{ "type": "URL", "indicator": "https://internal.lathoslabs.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://internal.lathoslabs.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3752652043, "indicator": "https://internal.lathoslabs.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 14, "pulses": [ { "id": "6570a91b1702fdce6c496a1e", "name": "note.html [Pulse by OctoSeek]", "description": "", "modified": "2023-12-06T17:02:19.096000", "created": "2023-12-06T17:02:19.096000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 909, "CVE": 2, "FileHash-SHA256": 1422, "domain": 481, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a823f8dbade2ab32ee77", "name": "Remote Access |Trick Clicks | C2 | False evidence appearing real. Content reputation.", "description": "", "modified": "2023-12-06T16:58:11.569000", "created": "2023-12-06T16:58:11.569000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 7, "FileHash-SHA256": 598, "hostname": 403, "domain": 583, "URL": 1814, "FileHash-MD5": 175, "FileHash-SHA1": 95 }, "indicator_count": 3675, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a7fc464f9f56ac33a389", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-12-06T16:57:32.030000", "created": "2023-12-06T16:57:32.030000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "domain": 3202, "CVE": 5, "FileHash-SHA256": 1943, "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 114, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a7e7daf278491d9f9eb4", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-12-06T16:57:11.228000", "created": "2023-12-06T16:57:11.228000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "domain": 3202, "CVE": 5, "FileHash-SHA256": 1943, "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a69b0f11713d9e4d0153", "name": "note.html", "description": "", "modified": "2023-12-06T16:51:39.617000", "created": "2023-12-06T16:51:39.617000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 909, "CVE": 2, "FileHash-SHA256": 1422, "domain": 481, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a647bca43f24b4a05a97", "name": "note.html", "description": "", "modified": "2023-12-06T16:50:15.239000", "created": "2023-12-06T16:50:15.239000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 909, "CVE": 2, "FileHash-SHA256": 1422, "domain": 481, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6522804c01930c8d2f1ad71f", "name": "Remote Access |Trick Clicks | C2 | False evidence appearing real. Content reputation.", "description": "Unrelated websites successfully flood , and dismantle reputations, marketing efforts of targets who has and lost 100% online visibility. Cyber criminals set up malicious websites, that drive down reputation, relevant media of target. The domains are traps popular w/some hackers or malicious red team groups typically hired by attorneys. Clicks, revenue flow to cyber criminals through malicious redirects, AGGRESSIVE social engineering, intellectual property abuse and obnoxious distraction. Contact is often made to trick target into believing their is interested in their product, body of work. Legal docs or funds may be exchange, giving cyber criminal access, email, clouds, Dropbox, forced login abuse, cloud share, phone number, C2, payment methods, banking, privilege to distribute, falsify ad campaigns of target. It's complicated but practices to frustrate , impoverish, profit, track, silence target. Malicious intent. Heavy tracking, core communication service swap.", "modified": "2023-11-07T08:04:06.581000", "created": "2023-10-08T10:11:22.600000", "tags": [ "heur", "cyber threat", "engineering", "covid19", "united", "phishing site", "telefonica peru", "malicious site", "control server", "phishing", "suppobox", "malware", "team", "ransomware", "download", "facebook", "daum", "cobalt strike", "pony", "artemis", "simda", "sodinokibi", "zbot", "bank", "feodo", "laplasclipper", "squirrelwaffle", "binder", "virut", "ramnit", "dropper", "formbook", "azorult", "revil", "matsnu", "service", "generic", "malicious", "emotet", "br", "trojanspy", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware site", "blacklist", "alexa", "malicious url", "detection list", "INDICATOR ROLE TITLE DESCRIPTION EXPIRATION RELATED PULSES URL ", "C2", "command_and_control", "nr-data", "cyber crime", "impersonation", "fraud", "intellectual property", "targets", "kedence", "song culture", "tsara lynn", "k\u00e9dence", "tsara", "tsara brashears", "social engineering", "interface exchange", "abuse", "privilege", "indicator", "file", "pattern match", "ascii text", "appdata", "windows nt", "script", "mitre att", "ck id", "show technique", "hybrid", "general", "local", "forced login", "content reputation", "reputation", "scheme", "crime", "cyber criminals", "arizona", "colorado", "newyork", "british", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "suricata alerts", "event category", "description sid", "suricata", "suricata", "cloud", "device remotwd", "remote attack", "remote controlled devices", "tracking", "spyware", "florida", "united states", "canada", "estonia", "cyber criminal", "alert" ], "references": [ "smartwishlist_1_.js", "https://www.hybrid-analysis.com/sample/ef02a04e1487fd373923ef2aa42b3d9af8d5fd600e5198150283b31aa7ed7558", "CVE-2012-1856", "CVE-2013-1331", "CVE-2017-8570", "CVE-2017-0147", "CVE-2017-11882", "CVE-2017-0199", "CVE-2018-8453", "https://the.sciencebehindecommerce.com/d9core", "https://pixel.tapad.com/idsync/ex/push static-tracking.klaviyo.com u002dtracking.klaviyo.com", "https://www.miraclebrand.co/apps/wonderment/tracking", "remote-access.net", "dev.remote-access.net", "hubspot.remote-access.net", "http://avient.remote-access.net/", "qa.remote-access.net", "http://www.remote-access.net", "https://avient.remote-access.net", "bam.nr-data.net", "appleaccessory.online", "init.ess.apple.com", "tv.apple.com", "http://icloud.ypcdce.com", "dr4qe3ddw9y32.cloudfront.net", "http://45.159.189.105/bot/regex", "http://clipper.guru/bot/regex", "http://45.159.189.105/bot/regex?key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34", "cloud.smartwishlist.webmarked.net", "http://dialacake.com/mumbai/yellow-pineapple-cake-2770.html", "https://hubspot.remote-access.net", "icloud.ypcdce.com", "Research and Data analysis" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "BR", "display_name": "BR", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Ramnit", "display_name": "Ramnit", "target": null }, { "id": "Emotet - S0367", "display_name": "Emotet - S0367", "target": null }, { "id": "Squirrelwaffle", "display_name": "Squirrelwaffle", "target": null }, { "id": "LaplasClipper", "display_name": "LaplasClipper", "target": null }, { "id": "SuppoBox", "display_name": "SuppoBox", "target": null }, { "id": "Virus:Win32/Daum", "display_name": "Virus:Win32/Daum", "target": "/malware/Virus:Win32/Daum" }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Backdoor:PHP/Artemis", "display_name": "Backdoor:PHP/Artemis", "target": "/malware/Backdoor:PHP/Artemis" }, { "id": "TEL:HackTool:Win32/ArtemisUser", "display_name": "TEL:HackTool:Win32/ArtemisUser", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Feodo", "display_name": "Feodo", "target": null }, { "id": "Backdoor:Win32/Simda", "display_name": "Backdoor:Win32/Simda", "target": "/malware/Backdoor:Win32/Simda" }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "REvil (ELF)", "display_name": "REvil (ELF)", "target": null }, { "id": "Trojan:Win32/Matsnu", "display_name": "Trojan:Win32/Matsnu", "target": "/malware/Trojan:Win32/Matsnu" }, { "id": "Virut", "display_name": "Virut", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "ZeuS", "display_name": "ZeuS", "target": null }, { "id": "Pony - S0453", "display_name": "Pony - S0453", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 7, "hostname": 403, "domain": 583, "URL": 1814, "FileHash-MD5": 175, "FileHash-SHA1": 95, "FileHash-SHA256": 598 }, "indicator_count": 3675, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "894 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1b570ce3f6227774113b", "name": "Remote Access |Trick Clicks | C2 | False evidence appearing real. ", "description": "", "modified": "2023-11-07T08:04:06.581000", "created": "2023-10-30T02:56:23.462000", "tags": [ "heur", "cyber threat", "engineering", "covid19", "united", "phishing site", "telefonica peru", "malicious site", "control server", "phishing", "suppobox", "malware", "team", "ransomware", "download", "facebook", "daum", "cobalt strike", "pony", "artemis", "simda", "sodinokibi", "zbot", "bank", "feodo", "laplasclipper", "squirrelwaffle", "binder", "virut", "ramnit", "dropper", "formbook", "azorult", "revil", "matsnu", "service", "generic", "malicious", "emotet", "br", "trojanspy", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware site", "blacklist", "alexa", "malicious url", "detection list", "INDICATOR ROLE TITLE DESCRIPTION EXPIRATION RELATED PULSES URL ", "C2", "command_and_control", "nr-data", "cyber crime", "impersonation", "fraud", "intellectual property", "targets", "kedence", "song culture", "tsara lynn", "k\u00e9dence", "tsara", "tsara brashears", "social engineering", "interface exchange", "abuse", "privilege", "indicator", "file", "pattern match", "ascii text", "appdata", "windows nt", "script", "mitre att", "ck id", "show technique", "hybrid", "general", "local", "forced login", "content reputation", "reputation", "scheme", "crime", "cyber criminals", "arizona", "colorado", "newyork", "british", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "suricata alerts", "event category", "description sid", "suricata", "suricata", "cloud", "device remotwd", "remote attack", "remote controlled devices", "tracking", "spyware", "florida", "united states", "canada", "estonia", "cyber criminal", "alert" ], "references": [ "smartwishlist_1_.js", "https://www.hybrid-analysis.com/sample/ef02a04e1487fd373923ef2aa42b3d9af8d5fd600e5198150283b31aa7ed7558", "CVE-2012-1856", "CVE-2013-1331", "CVE-2017-8570", "CVE-2017-0147", "CVE-2017-11882", "CVE-2017-0199", "CVE-2018-8453", "https://the.sciencebehindecommerce.com/d9core", "https://pixel.tapad.com/idsync/ex/push static-tracking.klaviyo.com u002dtracking.klaviyo.com", "https://www.miraclebrand.co/apps/wonderment/tracking", "remote-access.net", "dev.remote-access.net", "hubspot.remote-access.net", "http://avient.remote-access.net/", "qa.remote-access.net", "http://www.remote-access.net", "https://avient.remote-access.net", "bam.nr-data.net", "appleaccessory.online", "init.ess.apple.com", "tv.apple.com", "http://icloud.ypcdce.com", "dr4qe3ddw9y32.cloudfront.net", "http://45.159.189.105/bot/regex", "http://clipper.guru/bot/regex", "http://45.159.189.105/bot/regex?key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34", "cloud.smartwishlist.webmarked.net", "http://dialacake.com/mumbai/yellow-pineapple-cake-2770.html", "https://hubspot.remote-access.net", "icloud.ypcdce.com", "Research and Data analysis" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "BR", "display_name": "BR", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Ramnit", "display_name": "Ramnit", "target": null }, { "id": "Emotet - S0367", "display_name": "Emotet - S0367", "target": null }, { "id": "Squirrelwaffle", "display_name": "Squirrelwaffle", "target": null }, { "id": "LaplasClipper", "display_name": "LaplasClipper", "target": null }, { "id": "SuppoBox", "display_name": "SuppoBox", "target": null }, { "id": "Virus:Win32/Daum", "display_name": "Virus:Win32/Daum", "target": "/malware/Virus:Win32/Daum" }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Backdoor:PHP/Artemis", "display_name": "Backdoor:PHP/Artemis", "target": "/malware/Backdoor:PHP/Artemis" }, { "id": "TEL:HackTool:Win32/ArtemisUser", "display_name": "TEL:HackTool:Win32/ArtemisUser", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Feodo", "display_name": "Feodo", "target": null }, { "id": "Backdoor:Win32/Simda", "display_name": "Backdoor:Win32/Simda", "target": "/malware/Backdoor:Win32/Simda" }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "REvil (ELF)", "display_name": "REvil (ELF)", "target": null }, { "id": "Trojan:Win32/Matsnu", "display_name": "Trojan:Win32/Matsnu", "target": "/malware/Trojan:Win32/Matsnu" }, { "id": "Virut", "display_name": "Virut", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "ZeuS", "display_name": "ZeuS", "target": null }, { "id": "Pony - S0453", "display_name": "Pony - S0453", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": "6522804c01930c8d2f1ad71f", "export_count": 30, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 7, "hostname": 403, "domain": 583, "URL": 1814, "FileHash-MD5": 175, "FileHash-SHA1": 95, "FileHash-SHA256": 598 }, "indicator_count": 3675, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "894 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "652044fb2f28d46e91d29160", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears", "modified": "2023-11-05T14:05:48.545000", "created": "2023-10-06T17:33:47.403000", "tags": [ "ssl certificate", "whois whois", "iocs", "milum botnet", "army", "isp stuff", "whois record", "travel stuff", "misp", "threat roundup", "july", "apple", "password", "apple ios", "whois", "emotet", "powershell", "hacktool", "crypto", "pornhub", "tulach", "tsara", "camera", "connect", "tsara brashears", "brashears", "scanning_host", "trojan", "phishing", "afro", "june", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "http traffic", "suricata alerts", "event category", "description sid", "websma", "webabo", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware", "alexa", "heur", "malicious site", "malicious url", "unsafe", "agent", "phishing", "riskware", "bank", "iframe", "downldr", "presenoker", "artemis", "genkryptik", "fuery", "wacatac", "azorult", "service", "runescape", "facebook", "download", "union", "team", "opencandy", "exploit", "mimikatz", "blacklist https", "a1mara" ], "references": [ "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "Research and Data Analysis", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8" ], "public": 1, "adversary": "Tulach", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1070.003", "name": "Clear Command History", "display_name": "T1070.003 - Clear Command History" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56, "FileHash-SHA256": 1943, "domain": 3202, "hostname": 3487, "CVE": 5 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "896 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65204565ac1e8bce4de26df3", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears", "modified": "2023-11-05T14:05:48.545000", "created": "2023-10-06T17:35:33.618000", "tags": [ "ssl certificate", "whois whois", "iocs", "milum botnet", "army", "isp stuff", "whois record", "travel stuff", "misp", "threat roundup", "july", "apple", "password", "apple ios", "whois", "emotet", "powershell", "hacktool", "crypto", "pornhub", "tulach", "tsara", "camera", "connect", "tsara brashears", "brashears", "scanning_host", "trojan", "phishing", "afro", "june", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "http traffic", "suricata alerts", "event category", "description sid", "websma", "webabo", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware", "alexa", "heur", "malicious site", "malicious url", "unsafe", "agent", "phishing", "riskware", "bank", "iframe", "downldr", "presenoker", "artemis", "genkryptik", "fuery", "wacatac", "azorult", "service", "runescape", "facebook", "download", "union", "team", "opencandy", "exploit", "mimikatz", "blacklist https", "a1mara" ], "references": [ "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "Research and Data Analysis", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8" ], "public": 1, "adversary": "Tulach", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1070.003", "name": "Clear Command History", "display_name": "T1070.003 - Clear Command History" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56, "FileHash-SHA256": 1943, "domain": 3202, "hostname": 3487, "CVE": 5 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "896 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1df9a7da086561b9897f", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-11-05T14:05:48.545000", "created": "2023-10-30T03:07:37.963000", "tags": [ "ssl certificate", "whois whois", "iocs", "milum botnet", "army", "isp stuff", "whois record", "travel stuff", "misp", "threat roundup", "july", "apple", "password", "apple ios", "whois", "emotet", "powershell", "hacktool", "crypto", "pornhub", "tulach", "tsara", "camera", "connect", "tsara brashears", "brashears", "scanning_host", "trojan", "phishing", "afro", "june", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "http traffic", "suricata alerts", "event category", "description sid", "websma", "webabo", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware", "alexa", "heur", "malicious site", "malicious url", "unsafe", "agent", "phishing", "riskware", "bank", "iframe", "downldr", "presenoker", "artemis", "genkryptik", "fuery", "wacatac", "azorult", "service", "runescape", "facebook", "download", "union", "team", "opencandy", "exploit", "mimikatz", "blacklist https", "a1mara" ], "references": [ "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "Research and Data Analysis", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8" ], "public": 1, "adversary": "Tulach", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1070.003", "name": "Clear Command History", "display_name": "T1070.003 - Clear Command History" } ], "industries": [], "TLP": "white", "cloned_from": "65204565ac1e8bce4de26df3", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56, "FileHash-SHA256": 1943, "domain": 3202, "hostname": 3487, "CVE": 5 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "896 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6510efe0ef29f9f05b4a7dbc", "name": "note.html", "description": "Malicious", "modified": "2023-10-24T17:02:05.352000", "created": "2023-09-25T02:26:40.583000", "tags": [ "ssl certificate", "whois record", "resolutions", "communicating", "referrer", "apple", "historical ssl", "subdomains", "contacted", "hacktool", "united", "et info", "flag", "bad traffic", "date", "tls handshake", "failure", "misc activity", "external ip", "server", "blacklist", "unknown malware", "threatfox", "ssdeep", "file type", "html internet", "magic html", "ascii text", "trid hypertext", "markup language", "file size", "submission", "analysis", "rules not", "not found", "mitre", "info ids", "found sigma", "found", "files not", "found network", "ja3 mitre", "ta0007 command", "Pattern match: \"bootstrap@4.4.1\"", "Pattern match: \"popper.js@1.16.0\"", "100.0% (.HTML) HyperText Markup Language", "Attempts to identify its external IP address", "0x2b3861", "0x1f264c", "0x1e9f6a", "0x45b62b", "0xac498a", "0x574ac1", "0x4919e6window", "uint8array", "0x4919e6", "html file", "url https", "file name", "tag summary", "mitre1 iocs8", "images embedded", "codes comments0", "category value", "url http", "toolbar", "evasive" ], "references": [ "https://www.hybrid-analysis.com/sample/92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1/651057d67b30f0a0990f71ee", "SHA256 92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1", "Web Tools", "Other online research", "Analysis" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ThreatFox", "display_name": "ThreatFox", "target": null }, { "id": "HEUR:Trojan.BAT", "display_name": "HEUR:Trojan.BAT", "target": null }, { "id": "Vdehu.A", "display_name": "Vdehu.A", "target": null }, { "id": "Trojan.JS.ObfJS", "display_name": "Trojan.JS.ObfJS", "target": null }, { "id": "Dropper.Dapato", "display_name": "Dropper.Dapato", "target": null } ], "attack_ids": [ { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1422, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29, "domain": 481, "hostname": 909, "CVE": 2 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "651349097e0dee296da611fc", "name": "note.html", "description": "", "modified": "2023-10-24T17:02:05.352000", "created": "2023-09-26T21:11:37.530000", "tags": [ "ssl certificate", "whois record", "resolutions", "communicating", "referrer", "apple", "historical ssl", "subdomains", "contacted", "hacktool", "united", "et info", "flag", "bad traffic", "date", "tls handshake", "failure", "misc activity", "external ip", "server", "blacklist", "unknown malware", "threatfox", "ssdeep", "file type", "html internet", "magic html", "ascii text", "trid hypertext", "markup language", "file size", "submission", "analysis", "rules not", "not found", "mitre", "info ids", "found sigma", "found", "files not", "found network", "ja3 mitre", "ta0007 command", "Pattern match: \"bootstrap@4.4.1\"", "Pattern match: \"popper.js@1.16.0\"", "100.0% (.HTML) HyperText Markup Language", "Attempts to identify its external IP address", "0x2b3861", "0x1f264c", "0x1e9f6a", "0x45b62b", "0xac498a", "0x574ac1", "0x4919e6window", "uint8array", "0x4919e6", "html file", "url https", "file name", "tag summary", "mitre1 iocs8", "images embedded", "codes comments0", "category value", "url http", "toolbar", "evasive" ], "references": [ "https://www.hybrid-analysis.com/sample/92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1/651057d67b30f0a0990f71ee", "SHA256 92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1", "Web Tools", "Other online research", "Analysis" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ThreatFox", "display_name": "ThreatFox", "target": null }, { "id": "HEUR:Trojan.BAT", "display_name": "HEUR:Trojan.BAT", "target": null }, { "id": "Vdehu.A", "display_name": "Vdehu.A", "target": null }, { "id": "Trojan.JS.ObfJS", "display_name": "Trojan.JS.ObfJS", "target": null }, { "id": "Dropper.Dapato", "display_name": "Dropper.Dapato", "target": null } ], "attack_ids": [ { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "6510efe0ef29f9f05b4a7dbc", "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1422, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29, "domain": 481, "hostname": 909, "CVE": 2 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "652a97aa526adfee6ea546d1", "name": "note.html [Pulse by OctoSeek]", "description": "", "modified": "2023-10-24T17:02:05.352000", "created": "2023-10-14T13:29:14.460000", "tags": [ "ssl certificate", "whois record", "resolutions", "communicating", "referrer", "apple", "historical ssl", "subdomains", "contacted", "hacktool", "united", "et info", "flag", "bad traffic", "date", "tls handshake", "failure", "misc activity", "external ip", "server", "blacklist", "unknown malware", "threatfox", "ssdeep", "file type", "html internet", "magic html", "ascii text", "trid hypertext", "markup language", "file size", "submission", "analysis", "rules not", "not found", "mitre", "info ids", "found sigma", "found", "files not", "found network", "ja3 mitre", "ta0007 command", "Pattern match: \"bootstrap@4.4.1\"", "Pattern match: \"popper.js@1.16.0\"", "100.0% (.HTML) HyperText Markup Language", "Attempts to identify its external IP address", "0x2b3861", "0x1f264c", "0x1e9f6a", "0x45b62b", "0xac498a", "0x574ac1", "0x4919e6window", "uint8array", "0x4919e6", "html file", "url https", "file name", "tag summary", "mitre1 iocs8", "images embedded", "codes comments0", "category value", "url http", "toolbar", "evasive" ], "references": [ "https://www.hybrid-analysis.com/sample/92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1/651057d67b30f0a0990f71ee", "SHA256 92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1", "Web Tools", "Other online research", "Analysis" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ThreatFox", "display_name": "ThreatFox", "target": null }, { "id": "HEUR:Trojan.BAT", "display_name": "HEUR:Trojan.BAT", "target": null }, { "id": "Vdehu.A", "display_name": "Vdehu.A", "target": null }, { "id": "Trojan.JS.ObfJS", "display_name": "Trojan.JS.ObfJS", "target": null }, { "id": "Dropper.Dapato", "display_name": "Dropper.Dapato", "target": null } ], "attack_ids": [ { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "6510efe0ef29f9f05b4a7dbc", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1422, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29, "domain": 481, "hostname": 909, "CVE": 2 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "CVE-2013-1331", "smartwishlist_1_.js", "https://avient.remote-access.net", "Other online research", "https://www.miraclebrand.co/apps/wonderment/tracking", "appleaccessory.online", "Analysis", "icloud.ypcdce.com", "dr4qe3ddw9y32.cloudfront.net", "CVE-2017-11882", "hubspot.remote-access.net", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8", "http://www.remote-access.net", "https://pixel.tapad.com/idsync/ex/push static-tracking.klaviyo.com u002dtracking.klaviyo.com", "CVE-2012-1856", "https://www.hybrid-analysis.com/sample/ef02a04e1487fd373923ef2aa42b3d9af8d5fd600e5198150283b31aa7ed7558", "http://45.159.189.105/bot/regex", "SHA256 92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1", "CVE-2018-8453", "https://hubspot.remote-access.net", "bam.nr-data.net", "https://the.sciencebehindecommerce.com/d9core", "Research and Data Analysis", "http://avient.remote-access.net/", "CVE-2017-8570", "CVE-2017-0199", "cloud.smartwishlist.webmarked.net", "http://45.159.189.105/bot/regex?key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34", "remote-access.net", "CVE-2017-0147", "qa.remote-access.net", "dev.remote-access.net", "http://clipper.guru/bot/regex", "Web Tools", "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "tv.apple.com", "Research and Data analysis", "http://dialacake.com/mumbai/yellow-pineapple-cake-2770.html", "http://icloud.ypcdce.com", "https://www.hybrid-analysis.com/sample/92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1/651057d67b30f0a0990f71ee", "init.ess.apple.com" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Tulach" ], "malware_families": [ "Virus:win32/daum", "Zeus", "Emotet - s0367", "Dropper.dapato", "Pony - s0453", "Threatfox", "Vdehu.a", "Revil (elf)", "Trojanspy", "Ramnit", "Formbook", "Cobalt strike", "Feodo", "Virut", "Backdoor:php/artemis", "Trojan:win32/matsnu", "Maltiverse", "Trojan.js.obfjs", "Backdoor:win32/simda", "Laplasclipper", "Br", "Azorult - s0344", "Backdoor:win32/zbot", "Squirrelwaffle", "Tel:hacktool:win32/artemisuser", "Suppobox", "Heur:trojan.bat", "Ransomware" ], "industries": [], "unique_indicators": 32018 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/lathoslabs.com", "whois": "http://whois.domaintools.com/lathoslabs.com", "domain": "lathoslabs.com", "hostname": "internal.lathoslabs.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 14, "pulses": [ { "id": "6570a91b1702fdce6c496a1e", "name": "note.html [Pulse by OctoSeek]", "description": "", "modified": "2023-12-06T17:02:19.096000", "created": "2023-12-06T17:02:19.096000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 909, "CVE": 2, "FileHash-SHA256": 1422, "domain": 481, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a823f8dbade2ab32ee77", "name": "Remote Access |Trick Clicks | C2 | False evidence appearing real. Content reputation.", "description": "", "modified": "2023-12-06T16:58:11.569000", "created": "2023-12-06T16:58:11.569000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 7, "FileHash-SHA256": 598, "hostname": 403, "domain": 583, "URL": 1814, "FileHash-MD5": 175, "FileHash-SHA1": 95 }, "indicator_count": 3675, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a7fc464f9f56ac33a389", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-12-06T16:57:32.030000", "created": "2023-12-06T16:57:32.030000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "domain": 3202, "CVE": 5, "FileHash-SHA256": 1943, "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 114, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a7e7daf278491d9f9eb4", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-12-06T16:57:11.228000", "created": "2023-12-06T16:57:11.228000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "domain": 3202, "CVE": 5, "FileHash-SHA256": 1943, "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a69b0f11713d9e4d0153", "name": "note.html", "description": "", "modified": "2023-12-06T16:51:39.617000", "created": "2023-12-06T16:51:39.617000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 909, "CVE": 2, "FileHash-SHA256": 1422, "domain": 481, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a647bca43f24b4a05a97", "name": "note.html", "description": "", "modified": "2023-12-06T16:50:15.239000", "created": "2023-12-06T16:50:15.239000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 909, "CVE": 2, "FileHash-SHA256": 1422, "domain": 481, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6522804c01930c8d2f1ad71f", "name": "Remote Access |Trick Clicks | C2 | False evidence appearing real. Content reputation.", "description": "Unrelated websites successfully flood , and dismantle reputations, marketing efforts of targets who has and lost 100% online visibility. Cyber criminals set up malicious websites, that drive down reputation, relevant media of target. The domains are traps popular w/some hackers or malicious red team groups typically hired by attorneys. Clicks, revenue flow to cyber criminals through malicious redirects, AGGRESSIVE social engineering, intellectual property abuse and obnoxious distraction. Contact is often made to trick target into believing their is interested in their product, body of work. Legal docs or funds may be exchange, giving cyber criminal access, email, clouds, Dropbox, forced login abuse, cloud share, phone number, C2, payment methods, banking, privilege to distribute, falsify ad campaigns of target. It's complicated but practices to frustrate , impoverish, profit, track, silence target. Malicious intent. Heavy tracking, core communication service swap.", "modified": "2023-11-07T08:04:06.581000", "created": "2023-10-08T10:11:22.600000", "tags": [ "heur", "cyber threat", "engineering", "covid19", "united", "phishing site", "telefonica peru", "malicious site", "control server", "phishing", "suppobox", "malware", "team", "ransomware", "download", "facebook", "daum", "cobalt strike", "pony", "artemis", "simda", "sodinokibi", "zbot", "bank", "feodo", "laplasclipper", "squirrelwaffle", "binder", "virut", "ramnit", "dropper", "formbook", "azorult", "revil", "matsnu", "service", "generic", "malicious", "emotet", "br", "trojanspy", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware site", "blacklist", "alexa", "malicious url", "detection list", "INDICATOR ROLE TITLE DESCRIPTION EXPIRATION RELATED PULSES URL ", "C2", "command_and_control", "nr-data", "cyber crime", "impersonation", "fraud", "intellectual property", "targets", "kedence", "song culture", "tsara lynn", "k\u00e9dence", "tsara", "tsara brashears", "social engineering", "interface exchange", "abuse", "privilege", "indicator", "file", "pattern match", "ascii text", "appdata", "windows nt", "script", "mitre att", "ck id", "show technique", "hybrid", "general", "local", "forced login", "content reputation", "reputation", "scheme", "crime", "cyber criminals", "arizona", "colorado", "newyork", "british", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "suricata alerts", "event category", "description sid", "suricata", "suricata", "cloud", "device remotwd", "remote attack", "remote controlled devices", "tracking", "spyware", "florida", "united states", "canada", "estonia", "cyber criminal", "alert" ], "references": [ "smartwishlist_1_.js", "https://www.hybrid-analysis.com/sample/ef02a04e1487fd373923ef2aa42b3d9af8d5fd600e5198150283b31aa7ed7558", "CVE-2012-1856", "CVE-2013-1331", "CVE-2017-8570", "CVE-2017-0147", "CVE-2017-11882", "CVE-2017-0199", "CVE-2018-8453", "https://the.sciencebehindecommerce.com/d9core", "https://pixel.tapad.com/idsync/ex/push static-tracking.klaviyo.com u002dtracking.klaviyo.com", "https://www.miraclebrand.co/apps/wonderment/tracking", "remote-access.net", "dev.remote-access.net", "hubspot.remote-access.net", "http://avient.remote-access.net/", "qa.remote-access.net", "http://www.remote-access.net", "https://avient.remote-access.net", "bam.nr-data.net", "appleaccessory.online", "init.ess.apple.com", "tv.apple.com", "http://icloud.ypcdce.com", "dr4qe3ddw9y32.cloudfront.net", "http://45.159.189.105/bot/regex", "http://clipper.guru/bot/regex", "http://45.159.189.105/bot/regex?key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34", "cloud.smartwishlist.webmarked.net", "http://dialacake.com/mumbai/yellow-pineapple-cake-2770.html", "https://hubspot.remote-access.net", "icloud.ypcdce.com", "Research and Data analysis" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "BR", "display_name": "BR", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Ramnit", "display_name": "Ramnit", "target": null }, { "id": "Emotet - S0367", "display_name": "Emotet - S0367", "target": null }, { "id": "Squirrelwaffle", "display_name": "Squirrelwaffle", "target": null }, { "id": "LaplasClipper", "display_name": "LaplasClipper", "target": null }, { "id": "SuppoBox", "display_name": "SuppoBox", "target": null }, { "id": "Virus:Win32/Daum", "display_name": "Virus:Win32/Daum", "target": "/malware/Virus:Win32/Daum" }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Backdoor:PHP/Artemis", "display_name": "Backdoor:PHP/Artemis", "target": "/malware/Backdoor:PHP/Artemis" }, { "id": "TEL:HackTool:Win32/ArtemisUser", "display_name": "TEL:HackTool:Win32/ArtemisUser", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Feodo", "display_name": "Feodo", "target": null }, { "id": "Backdoor:Win32/Simda", "display_name": "Backdoor:Win32/Simda", "target": "/malware/Backdoor:Win32/Simda" }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "REvil (ELF)", "display_name": "REvil (ELF)", "target": null }, { "id": "Trojan:Win32/Matsnu", "display_name": "Trojan:Win32/Matsnu", "target": "/malware/Trojan:Win32/Matsnu" }, { "id": "Virut", "display_name": "Virut", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "ZeuS", "display_name": "ZeuS", "target": null }, { "id": "Pony - S0453", "display_name": "Pony - S0453", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 7, "hostname": 403, "domain": 583, "URL": 1814, "FileHash-MD5": 175, "FileHash-SHA1": 95, "FileHash-SHA256": 598 }, "indicator_count": 3675, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "894 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1b570ce3f6227774113b", "name": "Remote Access |Trick Clicks | C2 | False evidence appearing real. ", "description": "", "modified": "2023-11-07T08:04:06.581000", "created": "2023-10-30T02:56:23.462000", "tags": [ "heur", "cyber threat", "engineering", "covid19", "united", "phishing site", "telefonica peru", "malicious site", "control server", "phishing", "suppobox", "malware", "team", "ransomware", "download", "facebook", "daum", "cobalt strike", "pony", "artemis", "simda", "sodinokibi", "zbot", "bank", "feodo", "laplasclipper", "squirrelwaffle", "binder", "virut", "ramnit", "dropper", "formbook", "azorult", "revil", "matsnu", "service", "generic", "malicious", "emotet", "br", "trojanspy", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware site", "blacklist", "alexa", "malicious url", "detection list", "INDICATOR ROLE TITLE DESCRIPTION EXPIRATION RELATED PULSES URL ", "C2", "command_and_control", "nr-data", "cyber crime", "impersonation", "fraud", "intellectual property", "targets", "kedence", "song culture", "tsara lynn", "k\u00e9dence", "tsara", "tsara brashears", "social engineering", "interface exchange", "abuse", "privilege", "indicator", "file", "pattern match", "ascii text", "appdata", "windows nt", "script", "mitre att", "ck id", "show technique", "hybrid", "general", "local", "forced login", "content reputation", "reputation", "scheme", "crime", "cyber criminals", "arizona", "colorado", "newyork", "british", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "suricata alerts", "event category", "description sid", "suricata", "suricata", "cloud", "device remotwd", "remote attack", "remote controlled devices", "tracking", "spyware", "florida", "united states", "canada", "estonia", "cyber criminal", "alert" ], "references": [ "smartwishlist_1_.js", "https://www.hybrid-analysis.com/sample/ef02a04e1487fd373923ef2aa42b3d9af8d5fd600e5198150283b31aa7ed7558", "CVE-2012-1856", "CVE-2013-1331", "CVE-2017-8570", "CVE-2017-0147", "CVE-2017-11882", "CVE-2017-0199", "CVE-2018-8453", "https://the.sciencebehindecommerce.com/d9core", "https://pixel.tapad.com/idsync/ex/push static-tracking.klaviyo.com u002dtracking.klaviyo.com", "https://www.miraclebrand.co/apps/wonderment/tracking", "remote-access.net", "dev.remote-access.net", "hubspot.remote-access.net", "http://avient.remote-access.net/", "qa.remote-access.net", "http://www.remote-access.net", "https://avient.remote-access.net", "bam.nr-data.net", "appleaccessory.online", "init.ess.apple.com", "tv.apple.com", "http://icloud.ypcdce.com", "dr4qe3ddw9y32.cloudfront.net", "http://45.159.189.105/bot/regex", "http://clipper.guru/bot/regex", "http://45.159.189.105/bot/regex?key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34", "cloud.smartwishlist.webmarked.net", "http://dialacake.com/mumbai/yellow-pineapple-cake-2770.html", "https://hubspot.remote-access.net", "icloud.ypcdce.com", "Research and Data analysis" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "BR", "display_name": "BR", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Maltiverse", "display_name": "Maltiverse", "target": null }, { "id": "Ramnit", "display_name": "Ramnit", "target": null }, { "id": "Emotet - S0367", "display_name": "Emotet - S0367", "target": null }, { "id": "Squirrelwaffle", "display_name": "Squirrelwaffle", "target": null }, { "id": "LaplasClipper", "display_name": "LaplasClipper", "target": null }, { "id": "SuppoBox", "display_name": "SuppoBox", "target": null }, { "id": "Virus:Win32/Daum", "display_name": "Virus:Win32/Daum", "target": "/malware/Virus:Win32/Daum" }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Backdoor:PHP/Artemis", "display_name": "Backdoor:PHP/Artemis", "target": "/malware/Backdoor:PHP/Artemis" }, { "id": "TEL:HackTool:Win32/ArtemisUser", "display_name": "TEL:HackTool:Win32/ArtemisUser", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Feodo", "display_name": "Feodo", "target": null }, { "id": "Backdoor:Win32/Simda", "display_name": "Backdoor:Win32/Simda", "target": "/malware/Backdoor:Win32/Simda" }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "REvil (ELF)", "display_name": "REvil (ELF)", "target": null }, { "id": "Trojan:Win32/Matsnu", "display_name": "Trojan:Win32/Matsnu", "target": "/malware/Trojan:Win32/Matsnu" }, { "id": "Virut", "display_name": "Virut", "target": null }, { "id": "Backdoor:Win32/Zbot", "display_name": "Backdoor:Win32/Zbot", "target": "/malware/Backdoor:Win32/Zbot" }, { "id": "ZeuS", "display_name": "ZeuS", "target": null }, { "id": "Pony - S0453", "display_name": "Pony - S0453", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": "6522804c01930c8d2f1ad71f", "export_count": 30, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 7, "hostname": 403, "domain": 583, "URL": 1814, "FileHash-MD5": 175, "FileHash-SHA1": 95, "FileHash-SHA256": 598 }, "indicator_count": 3675, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "894 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "652044fb2f28d46e91d29160", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears", "modified": "2023-11-05T14:05:48.545000", "created": "2023-10-06T17:33:47.403000", "tags": [ "ssl certificate", "whois whois", "iocs", "milum botnet", "army", "isp stuff", "whois record", "travel stuff", "misp", "threat roundup", "july", "apple", "password", "apple ios", "whois", "emotet", "powershell", "hacktool", "crypto", "pornhub", "tulach", "tsara", "camera", "connect", "tsara brashears", "brashears", "scanning_host", "trojan", "phishing", "afro", "june", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "http traffic", "suricata alerts", "event category", "description sid", "websma", "webabo", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware", "alexa", "heur", "malicious site", "malicious url", "unsafe", "agent", "phishing", "riskware", "bank", "iframe", "downldr", "presenoker", "artemis", "genkryptik", "fuery", "wacatac", "azorult", "service", "runescape", "facebook", "download", "union", "team", "opencandy", "exploit", "mimikatz", "blacklist https", "a1mara" ], "references": [ "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "Research and Data Analysis", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8" ], "public": 1, "adversary": "Tulach", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1070.003", "name": "Clear Command History", "display_name": "T1070.003 - Clear Command History" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56, "FileHash-SHA256": 1943, "domain": 3202, "hostname": 3487, "CVE": 5 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "896 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65204565ac1e8bce4de26df3", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears", "modified": "2023-11-05T14:05:48.545000", "created": "2023-10-06T17:35:33.618000", "tags": [ "ssl certificate", "whois whois", "iocs", "milum botnet", "army", "isp stuff", "whois record", "travel stuff", "misp", "threat roundup", "july", "apple", "password", "apple ios", "whois", "emotet", "powershell", "hacktool", "crypto", "pornhub", "tulach", "tsara", "camera", "connect", "tsara brashears", "brashears", "scanning_host", "trojan", "phishing", "afro", "june", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "http traffic", "suricata alerts", "event category", "description sid", "websma", "webabo", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware", "alexa", "heur", "malicious site", "malicious url", "unsafe", "agent", "phishing", "riskware", "bank", "iframe", "downldr", "presenoker", "artemis", "genkryptik", "fuery", "wacatac", "azorult", "service", "runescape", "facebook", "download", "union", "team", "opencandy", "exploit", "mimikatz", "blacklist https", "a1mara" ], "references": [ "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "Research and Data Analysis", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8" ], "public": 1, "adversary": "Tulach", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1070.003", "name": "Clear Command History", "display_name": "T1070.003 - Clear Command History" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56, "FileHash-SHA256": 1943, "domain": 3202, "hostname": 3487, "CVE": 5 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "896 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://internal.lathoslabs.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://internal.lathoslabs.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776615542.7174914 }