{ "type": "URL", "indicator": "https://keayscreative.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://keayscreative.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3781365627, "indicator": "https://keayscreative.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 11, "pulses": [ { "id": "65be56d257bb241c4fa3f68d", "name": "AZORult CnC", "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares", "modified": "2024-03-04T14:03:17.574000", "created": "2024-02-03T15:08:02.291000", "tags": [ "ssl certificate", "whois record", "threat roundup", "whois whois", "january", "historical ssl", "referrer", "april", "resolutions", "siblings domain", "march", "february", "obz4usfn0 http", "problems", "threat network", "infrastructure", "st201601152", "startpage", "iframe", "united", "unknown", "search", "showing", "united kingdom", "creation date", "aaaa", "cname", "scan endpoints", "all octoseek", "date", "next", "script urls", "soa nxdomain", "link", "xml title", "portugal", "domain", "status", "expiration date", "pulse pulses", "as44273 host", "domain robot", "as61969 team", "body", "as8075", "netherlands", "servers", "emails", "duo insight", "type", "asnone united", "name servers", "germany unknown", "passive dns", "as14061", "as49453", "lowfi", "a domains", "urls", "privacy inc", "customer", "trojandropper", "dynamicloader", "default", "medium", "entries", "khtml", "download", "show", "activity", "http", "copy", "write", "malware", "adware affiliate", "hostname", "trojan", "pulse submit", "url analysis", "files", "as212913 fop", "russia unknown", "as397240", "as15169 google", "as19237 omnis", "as22169 omnis", "as20068 hawk", "as133618", "as47846", "as22489", "encrypt", "record value", "pragma", "accept ch", "ireland unknown", "msie", "chrome", "style", "gmt setcookie", "as6724 strato", "core", "win32", "backdoor", "expl", "exploit", "ipv4", "virtool", "azorult cnc", "possible", "as7018 att", "regsetvalueexa", "china as4134", "service", "asnone", "dns lookup", "ransom", "push", "eternalblue", "recon", "playgame", "domain name", "as13768 aptum", "meta", "error", "as43350 nforce", "as55286", "as60558 phoenix", "ip address", "registrar", "1996", "contacted", "unlocker", "red team", "af81 http", "execution", "open", "whois sslcert", "suspicious c2", "cve202322518", "collection", "vt graph", "excel", "emotet", "metro", "jeffrey reimer pt", "sharecare", "tsara brashears", "apple", "icloud" ], "references": [ "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z", "qbot.zip", "imp.fusioninstall.com", "https://mylegalbid.com/malwarebytes", "192.185.223.216 | 192.168.56.1 [malware]", "http://45.159.189.105/bot/regex", "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null", "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf", "xhamster.comyouporn.com", "cams4all.com", "watchhers.net", "weconnect.com", "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net", "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe", "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com", "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com", "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music", "https://www.songculture.com/tsara-lynn-brashears-music", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "youramateuporn.com", "ns2.abovedomains.com", "ww16.porn-community.porn25.com", "https://totallyspies.1000hentai.com/tag/clover-porn/", "pirateproxy.cc", "mwilliams.dev@gmail.com | piratepages.com", "838114.parkingcrew.net", "static-push-preprod.porndig.com", "www.redtube.comyouporn.com", "https://severeporn-com.pornproxy.page/", "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend", "yoursexy.porn | indianyouporn.com", "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com", "cdn.pornsocket.com", "http://secure.indianpornpass.com/track/hotpornstuff", "www.anyxxxtube.net", "https://twitter.com/PORNO_SEXYBABES", "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo", "campaign-manager.sharecare.com", "qa.companycam.com", "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1", "24-70mm.camera", "dropboxpayments.com", "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org", "http://xred.mooo.com", "https://sexgalaxy.net/tag/rodneymoore/", "http://alive.overit.com/~schoolbu/badmood3.exe", "jimgaffigan.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United Kingdom of Great Britain and Northern Ireland", "United States of America", "Netherlands", "Germany", "France" ], "malware_families": [ { "id": "Adware Affiliate", "display_name": "Adware Affiliate", "target": null }, { "id": "AZORult CnC", "display_name": "AZORult CnC", "target": null }, { "id": "Possible", "display_name": "Possible", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 737, "FileHash-SHA1": 692, "FileHash-SHA256": 7488, "URL": 6694, "domain": 5247, "hostname": 2932, "email": 49, "CVE": 2, "SSLCertFingerprint": 1 }, "indicator_count": 23842, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "776 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65be56d6df9d36bac14ccd87", "name": "AZORult CnC", "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares", "modified": "2024-03-04T14:03:17.574000", "created": "2024-02-03T15:08:06.808000", "tags": [ "ssl certificate", "whois record", "threat roundup", "whois whois", "january", "historical ssl", "referrer", "april", "resolutions", "siblings domain", "march", "february", "obz4usfn0 http", "problems", "threat network", "infrastructure", "st201601152", "startpage", "iframe", "united", "unknown", "search", "showing", "united kingdom", "creation date", "aaaa", "cname", "scan endpoints", "all octoseek", "date", "next", "script urls", "soa nxdomain", "link", "xml title", "portugal", "domain", "status", "expiration date", "pulse pulses", "as44273 host", "domain robot", "as61969 team", "body", "as8075", "netherlands", "servers", "emails", "duo insight", "type", "asnone united", "name servers", "germany unknown", "passive dns", "as14061", "as49453", "lowfi", "a domains", "urls", "privacy inc", "customer", "trojandropper", "dynamicloader", "default", "medium", "entries", "khtml", "download", "show", "activity", "http", "copy", "write", "malware", "adware affiliate", "hostname", "trojan", "pulse submit", "url analysis", "files", "as212913 fop", "russia unknown", "as397240", "as15169 google", "as19237 omnis", "as22169 omnis", "as20068 hawk", "as133618", "as47846", "as22489", "encrypt", "record value", "pragma", "accept ch", "ireland unknown", "msie", "chrome", "style", "gmt setcookie", "as6724 strato", "core", "win32", "backdoor", "expl", "exploit", "ipv4", "virtool", "azorult cnc", "possible", "as7018 att", "regsetvalueexa", "china as4134", "service", "asnone", "dns lookup", "ransom", "push", "eternalblue", "recon", "playgame", "domain name", "as13768 aptum", "meta", "error", "as43350 nforce", "as55286", "as60558 phoenix", "ip address", "registrar", "1996", "contacted", "unlocker", "red team", "af81 http", "execution", "open", "whois sslcert", "suspicious c2", "cve202322518", "collection", "vt graph", "excel", "emotet", "metro", "jeffrey reimer pt", "sharecare", "tsara brashears", "apple", "icloud" ], "references": [ "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z", "qbot.zip", "imp.fusioninstall.com", "https://mylegalbid.com/malwarebytes", "192.185.223.216 | 192.168.56.1 [malware]", "http://45.159.189.105/bot/regex", "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null", "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf", "xhamster.comyouporn.com", "cams4all.com", "watchhers.net", "weconnect.com", "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net", "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe", "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com", "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com", "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music", "https://www.songculture.com/tsara-lynn-brashears-music", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "youramateuporn.com", "ns2.abovedomains.com", "ww16.porn-community.porn25.com", "https://totallyspies.1000hentai.com/tag/clover-porn/", "pirateproxy.cc", "mwilliams.dev@gmail.com | piratepages.com", "838114.parkingcrew.net", "static-push-preprod.porndig.com", "www.redtube.comyouporn.com", "https://severeporn-com.pornproxy.page/", "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend", "yoursexy.porn | indianyouporn.com", "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com", "cdn.pornsocket.com", "http://secure.indianpornpass.com/track/hotpornstuff", "www.anyxxxtube.net", "https://twitter.com/PORNO_SEXYBABES", "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo", "campaign-manager.sharecare.com", "qa.companycam.com", "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1", "24-70mm.camera", "dropboxpayments.com", "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org", "http://xred.mooo.com", "https://sexgalaxy.net/tag/rodneymoore/", "http://alive.overit.com/~schoolbu/badmood3.exe", "jimgaffigan.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United Kingdom of Great Britain and Northern Ireland", "United States of America", "Netherlands", "Germany", "France" ], "malware_families": [ { "id": "Adware Affiliate", "display_name": "Adware Affiliate", "target": null }, { "id": "AZORult CnC", "display_name": "AZORult CnC", "target": null }, { "id": "Possible", "display_name": "Possible", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8134, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 737, "FileHash-SHA1": 692, "FileHash-SHA256": 7488, "URL": 6694, "domain": 5247, "hostname": 2932, "email": 49, "CVE": 2, "SSLCertFingerprint": 1 }, "indicator_count": 23842, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "776 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e928261e55d071a39bccb", "name": "Nymalm Trojan | Imagining Center", "description": "Rulesets:\nINDICATOR_EXE_Packed_VMProtect \nindicator_packed \nCritical Risk: INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA ruleset \nMalicious payloads that are hidden in fake Windows error logs \nHigh Risk: Nymalm Trojan\nAutorun Keys \nExecutable by an Executable \nMultiple phishing, worms, trojans found.", "modified": "2023-12-10T15:02:17.524000", "created": "2023-11-10T20:28:50.858000", "tags": [ "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february", "passive dns", "urls", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "related nids", "date", "status", "domain", "search", "critical" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nymalm Trojan", "display_name": "Nymalm Trojan", "target": null }, { "id": "trojan.tepfer/kelihos", "display_name": "trojan.tepfer/kelihos", "target": null } ], "attack_ids": [], "industries": [ "Health" ], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6879, "FileHash-MD5": 31, "FileHash-SHA1": 30, "FileHash-SHA256": 882, "domain": 4691, "hostname": 2047, "email": 1 }, "indicator_count": 14561, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e928722983be3cff90ea6", "name": "Nymalm Trojan | Imagining Center", "description": "Rulesets:\nINDICATOR_EXE_Packed_VMProtect \nindicator_packed \nCritical Risk: INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA ruleset \nMalicious payloads that are hidden in fake Windows error logs \nHigh Risk: Nymalm Trojan\nAutorun Keys \nExecutable by an Executable \nMultiple phishing, worms, trojans found.", "modified": "2023-12-10T15:02:17.524000", "created": "2023-11-10T20:28:55.817000", "tags": [ "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february", "passive dns", "urls", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "related nids", "date", "status", "domain", "search", "critical" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nymalm Trojan", "display_name": "Nymalm Trojan", "target": null }, { "id": "trojan.tepfer/kelihos", "display_name": "trojan.tepfer/kelihos", "target": null } ], "attack_ids": [], "industries": [ "Health" ], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6879, "FileHash-MD5": 31, "FileHash-SHA1": 30, "FileHash-SHA256": 882, "domain": 4691, "hostname": 2047, "email": 1 }, "indicator_count": 14561, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e928f68edf93885520275", "name": "Nymalm Trojan | Imagining Center", "description": "Rulesets:\nINDICATOR_EXE_Packed_VMProtect \nindicator_packed \nCritical Risk: INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA ruleset \nMalicious payloads that are hidden in fake Windows error logs \nHigh Risk: Nymalm Trojan\nAutorun Keys \nExecutable by an Executable \nMultiple phishing, worms, trojans found.", "modified": "2023-12-10T15:02:17.524000", "created": "2023-11-10T20:29:03.169000", "tags": [ "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february", "passive dns", "urls", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "related nids", "date", "status", "domain", "search", "critical" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nymalm Trojan", "display_name": "Nymalm Trojan", "target": null }, { "id": "trojan.tepfer/kelihos", "display_name": "trojan.tepfer/kelihos", "target": null } ], "attack_ids": [], "industries": [ "Health" ], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6879, "FileHash-MD5": 31, "FileHash-SHA1": 30, "FileHash-SHA256": 882, "domain": 4691, "hostname": 2047, "email": 1 }, "indicator_count": 14561, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e9290b19ddef38f1a66a1", "name": "Nymalm Trojan | Imagining Center", "description": "Rulesets:\nINDICATOR_EXE_Packed_VMProtect \nindicator_packed \nCritical Risk: INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA ruleset \nMalicious payloads that are hidden in fake Windows error logs \nHigh Risk: Nymalm Trojan\nAutorun Keys \nExecutable by an Executable \nMultiple phishing, worms, trojans found.", "modified": "2023-12-10T15:02:17.524000", "created": "2023-11-10T20:29:04.749000", "tags": [ "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february", "passive dns", "urls", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "related nids", "date", "status", "domain", "search", "critical" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nymalm Trojan", "display_name": "Nymalm Trojan", "target": null }, { "id": "trojan.tepfer/kelihos", "display_name": "trojan.tepfer/kelihos", "target": null } ], "attack_ids": [], "industries": [ "Health" ], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6879, "FileHash-MD5": 31, "FileHash-SHA1": 30, "FileHash-SHA256": 882, "domain": 4691, "hostname": 2047, "email": 1 }, "indicator_count": 14561, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e9290ecfe0631639b3509", "name": "Nymalm Trojan | Imagining Center", "description": "Rulesets:\nINDICATOR_EXE_Packed_VMProtect \nindicator_packed \nCritical Risk: INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA ruleset \nMalicious payloads that are hidden in fake Windows error logs \nHigh Risk: Nymalm Trojan\nAutorun Keys \nExecutable by an Executable \nMultiple phishing, worms, trojans found.", "modified": "2023-12-10T15:02:17.524000", "created": "2023-11-10T20:29:04.736000", "tags": [ "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february", "passive dns", "urls", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "related nids", "date", "status", "domain", "search", "critical" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nymalm Trojan", "display_name": "Nymalm Trojan", "target": null }, { "id": "trojan.tepfer/kelihos", "display_name": "trojan.tepfer/kelihos", "target": null } ], "attack_ids": [], "industries": [ "Health" ], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6879, "FileHash-MD5": 31, "FileHash-SHA1": 30, "FileHash-SHA256": 882, "domain": 4691, "hostname": 2047, "email": 1 }, "indicator_count": 14561, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e929487634ef5db41f048", "name": "Nymalm Trojan | Imagining Center", "description": "Rulesets:\nINDICATOR_EXE_Packed_VMProtect \nindicator_packed \nCritical Risk: INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA ruleset \nMalicious payloads that are hidden in fake Windows error logs \nHigh Risk: Nymalm Trojan\nAutorun Keys \nExecutable by an Executable \nMultiple phishing, worms, trojans found.", "modified": "2023-12-10T15:02:17.524000", "created": "2023-11-10T20:29:08.678000", "tags": [ "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february", "passive dns", "urls", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "related nids", "date", "status", "domain", "search", "critical" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nymalm Trojan", "display_name": "Nymalm Trojan", "target": null }, { "id": "trojan.tepfer/kelihos", "display_name": "trojan.tepfer/kelihos", "target": null } ], "attack_ids": [], "industries": [ "Health" ], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6879, "FileHash-MD5": 31, "FileHash-SHA1": 30, "FileHash-SHA256": 882, "domain": 4691, "hostname": 2047, "email": 1 }, "indicator_count": 14561, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e46078568d62bc323e093", "name": "Imaging Center affected by WebToolbar \u2022 Critical C2 and Mitre Att", "description": "Critical - dpqhhab.exe\n216d5b6361d88c59cd0fb66c0ca94a27f6c1e0d592fc325b6d58929d4d5a1e76", "modified": "2023-12-10T13:00:37.604000", "created": "2023-11-10T15:02:31.518000", "tags": [ "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "cisco umbrella", "site", "heur", "alexa top", "safe site", "million", "malware", "malware site", "phishing site", "malicious site", "crack", "wacatac", "unsafe", "phishing", "xrat", "xtrat", "nircmd", "swrort", "iframe", "downldr", "installcore", "agent", "unruy", "filetour", "cleaner", "patcher", "adload", "win64", "artemis", "riskware", "genkryptik", "fuery", "alexa", "blacklist https", "united", "ip address", "presenoker", "opencandy", "exploit", "quasar rat", "mimikatz", "malicious", "applicunwnt", "acint", "systweak", "behav", "tiggre", "conduit", "trojanspy", "webtoolbar", "gc", "xfbml1", "pattern match", "file", "ascii text", "indicator", "windows nt", "script", "appdata", "mitre att", "date", "unknown", "error", "hybrid", "general", "local", "click", "facebook", "strings", "class", "generator", "critical", "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 221, "FileHash-SHA1": 171, "FileHash-SHA256": 2904, "domain": 4834, "hostname": 1631, "CVE": 9, "URL": 5670 }, "indicator_count": 15440, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e46130211d24d7f9ef311", "name": "Imaging Center affected by WebToolbar \u2022 Critical C2 and Mitre Att", "description": "Critical - dpqhhab.exe\n216d5b6361d88c59cd0fb66c0ca94a27f6c1e0d592fc325b6d58929d4d5a1e76", "modified": "2023-12-10T13:00:37.604000", "created": "2023-11-10T15:02:43.841000", "tags": [ "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "cisco umbrella", "site", "heur", "alexa top", "safe site", "million", "malware", "malware site", "phishing site", "malicious site", "crack", "wacatac", "unsafe", "phishing", "xrat", "xtrat", "nircmd", "swrort", "iframe", "downldr", "installcore", "agent", "unruy", "filetour", "cleaner", "patcher", "adload", "win64", "artemis", "riskware", "genkryptik", "fuery", "alexa", "blacklist https", "united", "ip address", "presenoker", "opencandy", "exploit", "quasar rat", "mimikatz", "malicious", "applicunwnt", "acint", "systweak", "behav", "tiggre", "conduit", "trojanspy", "webtoolbar", "gc", "xfbml1", "pattern match", "file", "ascii text", "indicator", "windows nt", "script", "appdata", "mitre att", "date", "unknown", "error", "hybrid", "general", "local", "click", "facebook", "strings", "class", "generator", "critical", "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 221, "FileHash-SHA1": 171, "FileHash-SHA256": 2904, "domain": 4834, "hostname": 1631, "CVE": 9, "URL": 5670 }, "indicator_count": 15440, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e469fbf2e1c732bbeb7a3", "name": "Imaging Center affected by WebToolbar \u2022 Critical C2 and Mitre Att", "description": "Critical - dpqhhab.exe\n216d5b6361d88c59cd0fb66c0ca94a27f6c1e0d592fc325b6d58929d4d5a1e76\n\nAllows bad actor to alter diagnosis without physician override or documentation of.", "modified": "2023-12-10T13:00:37.604000", "created": "2023-11-10T15:05:03.947000", "tags": [ "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "cisco umbrella", "site", "heur", "alexa top", "safe site", "million", "malware", "malware site", "phishing site", "malicious site", "crack", "wacatac", "unsafe", "phishing", "xrat", "xtrat", "nircmd", "swrort", "iframe", "downldr", "installcore", "agent", "unruy", "filetour", "cleaner", "patcher", "adload", "win64", "artemis", "riskware", "genkryptik", "fuery", "alexa", "blacklist https", "united", "ip address", "presenoker", "opencandy", "exploit", "quasar rat", "mimikatz", "malicious", "applicunwnt", "acint", "systweak", "behav", "tiggre", "conduit", "trojanspy", "webtoolbar", "gc", "xfbml1", "pattern match", "file", "ascii text", "indicator", "windows nt", "script", "appdata", "mitre att", "date", "unknown", "error", "hybrid", "general", "local", "click", "facebook", "strings", "class", "generator", "critical", "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 221, "FileHash-SHA1": 171, "FileHash-SHA256": 2904, "domain": 4834, "hostname": 1631, "CVE": 9, "URL": 5670 }, "indicator_count": 15440, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "ww16.porn-community.porn25.com", "cdn.pornsocket.com", "https://severeporn-com.pornproxy.page/", "xhamster.comyouporn.com", "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1", "www.redtube.comyouporn.com", "http://xred.mooo.com", "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null", "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com", "jimgaffigan.com", "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com", "imp.fusioninstall.com", "https://twitter.com/PORNO_SEXYBABES", "https://www.songculture.com/tsara-lynn-brashears-music", "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf", "https://totallyspies.1000hentai.com/tag/clover-porn/", "838114.parkingcrew.net", "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo", "campaign-manager.sharecare.com", "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net", "pirateproxy.cc", "http://45.159.189.105/bot/regex", "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music", "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com", "192.185.223.216 | 192.168.56.1 [malware]", "https://mylegalbid.com/malwarebytes", "http://secure.indianpornpass.com/track/hotpornstuff", "mwilliams.dev@gmail.com | piratepages.com", "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z", "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org", "qa.companycam.com", "https://sexgalaxy.net/tag/rodneymoore/", "http://alive.overit.com/~schoolbu/badmood3.exe", "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe", "qbot.zip", "static-push-preprod.porndig.com", "weconnect.com", "www.anyxxxtube.net", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "watchhers.net", "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend", "yoursexy.porn | indianyouporn.com", "dropboxpayments.com", "cams4all.com", "youramateuporn.com", "24-70mm.camera", "ns2.abovedomains.com" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Adware affiliate", "Gc", "Trojanspy", "Virtool", "Possible", "Trojan.tepfer/kelihos", "Nymalm trojan", "Webtoolbar", "Azorult cnc" ], "industries": [ "Health" ], "unique_indicators": 45297 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/keayscreative.com", "whois": "http://whois.domaintools.com/keayscreative.com", "domain": "keayscreative.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 11, "pulses": [ { "id": "65be56d257bb241c4fa3f68d", "name": "AZORult CnC", "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares", "modified": "2024-03-04T14:03:17.574000", "created": "2024-02-03T15:08:02.291000", "tags": [ "ssl certificate", "whois record", "threat roundup", "whois whois", "january", "historical ssl", "referrer", "april", "resolutions", "siblings domain", "march", "february", "obz4usfn0 http", "problems", "threat network", "infrastructure", "st201601152", "startpage", "iframe", "united", "unknown", "search", "showing", "united kingdom", "creation date", "aaaa", "cname", "scan endpoints", "all octoseek", "date", "next", "script urls", "soa nxdomain", "link", "xml title", "portugal", "domain", "status", "expiration date", "pulse pulses", "as44273 host", "domain robot", "as61969 team", "body", "as8075", "netherlands", "servers", "emails", "duo insight", "type", "asnone united", "name servers", "germany unknown", "passive dns", "as14061", "as49453", "lowfi", "a domains", "urls", "privacy inc", "customer", "trojandropper", "dynamicloader", "default", "medium", "entries", "khtml", "download", "show", "activity", "http", "copy", "write", "malware", "adware affiliate", "hostname", "trojan", "pulse submit", "url analysis", "files", "as212913 fop", "russia unknown", "as397240", "as15169 google", "as19237 omnis", "as22169 omnis", "as20068 hawk", "as133618", "as47846", "as22489", "encrypt", "record value", "pragma", "accept ch", "ireland unknown", "msie", "chrome", "style", "gmt setcookie", "as6724 strato", "core", "win32", "backdoor", "expl", "exploit", "ipv4", "virtool", "azorult cnc", "possible", "as7018 att", "regsetvalueexa", "china as4134", "service", "asnone", "dns lookup", "ransom", "push", "eternalblue", "recon", "playgame", "domain name", "as13768 aptum", "meta", "error", "as43350 nforce", "as55286", "as60558 phoenix", "ip address", "registrar", "1996", "contacted", "unlocker", "red team", "af81 http", "execution", "open", "whois sslcert", "suspicious c2", "cve202322518", "collection", "vt graph", "excel", "emotet", "metro", "jeffrey reimer pt", "sharecare", "tsara brashears", "apple", "icloud" ], "references": [ "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z", "qbot.zip", "imp.fusioninstall.com", "https://mylegalbid.com/malwarebytes", "192.185.223.216 | 192.168.56.1 [malware]", "http://45.159.189.105/bot/regex", "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null", "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf", "xhamster.comyouporn.com", "cams4all.com", "watchhers.net", "weconnect.com", "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net", "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe", "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com", "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com", "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music", "https://www.songculture.com/tsara-lynn-brashears-music", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "youramateuporn.com", "ns2.abovedomains.com", "ww16.porn-community.porn25.com", "https://totallyspies.1000hentai.com/tag/clover-porn/", "pirateproxy.cc", "mwilliams.dev@gmail.com | piratepages.com", "838114.parkingcrew.net", "static-push-preprod.porndig.com", "www.redtube.comyouporn.com", "https://severeporn-com.pornproxy.page/", "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend", "yoursexy.porn | indianyouporn.com", "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com", "cdn.pornsocket.com", "http://secure.indianpornpass.com/track/hotpornstuff", "www.anyxxxtube.net", "https://twitter.com/PORNO_SEXYBABES", "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo", "campaign-manager.sharecare.com", "qa.companycam.com", "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1", "24-70mm.camera", "dropboxpayments.com", "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org", "http://xred.mooo.com", "https://sexgalaxy.net/tag/rodneymoore/", "http://alive.overit.com/~schoolbu/badmood3.exe", "jimgaffigan.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United Kingdom of Great Britain and Northern Ireland", "United States of America", "Netherlands", "Germany", "France" ], "malware_families": [ { "id": "Adware Affiliate", "display_name": "Adware Affiliate", "target": null }, { "id": "AZORult CnC", "display_name": "AZORult CnC", "target": null }, { "id": "Possible", "display_name": "Possible", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 737, "FileHash-SHA1": 692, "FileHash-SHA256": 7488, "URL": 6694, "domain": 5247, "hostname": 2932, "email": 49, "CVE": 2, "SSLCertFingerprint": 1 }, "indicator_count": 23842, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "776 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65be56d6df9d36bac14ccd87", "name": "AZORult CnC", "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares", "modified": "2024-03-04T14:03:17.574000", "created": "2024-02-03T15:08:06.808000", "tags": [ "ssl certificate", "whois record", "threat roundup", "whois whois", "january", "historical ssl", "referrer", "april", "resolutions", "siblings domain", "march", "february", "obz4usfn0 http", "problems", "threat network", "infrastructure", "st201601152", "startpage", "iframe", "united", "unknown", "search", "showing", "united kingdom", "creation date", "aaaa", "cname", "scan endpoints", "all octoseek", "date", "next", "script urls", "soa nxdomain", "link", "xml title", "portugal", "domain", "status", "expiration date", "pulse pulses", "as44273 host", "domain robot", "as61969 team", "body", "as8075", "netherlands", "servers", "emails", "duo insight", "type", "asnone united", "name servers", "germany unknown", "passive dns", "as14061", "as49453", "lowfi", "a domains", "urls", "privacy inc", "customer", "trojandropper", "dynamicloader", "default", "medium", "entries", "khtml", "download", "show", "activity", "http", "copy", "write", "malware", "adware affiliate", "hostname", "trojan", "pulse submit", "url analysis", "files", "as212913 fop", "russia unknown", "as397240", "as15169 google", "as19237 omnis", "as22169 omnis", "as20068 hawk", "as133618", "as47846", "as22489", "encrypt", "record value", "pragma", "accept ch", "ireland unknown", "msie", "chrome", "style", "gmt setcookie", "as6724 strato", "core", "win32", "backdoor", "expl", "exploit", "ipv4", "virtool", "azorult cnc", "possible", "as7018 att", "regsetvalueexa", "china as4134", "service", "asnone", "dns lookup", "ransom", "push", "eternalblue", "recon", "playgame", "domain name", "as13768 aptum", "meta", "error", "as43350 nforce", "as55286", "as60558 phoenix", "ip address", "registrar", "1996", "contacted", "unlocker", "red team", "af81 http", "execution", "open", "whois sslcert", "suspicious c2", "cve202322518", "collection", "vt graph", "excel", "emotet", "metro", "jeffrey reimer pt", "sharecare", "tsara brashears", "apple", "icloud" ], "references": [ "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z", "qbot.zip", "imp.fusioninstall.com", "https://mylegalbid.com/malwarebytes", "192.185.223.216 | 192.168.56.1 [malware]", "http://45.159.189.105/bot/regex", "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null", "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf", "xhamster.comyouporn.com", "cams4all.com", "watchhers.net", "weconnect.com", "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net", "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe", "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com", "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com", "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music", "https://www.songculture.com/tsara-lynn-brashears-music", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "youramateuporn.com", "ns2.abovedomains.com", "ww16.porn-community.porn25.com", "https://totallyspies.1000hentai.com/tag/clover-porn/", "pirateproxy.cc", "mwilliams.dev@gmail.com | piratepages.com", "838114.parkingcrew.net", "static-push-preprod.porndig.com", "www.redtube.comyouporn.com", "https://severeporn-com.pornproxy.page/", "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend", "yoursexy.porn | indianyouporn.com", "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com", "cdn.pornsocket.com", "http://secure.indianpornpass.com/track/hotpornstuff", "www.anyxxxtube.net", "https://twitter.com/PORNO_SEXYBABES", "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo", "campaign-manager.sharecare.com", "qa.companycam.com", "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1", "24-70mm.camera", "dropboxpayments.com", "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org", "http://xred.mooo.com", "https://sexgalaxy.net/tag/rodneymoore/", "http://alive.overit.com/~schoolbu/badmood3.exe", "jimgaffigan.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United Kingdom of Great Britain and Northern Ireland", "United States of America", "Netherlands", "Germany", "France" ], "malware_families": [ { "id": "Adware Affiliate", "display_name": "Adware Affiliate", "target": null }, { "id": "AZORult CnC", "display_name": "AZORult CnC", "target": null }, { "id": "Possible", "display_name": "Possible", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8134, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 737, "FileHash-SHA1": 692, "FileHash-SHA256": 7488, "URL": 6694, "domain": 5247, "hostname": 2932, "email": 49, "CVE": 2, "SSLCertFingerprint": 1 }, "indicator_count": 23842, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "776 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e928261e55d071a39bccb", "name": "Nymalm Trojan | Imagining Center", "description": "Rulesets:\nINDICATOR_EXE_Packed_VMProtect \nindicator_packed \nCritical Risk: INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA ruleset \nMalicious payloads that are hidden in fake Windows error logs \nHigh Risk: Nymalm Trojan\nAutorun Keys \nExecutable by an Executable \nMultiple phishing, worms, trojans found.", "modified": "2023-12-10T15:02:17.524000", "created": "2023-11-10T20:28:50.858000", "tags": [ "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february", "passive dns", "urls", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "related nids", "date", "status", "domain", "search", "critical" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nymalm Trojan", "display_name": "Nymalm Trojan", "target": null }, { "id": "trojan.tepfer/kelihos", "display_name": "trojan.tepfer/kelihos", "target": null } ], "attack_ids": [], "industries": [ "Health" ], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6879, "FileHash-MD5": 31, "FileHash-SHA1": 30, "FileHash-SHA256": 882, "domain": 4691, "hostname": 2047, "email": 1 }, "indicator_count": 14561, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e928722983be3cff90ea6", "name": "Nymalm Trojan | Imagining Center", "description": "Rulesets:\nINDICATOR_EXE_Packed_VMProtect \nindicator_packed \nCritical Risk: INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA ruleset \nMalicious payloads that are hidden in fake Windows error logs \nHigh Risk: Nymalm Trojan\nAutorun Keys \nExecutable by an Executable \nMultiple phishing, worms, trojans found.", "modified": "2023-12-10T15:02:17.524000", "created": "2023-11-10T20:28:55.817000", "tags": [ "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february", "passive dns", "urls", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "related nids", "date", "status", "domain", "search", "critical" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nymalm Trojan", "display_name": "Nymalm Trojan", "target": null }, { "id": "trojan.tepfer/kelihos", "display_name": "trojan.tepfer/kelihos", "target": null } ], "attack_ids": [], "industries": [ "Health" ], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6879, "FileHash-MD5": 31, "FileHash-SHA1": 30, "FileHash-SHA256": 882, "domain": 4691, "hostname": 2047, "email": 1 }, "indicator_count": 14561, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e928f68edf93885520275", "name": "Nymalm Trojan | Imagining Center", "description": "Rulesets:\nINDICATOR_EXE_Packed_VMProtect \nindicator_packed \nCritical Risk: INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA ruleset \nMalicious payloads that are hidden in fake Windows error logs \nHigh Risk: Nymalm Trojan\nAutorun Keys \nExecutable by an Executable \nMultiple phishing, worms, trojans found.", "modified": "2023-12-10T15:02:17.524000", "created": "2023-11-10T20:29:03.169000", "tags": [ "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february", "passive dns", "urls", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "related nids", "date", "status", "domain", "search", "critical" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nymalm Trojan", "display_name": "Nymalm Trojan", "target": null }, { "id": "trojan.tepfer/kelihos", "display_name": "trojan.tepfer/kelihos", "target": null } ], "attack_ids": [], "industries": [ "Health" ], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6879, "FileHash-MD5": 31, "FileHash-SHA1": 30, "FileHash-SHA256": 882, "domain": 4691, "hostname": 2047, "email": 1 }, "indicator_count": 14561, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e9290b19ddef38f1a66a1", "name": "Nymalm Trojan | Imagining Center", "description": "Rulesets:\nINDICATOR_EXE_Packed_VMProtect \nindicator_packed \nCritical Risk: INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA ruleset \nMalicious payloads that are hidden in fake Windows error logs \nHigh Risk: Nymalm Trojan\nAutorun Keys \nExecutable by an Executable \nMultiple phishing, worms, trojans found.", "modified": "2023-12-10T15:02:17.524000", "created": "2023-11-10T20:29:04.749000", "tags": [ "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february", "passive dns", "urls", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "related nids", "date", "status", "domain", "search", "critical" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nymalm Trojan", "display_name": "Nymalm Trojan", "target": null }, { "id": "trojan.tepfer/kelihos", "display_name": "trojan.tepfer/kelihos", "target": null } ], "attack_ids": [], "industries": [ "Health" ], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6879, "FileHash-MD5": 31, "FileHash-SHA1": 30, "FileHash-SHA256": 882, "domain": 4691, "hostname": 2047, "email": 1 }, "indicator_count": 14561, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e9290ecfe0631639b3509", "name": "Nymalm Trojan | Imagining Center", "description": "Rulesets:\nINDICATOR_EXE_Packed_VMProtect \nindicator_packed \nCritical Risk: INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA ruleset \nMalicious payloads that are hidden in fake Windows error logs \nHigh Risk: Nymalm Trojan\nAutorun Keys \nExecutable by an Executable \nMultiple phishing, worms, trojans found.", "modified": "2023-12-10T15:02:17.524000", "created": "2023-11-10T20:29:04.736000", "tags": [ "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february", "passive dns", "urls", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "related nids", "date", "status", "domain", "search", "critical" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nymalm Trojan", "display_name": "Nymalm Trojan", "target": null }, { "id": "trojan.tepfer/kelihos", "display_name": "trojan.tepfer/kelihos", "target": null } ], "attack_ids": [], "industries": [ "Health" ], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6879, "FileHash-MD5": 31, "FileHash-SHA1": 30, "FileHash-SHA256": 882, "domain": 4691, "hostname": 2047, "email": 1 }, "indicator_count": 14561, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e929487634ef5db41f048", "name": "Nymalm Trojan | Imagining Center", "description": "Rulesets:\nINDICATOR_EXE_Packed_VMProtect \nindicator_packed \nCritical Risk: INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA ruleset \nMalicious payloads that are hidden in fake Windows error logs \nHigh Risk: Nymalm Trojan\nAutorun Keys \nExecutable by an Executable \nMultiple phishing, worms, trojans found.", "modified": "2023-12-10T15:02:17.524000", "created": "2023-11-10T20:29:08.678000", "tags": [ "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february", "passive dns", "urls", "scan endpoints", "all search", "otx octoseek", "url http", "pulse pulses", "http", "ip address", "related nids", "date", "status", "domain", "search", "critical" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nymalm Trojan", "display_name": "Nymalm Trojan", "target": null }, { "id": "trojan.tepfer/kelihos", "display_name": "trojan.tepfer/kelihos", "target": null } ], "attack_ids": [], "industries": [ "Health" ], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6879, "FileHash-MD5": 31, "FileHash-SHA1": 30, "FileHash-SHA256": 882, "domain": 4691, "hostname": 2047, "email": 1 }, "indicator_count": 14561, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e46078568d62bc323e093", "name": "Imaging Center affected by WebToolbar \u2022 Critical C2 and Mitre Att", "description": "Critical - dpqhhab.exe\n216d5b6361d88c59cd0fb66c0ca94a27f6c1e0d592fc325b6d58929d4d5a1e76", "modified": "2023-12-10T13:00:37.604000", "created": "2023-11-10T15:02:31.518000", "tags": [ "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "cisco umbrella", "site", "heur", "alexa top", "safe site", "million", "malware", "malware site", "phishing site", "malicious site", "crack", "wacatac", "unsafe", "phishing", "xrat", "xtrat", "nircmd", "swrort", "iframe", "downldr", "installcore", "agent", "unruy", "filetour", "cleaner", "patcher", "adload", "win64", "artemis", "riskware", "genkryptik", "fuery", "alexa", "blacklist https", "united", "ip address", "presenoker", "opencandy", "exploit", "quasar rat", "mimikatz", "malicious", "applicunwnt", "acint", "systweak", "behav", "tiggre", "conduit", "trojanspy", "webtoolbar", "gc", "xfbml1", "pattern match", "file", "ascii text", "indicator", "windows nt", "script", "appdata", "mitre att", "date", "unknown", "error", "hybrid", "general", "local", "click", "facebook", "strings", "class", "generator", "critical", "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 221, "FileHash-SHA1": 171, "FileHash-SHA256": 2904, "domain": 4834, "hostname": 1631, "CVE": 9, "URL": 5670 }, "indicator_count": 15440, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "654e46130211d24d7f9ef311", "name": "Imaging Center affected by WebToolbar \u2022 Critical C2 and Mitre Att", "description": "Critical - dpqhhab.exe\n216d5b6361d88c59cd0fb66c0ca94a27f6c1e0d592fc325b6d58929d4d5a1e76", "modified": "2023-12-10T13:00:37.604000", "created": "2023-11-10T15:02:43.841000", "tags": [ "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "cisco umbrella", "site", "heur", "alexa top", "safe site", "million", "malware", "malware site", "phishing site", "malicious site", "crack", "wacatac", "unsafe", "phishing", "xrat", "xtrat", "nircmd", "swrort", "iframe", "downldr", "installcore", "agent", "unruy", "filetour", "cleaner", "patcher", "adload", "win64", "artemis", "riskware", "genkryptik", "fuery", "alexa", "blacklist https", "united", "ip address", "presenoker", "opencandy", "exploit", "quasar rat", "mimikatz", "malicious", "applicunwnt", "acint", "systweak", "behav", "tiggre", "conduit", "trojanspy", "webtoolbar", "gc", "xfbml1", "pattern match", "file", "ascii text", "indicator", "windows nt", "script", "appdata", "mitre att", "date", "unknown", "error", "hybrid", "general", "local", "click", "facebook", "strings", "class", "generator", "critical", "ssl certificate", "whois record", "threat roundup", "october", "contacted", "january", "resolutions", "whois whois", "june", "communicating", "february" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "WebToolbar", "display_name": "WebToolbar", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 221, "FileHash-SHA1": 171, "FileHash-SHA256": 2904, "domain": 4834, "hostname": 1631, "CVE": 9, "URL": 5670 }, "indicator_count": 15440, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://keayscreative.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://keayscreative.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776631672.2534359 }