{ "type": "URL", "indicator": "https://learning.dmec.org", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://learning.dmec.org", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4132894289, "indicator": "https://learning.dmec.org", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 1, "pulses": [ { "id": "68cf2c43f6493c55c8d08bf9", "name": "Executed \u2022 Installend RMS Module | .exe RMS.exe", "description": "Recap: Executed in Denver, Co.USA. Attacked a Newly purchased iPhone. Multi person attempt . Attacker executed via watch. . Related to Trump campaign Palantir text linked in references. \n\nCyberInt states that Remote Manipulator System (RMS) is a legitimate tool developed by Russian organization TektonIT and has been observed in campaigns conducted by TA505 as well as numerous smaller campaigns likely attributable to other, disparate, threat actors. In addition to the availability of commercial licenses, the tool is free for non-commercial use and supports the remote administration of both Microsoft Windows and Android devices.\nCreation Date\n2023-05-01 00:28:45\nLast Modification Date\n2025-09-13 22:34:36\n- by CarlosCabal (VirusTotal)\n\nInteresting. Being used in America.", "modified": "2025-10-20T21:03:08.498000", "created": "2025-09-20T22:35:47.459000", "tags": [ "lowfi", "tektonit yara", "pulses otx", "pexe", "pe32", "intel", "vendor finding", "ms defender", "number", "install", "installend", "igor", "pavlov", "remote access tool", "dynamicloader", "medium", "dynamic", "ip address", "domain", "file name", "reads", "windows", "checks", "pehash external", "rms", "rms module", "private build", "watch", "msie", "windows nt", "wow64", "slcc2", "media center", "port", "destination", "search", "united", "read c", "write", "persistence", "execution", "malware", "push", "copy", "next", "autorun", "unknown", "skykit", "companyname", "insta", "dod", "udp a83f8110", "encoding", "e1203 windows", "file attributes", "catalog tree", "analysis ob0001", "analysis ob0002", "f0002 polling", "control ob0004", "access ob0005", "defense evasion", "extraction", "data upload", "failed", "related tru", "unit data", "included review", "iocs", "suggestedloes", "find su", "type o", "extr", "references try", "cat antivirus", "com tektonit", "original f", "match info", "adversaries", "match unknown", "30000s", "info", "info checks", "taskjob t1053", "execution flow", "t1574 dll", "window", "tulach", "yara", "hallrender", "apple", "ios", "114.114.114.114", "targeted", "monitoring", "brian sabey & co", "tsara brashears target", "angry quasi", "pp mafia", "dangerous", "redrum", "nemtih" ], "references": [ "Try LogMeIn Resolve For Free \u2014 Powerful tools for device management and remote software installs from LogMeInResolve.", "Installed on Tsara Brashears phone in a drive up incident in October 2024", "Yara: CATEGORY _7_Zip_Installer ;!@Install@! ;!@InstallEnd@! 7z Igor,Pavlov", "Antivirus Detections: Yara.Trojan.Remoteadmin-151 (29:30 BST) - a full list of key details:-1-2-3-4.", "EXE:CompanyName \u2022 TektonIT EXE:EntryPoint:0x121cf \u2022 EXE:FileDescription RMS Component", "TektonIT RMS Component \u2022 6.0 Internal Name \u2022 LegalCopyright\u00a9 2014 TektonIT.", "Original Filename: RMS Module PrivateBuild \u2022 ProductName \u2022 RMS ProductVersion 6.0", "Worn as Watch \u2022 Highlighter yellow & green Large Font. Looks like a toy. Clearly a weapon", "Non white or African American , black haired Middle Eastern 55+ male in non discreet Car", "Vehicle described as Midnight blue , attempted to hit target at a high rate of speed when target left", "parking spot on possibly Logan, male tried to clip target at Logan & 18th. No plates", "Same target l followed and observed at Metro T-mobile on Evans & Federal in Denver", "Described as an Opaque white skinned , non Caucasian bald male. Clearly Persian or Israeli (other) Russian?", "He watched a \u2018target\u2019 while buying least expensive product available. Shirt with US Flag distraction", "Target no longer able to provide info. Paper tags over real Co#LP on car dark colored car.", "Attempted, overt side swipe of family member of target in City Park , by W/M w/US Army tags", "Not surprisingly driving a Ford F 150 | Very disturbing incidents continue. Goal clear. Hired to K****", "Alerts: recon_fingerprint antisandbox_sleep dynamic_function_loading encrypted_ioc", "Alerts: resumethread_remote_process reads_self stealth_window uses_windows_utilities", "Alerts: antivm_checks_available_memory queries_keyboard_layout", "Alerts: stealth_timeout dll_load_uncommon_file_types antidebug_setunhandledexceptionfilter", "Alerts: network_icmp modifies_certificates injection_resumethread dumped_buffer", "Alerts: network_cnc_http network_http creates_exe uses_windows_utilities", "Alerts: allocates_rwx antisandbox_foregroundwindows", "Related Trump pulse: https://otx.alienvault.com/pulse/68c954a80675ccc89b0e9b63", "6.0.0.0 Deep Impact: +Tsara Brashears , +callmeDoris , +Merkd1904 , +scnrscnr, likely dorkingbeauty", "6.0.0.0 United States AS749 DOD network information center \u2022 Historical telemetry", "Don\u2019t ask questions. Just terrorize. destroy equipment paid for by US citizens. What\u2019s yours is theirs.", "IDS: MALWARE-CNC Win.Trojan.Rfusclient outbound connection", "IDS: Matches rule PROTOCOL-ICMP Unusual PING detected", "IDS: PROTOCOL-ICMP PING Windows PROTOCOL-ICMP PING PROTOCOL-ICMP Echo Reply", "IDS: PUA-OTHER RMS rmansys remote management tool cnc communication", "IDS: Unique rule identifier: This rule belongs to a private collection", "Signa: Matches rule Msiexec Quiet Installation by frack113", "Sigma: Matches rule Remote Access Tool Services Have Been Installed - Security by Connor Martin, Nasreddine Bencherchali (Nextron Systems)", "Sigma: Matches rule Compression Utility Passed Uncommon Directory (via cmdline) by SOC Prime Team", "Capabilities: Collection Get geographical location \u2022 Log keystrokes via polling", "Capabilities: Anti-Analysis Self delete \u2022 Inspect load icon resource", "Capabilities: Targeting Identify system language via API", "Capabilities: Data-Manipulation Encode data using XOR Hash data with CRC32", "Capabilities: Persistence Create shortcut via IShellLink Communication \u2022 Write and execute a file", "Malware packed. Haven\u2019t sorted all.", "Continued stalking \u2022 I am of course also being targeted w/ attempts requiring surgery.", "Very dangerous. Has been going on for 12+ years affecting everyone who knew target.", "Machiavellians have already built a new world with a world. Some fear the Apocalypse they created.", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/mc/challenge/brw/do/210/dd14d159", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/210/d5caee55-c7ae-4b3a-8be7-b65fa5f885c9", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/210/d5caee55-c7ae-4b3a-8be7-b65fa5f885c9", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/220/6b180faa-7ce7-4e26-a3b0-aa241497c70f", "The attackers are all different races, Caucasian, African American, Asian, Indian, Persian, Ethiopian, and ambiguous", "I\u2019d like to make an appeal. Please stop. Your original target has gone away." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "#Lowfi:HSTR:MonitoringTool:TektonIt", "display_name": "#Lowfi:HSTR:MonitoringTool:TektonIt", "target": null }, { "id": "Win.Trojan.Remoteadmin-151", "display_name": "Win.Trojan.Remoteadmin-151", "target": null }, { "id": "Win.Trojan.Rfusclient", "display_name": "Win.Trojan.Rfusclient", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "TrojanDownloader:HTML/Adodb.gen!A", "display_name": "TrojanDownloader:HTML/Adodb.gen!A", "target": "/malware/TrojanDownloader:HTML/Adodb.gen!A" } ], "attack_ids": [ { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 479, "FileHash-SHA1": 436, "FileHash-SHA256": 2102, "URL": 659, "domain": 162, "hostname": 305, "SSLCertFingerprint": 1, "email": 6 }, "indicator_count": 4150, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "224 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "IDS: PUA-OTHER RMS rmansys remote management tool cnc communication", "The attackers are all different races, Caucasian, African American, Asian, Indian, Persian, Ethiopian, and ambiguous", "Alerts: antivm_checks_available_memory queries_keyboard_layout", "Target no longer able to provide info. Paper tags over real Co#LP on car dark colored car.", "Non white or African American , black haired Middle Eastern 55+ male in non discreet Car", "Capabilities: Targeting Identify system language via API", "Yara: CATEGORY _7_Zip_Installer ;!@Install@! ;!@InstallEnd@! 7z Igor,Pavlov", "He watched a \u2018target\u2019 while buying least expensive product available. Shirt with US Flag distraction", "Capabilities: Anti-Analysis Self delete \u2022 Inspect load icon resource", "Alerts: network_cnc_http network_http creates_exe uses_windows_utilities", "Alerts: stealth_timeout dll_load_uncommon_file_types antidebug_setunhandledexceptionfilter", "Worn as Watch \u2022 Highlighter yellow & green Large Font. Looks like a toy. Clearly a weapon", "Vehicle described as Midnight blue , attempted to hit target at a high rate of speed when target left", "Malware packed. Haven\u2019t sorted all.", "Don\u2019t ask questions. Just terrorize. destroy equipment paid for by US citizens. What\u2019s yours is theirs.", "Described as an Opaque white skinned , non Caucasian bald male. Clearly Persian or Israeli (other) Russian?", "Alerts: resumethread_remote_process reads_self stealth_window uses_windows_utilities", "parking spot on possibly Logan, male tried to clip target at Logan & 18th. No plates", "IDS: MALWARE-CNC Win.Trojan.Rfusclient outbound connection", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/210/d5caee55-c7ae-4b3a-8be7-b65fa5f885c9", "Installed on Tsara Brashears phone in a drive up incident in October 2024", "Alerts: network_icmp modifies_certificates injection_resumethread dumped_buffer", "Antivirus Detections: Yara.Trojan.Remoteadmin-151 (29:30 BST) - a full list of key details:-1-2-3-4.", "Not surprisingly driving a Ford F 150 | Very disturbing incidents continue. Goal clear. Hired to K****", "Sigma: Matches rule Remote Access Tool Services Have Been Installed - Security by Connor Martin, Nasreddine Bencherchali (Nextron Systems)", "6.0.0.0 Deep Impact: +Tsara Brashears , +callmeDoris , +Merkd1904 , +scnrscnr, likely dorkingbeauty", "Attempted, overt side swipe of family member of target in City Park , by W/M w/US Army tags", "TektonIT RMS Component \u2022 6.0 Internal Name \u2022 LegalCopyright\u00a9 2014 TektonIT.", "Continued stalking \u2022 I am of course also being targeted w/ attempts requiring surgery.", "EXE:CompanyName \u2022 TektonIT EXE:EntryPoint:0x121cf \u2022 EXE:FileDescription RMS Component", "Original Filename: RMS Module PrivateBuild \u2022 ProductName \u2022 RMS ProductVersion 6.0", "Related Trump pulse: https://otx.alienvault.com/pulse/68c954a80675ccc89b0e9b63", "Sigma: Matches rule Compression Utility Passed Uncommon Directory (via cmdline) by SOC Prime Team", "Capabilities: Collection Get geographical location \u2022 Log keystrokes via polling", "Very dangerous. Has been going on for 12+ years affecting everyone who knew target.", "Alerts: recon_fingerprint antisandbox_sleep dynamic_function_loading encrypted_ioc", "Capabilities: Persistence Create shortcut via IShellLink Communication \u2022 Write and execute a file", "IDS: PROTOCOL-ICMP PING Windows PROTOCOL-ICMP PING PROTOCOL-ICMP Echo Reply", "IDS: Matches rule PROTOCOL-ICMP Unusual PING detected", "Capabilities: Data-Manipulation Encode data using XOR Hash data with CRC32", "Alerts: allocates_rwx antisandbox_foregroundwindows", "Machiavellians have already built a new world with a world. Some fear the Apocalypse they created.", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/220/6b180faa-7ce7-4e26-a3b0-aa241497c70f", "Same target l followed and observed at Metro T-mobile on Evans & Federal in Denver", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/mc/challenge/brw/do/210/dd14d159", "Try LogMeIn Resolve For Free \u2014 Powerful tools for device management and remote software installs from LogMeInResolve.", "IDS: Unique rule identifier: This rule belongs to a private collection", "I\u2019d like to make an appeal. Please stop. Your original target has gone away.", "Signa: Matches rule Msiexec Quiet Installation by frack113", "6.0.0.0 United States AS749 DOD network information center \u2022 Historical telemetry" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Win.trojan.rfusclient", "Trojandownloader:html/adodb.gen!a", "Tulach", "#lowfi:hstr:monitoringtool:tektonit", "Win.trojan.remoteadmin-151" ], "industries": [], "unique_indicators": 4298 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/dmec.org", "whois": "http://whois.domaintools.com/dmec.org", "domain": "dmec.org", "hostname": "learning.dmec.org" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 1, "pulses": [ { "id": "68cf2c43f6493c55c8d08bf9", "name": "Executed \u2022 Installend RMS Module | .exe RMS.exe", "description": "Recap: Executed in Denver, Co.USA. Attacked a Newly purchased iPhone. Multi person attempt . Attacker executed via watch. . Related to Trump campaign Palantir text linked in references. \n\nCyberInt states that Remote Manipulator System (RMS) is a legitimate tool developed by Russian organization TektonIT and has been observed in campaigns conducted by TA505 as well as numerous smaller campaigns likely attributable to other, disparate, threat actors. In addition to the availability of commercial licenses, the tool is free for non-commercial use and supports the remote administration of both Microsoft Windows and Android devices.\nCreation Date\n2023-05-01 00:28:45\nLast Modification Date\n2025-09-13 22:34:36\n- by CarlosCabal (VirusTotal)\n\nInteresting. Being used in America.", "modified": "2025-10-20T21:03:08.498000", "created": "2025-09-20T22:35:47.459000", "tags": [ "lowfi", "tektonit yara", "pulses otx", "pexe", "pe32", "intel", "vendor finding", "ms defender", "number", "install", "installend", "igor", "pavlov", "remote access tool", "dynamicloader", "medium", "dynamic", "ip address", "domain", "file name", "reads", "windows", "checks", "pehash external", "rms", "rms module", "private build", "watch", "msie", "windows nt", "wow64", "slcc2", "media center", "port", "destination", "search", "united", "read c", "write", "persistence", "execution", "malware", "push", "copy", "next", "autorun", "unknown", "skykit", "companyname", "insta", "dod", "udp a83f8110", "encoding", "e1203 windows", "file attributes", "catalog tree", "analysis ob0001", "analysis ob0002", "f0002 polling", "control ob0004", "access ob0005", "defense evasion", "extraction", "data upload", "failed", "related tru", "unit data", "included review", "iocs", "suggestedloes", "find su", "type o", "extr", "references try", "cat antivirus", "com tektonit", "original f", "match info", "adversaries", "match unknown", "30000s", "info", "info checks", "taskjob t1053", "execution flow", "t1574 dll", "window", "tulach", "yara", "hallrender", "apple", "ios", "114.114.114.114", "targeted", "monitoring", "brian sabey & co", "tsara brashears target", "angry quasi", "pp mafia", "dangerous", "redrum", "nemtih" ], "references": [ "Try LogMeIn Resolve For Free \u2014 Powerful tools for device management and remote software installs from LogMeInResolve.", "Installed on Tsara Brashears phone in a drive up incident in October 2024", "Yara: CATEGORY _7_Zip_Installer ;!@Install@! ;!@InstallEnd@! 7z Igor,Pavlov", "Antivirus Detections: Yara.Trojan.Remoteadmin-151 (29:30 BST) - a full list of key details:-1-2-3-4.", "EXE:CompanyName \u2022 TektonIT EXE:EntryPoint:0x121cf \u2022 EXE:FileDescription RMS Component", "TektonIT RMS Component \u2022 6.0 Internal Name \u2022 LegalCopyright\u00a9 2014 TektonIT.", "Original Filename: RMS Module PrivateBuild \u2022 ProductName \u2022 RMS ProductVersion 6.0", "Worn as Watch \u2022 Highlighter yellow & green Large Font. Looks like a toy. Clearly a weapon", "Non white or African American , black haired Middle Eastern 55+ male in non discreet Car", "Vehicle described as Midnight blue , attempted to hit target at a high rate of speed when target left", "parking spot on possibly Logan, male tried to clip target at Logan & 18th. No plates", "Same target l followed and observed at Metro T-mobile on Evans & Federal in Denver", "Described as an Opaque white skinned , non Caucasian bald male. Clearly Persian or Israeli (other) Russian?", "He watched a \u2018target\u2019 while buying least expensive product available. Shirt with US Flag distraction", "Target no longer able to provide info. Paper tags over real Co#LP on car dark colored car.", "Attempted, overt side swipe of family member of target in City Park , by W/M w/US Army tags", "Not surprisingly driving a Ford F 150 | Very disturbing incidents continue. Goal clear. Hired to K****", "Alerts: recon_fingerprint antisandbox_sleep dynamic_function_loading encrypted_ioc", "Alerts: resumethread_remote_process reads_self stealth_window uses_windows_utilities", "Alerts: antivm_checks_available_memory queries_keyboard_layout", "Alerts: stealth_timeout dll_load_uncommon_file_types antidebug_setunhandledexceptionfilter", "Alerts: network_icmp modifies_certificates injection_resumethread dumped_buffer", "Alerts: network_cnc_http network_http creates_exe uses_windows_utilities", "Alerts: allocates_rwx antisandbox_foregroundwindows", "Related Trump pulse: https://otx.alienvault.com/pulse/68c954a80675ccc89b0e9b63", "6.0.0.0 Deep Impact: +Tsara Brashears , +callmeDoris , +Merkd1904 , +scnrscnr, likely dorkingbeauty", "6.0.0.0 United States AS749 DOD network information center \u2022 Historical telemetry", "Don\u2019t ask questions. Just terrorize. destroy equipment paid for by US citizens. What\u2019s yours is theirs.", "IDS: MALWARE-CNC Win.Trojan.Rfusclient outbound connection", "IDS: Matches rule PROTOCOL-ICMP Unusual PING detected", "IDS: PROTOCOL-ICMP PING Windows PROTOCOL-ICMP PING PROTOCOL-ICMP Echo Reply", "IDS: PUA-OTHER RMS rmansys remote management tool cnc communication", "IDS: Unique rule identifier: This rule belongs to a private collection", "Signa: Matches rule Msiexec Quiet Installation by frack113", "Sigma: Matches rule Remote Access Tool Services Have Been Installed - Security by Connor Martin, Nasreddine Bencherchali (Nextron Systems)", "Sigma: Matches rule Compression Utility Passed Uncommon Directory (via cmdline) by SOC Prime Team", "Capabilities: Collection Get geographical location \u2022 Log keystrokes via polling", "Capabilities: Anti-Analysis Self delete \u2022 Inspect load icon resource", "Capabilities: Targeting Identify system language via API", "Capabilities: Data-Manipulation Encode data using XOR Hash data with CRC32", "Capabilities: Persistence Create shortcut via IShellLink Communication \u2022 Write and execute a file", "Malware packed. Haven\u2019t sorted all.", "Continued stalking \u2022 I am of course also being targeted w/ attempts requiring surgery.", "Very dangerous. Has been going on for 12+ years affecting everyone who knew target.", "Machiavellians have already built a new world with a world. Some fear the Apocalypse they created.", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/mc/challenge/brw/do/210/dd14d159", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/210/d5caee55-c7ae-4b3a-8be7-b65fa5f885c9", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/210/d5caee55-c7ae-4b3a-8be7-b65fa5f885c9", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/220/6b180faa-7ce7-4e26-a3b0-aa241497c70f", "The attackers are all different races, Caucasian, African American, Asian, Indian, Persian, Ethiopian, and ambiguous", "I\u2019d like to make an appeal. Please stop. Your original target has gone away." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "#Lowfi:HSTR:MonitoringTool:TektonIt", "display_name": "#Lowfi:HSTR:MonitoringTool:TektonIt", "target": null }, { "id": "Win.Trojan.Remoteadmin-151", "display_name": "Win.Trojan.Remoteadmin-151", "target": null }, { "id": "Win.Trojan.Rfusclient", "display_name": "Win.Trojan.Rfusclient", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "TrojanDownloader:HTML/Adodb.gen!A", "display_name": "TrojanDownloader:HTML/Adodb.gen!A", "target": "/malware/TrojanDownloader:HTML/Adodb.gen!A" } ], "attack_ids": [ { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 479, "FileHash-SHA1": 436, "FileHash-SHA256": 2102, "URL": 659, "domain": 162, "hostname": 305, "SSLCertFingerprint": 1, "email": 6 }, "indicator_count": 4150, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "224 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://learning.dmec.org", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://learning.dmec.org", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780372181.9337842 }