CIDR": 2 }, "indicator_count": 7232, "is_author": false, "is_subscribing": null, "subscriber_count": 234, "modified_text": "548 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66eb3ef6d765187a437767e4", "name": "Hijacked 'Operation Endgame' Tofsee Ransomware", "description": "This a project. A target has been put into different Operations: Project Hilo, Project Helix, Operation Endgame, The NSO Cellebrite Pegasus hit list. These are real and very serious serious threat. Severe Cyber issues made their way to her infected devices as well as the devices of family members. Death threats continue to come in. Several DoD IP addresses found in a PDF. It's unresearched at this time,, DoD via BGP HE has been questionable considering use gateway abuse by SWIPPER. \n\nStill no authority can confirm victim is a suspect. Must be a crazy high to help Jeffrey Scott Reiner PT. DPT get away with assault in such a ridiculous manner. Court report posted online by Trellis (BS) is of course a falsified , vulnerability filled 'made you click' document.. Faldif0, empty docmpty doc, citing it was refreshed in 2023. \nThere is no doubt these masqueraders mean to intimidate, humiliate, isolate & harm target. These people are not in China. False attribution is likely. Attack is disseminates from USA.", "modified": "2024-10-18T20:04:41.836000", "created": "2024-09-18T20:58:30.691000", "tags": [ "as8075", "united", "pid425870621", "tid700443057", "tpid425870621", "slot1", "mascore2", "bcnt1", "unid88000705", "nct1", "date", "china", "china unknown", "passive dns", "body xml", "error code", "requestid", "hostid ec", "server", "gmt content", "type", "registry", "intel", "ms windows", "show", "entries", "search", "high", "pe32", "high process", "injection t1055", "salicode", "worm", "copy", "tools", "service", "write", "win32", "persistence", "execution", "april", "urls", "http", "unique", "scan endpoints", "all scoreblue", "url http", "pulse pulses", "ip address", "related nids", "code", "as54113", "unknown", "body", "fastly error", "please", "sea p", "msil", "accept", "aaaa", "nxdomain", "whitelisted", "as15169 google", "status", "as44273 host", "as46691", "domain", "url https", "files location", "info", "script urls", "path max", "age86400 set", "cookie", "script domains", "javascript", "script script", "trojanspy", "cname", "emails", "servers", "all search", "related pulses", "file samples", "files matching", "creation date", "germany unknown", "yara detections", "filehash", "av detections", "ids detections", "alerts", "analysis date", "file score", "meta", "home welcome", "write c", "delete c", "query", "local", "hostname", "a domains", "lowfi", "content type", "record value", "suite", "showing", "asnone united", "as29873", "ipv4", "pulse submit", "url analysis", "files", "pe32 executable", "potential scan", "0pgtwhu", "t1045", "port", "infection", "recon", "malware", "june", "delphi", "taobao network", "as45102 alibaba", "as4812 china", "next", "expiration date", "name servers", "dynamicloader", "dynamic", "sha256", "dynamic link", "library exe", "adobe", "incorporated", "read", "yara rule", "delete", "binary file", "push", "malicious", "july", "iocs", "levelbluelabs", "jeff4son", "adversaries", "registry run", "flow t1574", "dll sideloading", "boot", "logon autostart", "execution t1547", "keys", "startup folder", "t1497 may", "encryption", "catalog tree", "analysis ob0001", "virtual machine", "detection b0009", "check registry", "analysis ob0002", "executable code", "stack strings", "control ob0004", "get http", "http requests", "dns resolutions", "ip traffic", "pattern domains", "memory pattern", "urls http", "request", "response", "connection", "trojan", "otx scoreblue", "windows", "embeddedwb", "medium", "shellexecuteexw", "msie", "windows nt", "displayname", "tofsee", "hashes", "vhash", "authentihash", "ssdeep", "win32 exe", "magic pe32", "trid win32", "library", "read c", "file guard", "rtversion", "langchinese", "legalcopyright", "reserved", "ransom", "moved", "media", "ascii text", "default", "upack", "mike", "contacted", "x87xe1x1d", "regsetvalueexa", "x95xd3xa4", "regbinary", "x84xa8xe8i", "x8dxb7xb7", "hx88x9ax1e", "mx81xd1r", "x92xac", "xc2x84", "stream", "swipper", "pdfcreator.sf.net", "botnet", "black mercedes", "please forgive me", "therahand thouroughhand" ], "references": [ "Project Endgame - pegausintel.com -Unsjre if related to NSO Group", "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean", "Yara Detections: compromised_site_redirector_fromcharcode , Cabinet_Archive , SFX_CAB", "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile", "P\u2019s Contacted: 93.184.221.240 3.33.130.190 | Domains Contacted: counterslocal.com", "compromised_site_redirector_fromcharcode fromCharCode", "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527", "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/", "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf", "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/", "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166", "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539", "Antivirus Detections Cryp_Xed-12 , Mal/Generic-S , Packed/Upack Yara Detections Upackv039finalDwing , UpackV037Dwing", "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Worm:Win32/Macoute.A", "display_name": "Worm:Win32/Macoute.A", "target": "/malware/Worm:Win32/Macoute.A" }, { "id": "TrojanDownloader:Win32/Nemucod", "display_name": "TrojanDownloader:Win32/Nemucod", "target": "/malware/TrojanDownloader:Win32/Nemucod" }, { "id": "TrojanSpy:Win32/Nivdort", "display_name": "TrojanSpy:Win32/Nivdort", "target": "/malware/TrojanSpy:Win32/Nivdort" }, { "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean", "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean", "target": null }, { "id": "Worm:Win32/Fesber.A", "display_name": "Worm:Win32/Fesber.A", "target": "/malware/Worm:Win32/Fesber.A" }, { "id": "Ransom:Win32/Eniqma.A", "display_name": "Ransom:Win32/Eniqma.A", "target": "/malware/Ransom:Win32/Eniqma.A" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "UpackV037Dwing", "display_name": "UpackV037Dwing", "target": null }, { "id": "Cryp_Xed-12", "display_name": "Cryp_Xed-12", "target": null }, { "id": "Mal/Generic-S", "display_name": "Mal/Generic-S", "target": null } ], "attack_ids": [ { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1096", "name": "NTFS File Attributes", "display_name": "T1096 - NTFS File Attributes" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1493, "FileHash-SHA1": 1393, "FileHash-SHA256": 5881, "URL": 1495, "domain": 1947, "hostname": 1360, "email": 18, "CVE": 1 }, "indicator_count": 13588, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "548 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66e94760a415fb970ab2dfdd", "name": "Pornhub Api connected to Targets phone via Remote Telegram install", "description": "Cyber attack named 'Project Endgame' by threat actors || Cyber criminal IMMEDIATELY remotely accessed targets device when it was new from manufacturer. Remote installation of telegram app, installed pornhub. Dumping, making all types of pornography appear to come from targets and associated persons devices. It's never ending. || Win32:PWSX-gen\\ [Trj]\n#Lowfi:HSTR:Win32/Exprio\nALF:Trojan:BAT/EnvVarCharReplacement\nBackdoor:Win32/Tofsee\nTrojan:Win32/Azorult\nTrojan:Win32/Danabot\nTrojan:Win32/Eqtonex\nTrojan:Win32/Meredrop\nTrojanDownloader:Win32/Tofsee\nVirTool:Win32/Obfuscator\nWin.Dropper.Tofsee-10023347-0", "modified": "2024-10-17T08:04:26.924000", "created": "2024-09-17T09:09:52.842000", "tags": [ "all scoreblue", "contacted", "telegram", "pornhub", "hostname", "domain", "iocs", "pdf report", "pcap", "stix", "openioc", "ck t1003", "os credential", "dumping t1005", "local system", "t1012", "registry t1018", "remote system", "discovery t1027", "files", "t1053", "whitelisted", "agent", "as13414 twitter", "as14061", "as15169 google", "as16552", "as16276", "as19679 dropbox", "as22612", "as25019", "as32934", "as35680", "as62597", "as54113", "as397241", "as397240", "nsone as63949", "as35819", "china unknown", "chrome", "code", "as16552 tiggee", "as2914 ntt", "as25019 saudi", "asnone hong", "as63949 linode", "as7303 telecom", "as8151", "as9318 sk", "asn as13414", "asn as48684", "cookie", "encrypt", "endgame", "emails", "cryp", "delphi", "dynamicloader", "dns", "grum", "germany unknown", "gmt max", "connection", "dns resolutions", "porn", "regsz", "langgeorgian", "sublangdefault", "rticon", "english", "regsetvalueexa", "regdword", "medium", "t1055", "win32", "malware", "copy", "updater", "generic", "delete c", "yara rule", "high", "search", "ms windows", "tofsee", "show", "windows", "russia as49505", "united", "grum", "write", "query", "contacted", "installs", "stream", "unknown", "as46606", "passive dns", "date", "scan endpoints", "pulse pulses", "urls", "as8151", "mexico unknown", "saudi arabia", "as25019 saudi", "china unknown", "as7303 telecom", "hungary unknown", "trojan", "msie", "body", "ransom", "icmp traffic", "pdb path", "filehash", "url http", "http", "address", "russia unknown", "privacy tools", "as396982 google", "as57416 llc", "div div", "span h3", "span div", "h3 p", "as24940 hetzner", "face", "delete", "yara detections", "sinkhole cookie", "value snkz", "pe32", "suspicious", "possible", "as56864 xeon", "ipv4", "pulse submit", "url analysis", "ip address", "location united", "next", "germany unknown", "method", "allowed server", "content length", "content type", "cookie", "registrar abuse", "explorer", "files matching", "homepage", "hungary unknown", "installs ip", "installs", "ip", "link", "mexico unknown", "pegasus", "operation endgame", "public key", "ransom", "twitter redirect", "Kong unknown", "script urls", "servers", "updater", "united kingdom unknown", "unique", "ukraine unknown", "trojan features", "trojan", "tofsee", "title telegram", "tags twitter", "twitter", "tags", "sublangdefault" ], "references": [ "Pornhub.com | Telegram https://t.me/login/36861 | loopprojects.t.me", "Cookie : stel_ssid b86d14460f22d8fea8_13386273115952986987", "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "https://www.pornhub.com/video/search?search=tsara+brashears", "ads.pornhub.com | ams-v61.pornhub.com | api-stage.pornhub.com", "api-stage.pornhub.com | abtesting.pornhub.com | pornhub.com | cms-stage20.pornhub.com | imgs.pornhub.com | http://tourcdn.girlsdoporn.com", "girlsdoporn.com | bar.pornhub.com | bar.pornhub.com | cdn-d-vid-embed.pornhub.com | http://pornhub.tv/Jena6599 | whatsapp.pornhub.com", "https://sslproxy.gatewayclient3.v.hikops.com", "api2ip.ua \u00bb External IP Lookup Service Domain", "83610e8d2924c9886b25ad530e8ad971.pornhub.com", "Win32:PWSX-gen\\ [Trj] IDS Detections Potential Dridex.Maldoc Minimal Executable Request External IP Address Lookup DNS Query (2ip .ua) Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Query to a *.top domain - Likely Hostile Suspicious User Agent (Microsoft Internet Explorer) SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 HTTP Request to a *.top domain Dotted Quad Host ZIP Request Possible EXE Download From Suspicious TLD TLS Handshake Failure ... Less", "IDS Detections: Potential Dridex.Maldoc Minimal Executable Request External IP Address Lookup DNS Query (2ip .ua)", "IDS Detections: Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Query to a *.top domain - Likely Hostile", "IDS Detections: Suspicious User Agent (Microsoft Internet Explorer) SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016", "Win32:RansomX-gen\\ [Ransom] Trojan:Win32/Neconyd.A" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia", "Brazil", "Singapore", "Netherlands", "Russian Federation", "Japan", "Malaysia", "Hong Kong", "Ireland", "Korea, Republic of", "France", "United Kingdom of Great Britain and Northern Ireland", "Argentina", "Austria", "China", "Canada", "Germany" ], "malware_families": [ { "id": "Backdoor:Win32/Tofsee", "display_name": "Backdoor:Win32/Tofsee", "target": "/malware/Backdoor:Win32/Tofsee" }, { "id": "TrojanDownloader:Win32/Tofsee", "display_name": "TrojanDownloader:Win32/Tofsee", "target": "/malware/TrojanDownloader:Win32/Tofsee" }, { "id": "Win32:PWSX-gen\\ [Trj]", "display_name": "Win32:PWSX-gen\\ [Trj]", "target": null }, { "id": "Win.Dropper.Tofsee-10023347-0", "display_name": "Win.Dropper.Tofsee-10023347-0", "target": null }, { "id": "#Lowfi:HSTR:Win32/Exprio", "display_name": "#Lowfi:HSTR:Win32/Exprio", "target": null }, { "id": "VirTool:Win32/Obfuscator", "display_name": "VirTool:Win32/Obfuscator", "target": "/malware/VirTool:Win32/Obfuscator" }, { "id": "Trojan:Win32/Meredrop", "display_name": "Trojan:Win32/Meredrop", "target": "/malware/Trojan:Win32/Meredrop" }, { "id": "Trojan:Win32/Eqtonex", "display_name": "Trojan:Win32/Eqtonex", "target": "/malware/Trojan:Win32/Eqtonex" }, { "id": "Trojan:Win32/Danabot", "display_name": "Trojan:Win32/Danabot", "target": "/malware/Trojan:Win32/Danabot" }, { "id": "Trojan:Win32/Azorult", "display_name": "Trojan:Win32/Azorult", "target": "/malware/Trojan:Win32/Azorult" }, { "id": "ALF:Trojan:BAT/EnvVarCharReplacement", "display_name": "ALF:Trojan:BAT/EnvVarCharReplacement", "target": null } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1428", "name": "Exploit Enterprise Resources", "display_name": "T1428 - Exploit Enterprise Resources" }, { "id": "T1443", "name": "Remotely Install Application", "display_name": "T1443 - Remotely Install Application" }, { "id": "T1478", "name": "Install Insecure or Malicious Configuration", "display_name": "T1478 - Install Insecure or Malicious Configuration" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1570, "FileHash-SHA1": 1301, "FileHash-SHA256": 3497, "URL": 3835, "domain": 1475, "hostname": 2405, "CIDR": 1, "email": 23 }, "indicator_count": 14107, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "550 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://hotmail-security.us/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://hotmail-security.us/", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776681155.5884879 }