{ "type": "URL", "indicator": "https://megabizdir.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://megabizdir.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3757869675, "indicator": "https://megabizdir.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 14, "pulses": [ { "id": "6570a7fc464f9f56ac33a389", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-12-06T16:57:32.030000", "created": "2023-12-06T16:57:32.030000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "domain": 3202, "CVE": 5, "FileHash-SHA256": 1943, "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 114, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a7e7daf278491d9f9eb4", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-12-06T16:57:11.228000", "created": "2023-12-06T16:57:11.228000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "domain": 3202, "CVE": 5, "FileHash-SHA256": 1943, "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653352d8b003257d7a22d0de", "name": "CVE-2018-13379", "description": "The full text of the latest security vulnerability (CVE) released by the US Department of Homeland Security (DoH) at the World Security Conference in New York on Wednesday, 2 January 2019..", "modified": "2023-11-20T04:03:14.293000", "created": "2023-10-21T04:26:00.685000", "tags": [ "fortios", "targeted", "alien labs", "government", "financial", "scoring system", "epss", "impact", "scan endpoints", "all cve", "critical", "media", "energy", "defense", "metasploit" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ellenmmm", "id": "233693", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-MD5": 733, "FileHash-SHA1": 699, "FileHash-SHA256": 3837, "URL": 736, "domain": 402, "hostname": 346, "email": 5 }, "indicator_count": 6759, "is_author": false, "is_subscribing": null, "subscriber_count": 83, "modified_text": "881 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65331eeded285a25c31d63a4", "name": "Tracking and Botnet campaign", "description": "US attackers making an exit by dumping to my devices & spreading to various other unsuspecting?\nRevenge for researching? Dumping to make it hard to implicate a single source. \nDump of Tsara Brashears and other adult content , malvertizing by a cyber stalker campaigners. As reported previously, entered my device and took control. Evidence pulled from a device while attack in progress. Device read Michigan, shopping, advertising, news, etc. Location not associated with any failed privacy controls on devices listing other locations.\nI listed a few IOC's Dumped to device in references. \nDump was continuous. Device modification for storage, new systems interface created upon device update. Moderete byte load per minute. Example 227 KB per minute. Prism command line tool\nChina foolish enough to implicate themselves for unclear crimes against American citizens? If an alleged crime against a target was allegedly committed in US someone is silencing her big time. There are a few other names as well. Targets?", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T00:44:29.344000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 46, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653323d24f9946946c804be4", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "Sounds crazy made up. This is an expensive campaign. Talented, lost individuals.\nI'm naming this campaign.\n'Canto XXVI' Bolgia 8 \u2013 Counsellors of Fraud\nThat's where they'll return.", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T01:05:22.903000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653323de61317f6ca7a3e875", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "Sounds crazy made up. This is an expensive campaign. Talented, lost individuals.\nI'm naming this campaign.\n'Canto XXVI' Bolgia 8 \u2013 Counsellors of Fraud\nThat's where they'll return.", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T01:05:34.166000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6533b20cf4ad384a0193c655", "name": "114.114.114.114 Tracking | Botnet | Malvertizing ", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T11:12:12.005000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323d24f9946946c804be4", "export_count": 53, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1ffb074d89724cb81371", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:16:11.181000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323de61317f6ca7a3e875", "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f200c20e12f03f749c403", "name": "114.114.114.114 Tracking | Botnet | Malvertizing", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:16:28.252000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "6533b20cf4ad384a0193c655", "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f205bac4b92f025125962", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:17:47.051000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323d24f9946946c804be4", "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65580ba704bae549b90948b5", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-11-18T00:56:07.651000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653f1ffb074d89724cb81371", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "652044fb2f28d46e91d29160", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears", "modified": "2023-11-05T14:05:48.545000", "created": "2023-10-06T17:33:47.403000", "tags": [ "ssl certificate", "whois whois", "iocs", "milum botnet", "army", "isp stuff", "whois record", "travel stuff", "misp", "threat roundup", "july", "apple", "password", "apple ios", "whois", "emotet", "powershell", "hacktool", "crypto", "pornhub", "tulach", "tsara", "camera", "connect", "tsara brashears", "brashears", "scanning_host", "trojan", "phishing", "afro", "june", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "http traffic", "suricata alerts", "event category", "description sid", "websma", "webabo", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware", "alexa", "heur", "malicious site", "malicious url", "unsafe", "agent", "phishing", "riskware", "bank", "iframe", "downldr", "presenoker", "artemis", "genkryptik", "fuery", "wacatac", "azorult", "service", "runescape", "facebook", "download", "union", "team", "opencandy", "exploit", "mimikatz", "blacklist https", "a1mara" ], "references": [ "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "Research and Data Analysis", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8" ], "public": 1, "adversary": "Tulach", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1070.003", "name": "Clear Command History", "display_name": "T1070.003 - Clear Command History" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56, "FileHash-SHA256": 1943, "domain": 3202, "hostname": 3487, "CVE": 5 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "896 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65204565ac1e8bce4de26df3", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears", "modified": "2023-11-05T14:05:48.545000", "created": "2023-10-06T17:35:33.618000", "tags": [ "ssl certificate", "whois whois", "iocs", "milum botnet", "army", "isp stuff", "whois record", "travel stuff", "misp", "threat roundup", "july", "apple", "password", "apple ios", "whois", "emotet", "powershell", "hacktool", "crypto", "pornhub", "tulach", "tsara", "camera", "connect", "tsara brashears", "brashears", "scanning_host", "trojan", "phishing", "afro", "june", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "http traffic", "suricata alerts", "event category", "description sid", "websma", "webabo", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware", "alexa", "heur", "malicious site", "malicious url", "unsafe", "agent", "phishing", "riskware", "bank", "iframe", "downldr", "presenoker", "artemis", "genkryptik", "fuery", "wacatac", "azorult", "service", "runescape", "facebook", "download", "union", "team", "opencandy", "exploit", "mimikatz", "blacklist https", "a1mara" ], "references": [ "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "Research and Data Analysis", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8" ], "public": 1, "adversary": "Tulach", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1070.003", "name": "Clear Command History", "display_name": "T1070.003 - Clear Command History" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56, "FileHash-SHA256": 1943, "domain": 3202, "hostname": 3487, "CVE": 5 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "896 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1df9a7da086561b9897f", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-11-05T14:05:48.545000", "created": "2023-10-30T03:07:37.963000", "tags": [ "ssl certificate", "whois whois", "iocs", "milum botnet", "army", "isp stuff", "whois record", "travel stuff", "misp", "threat roundup", "july", "apple", "password", "apple ios", "whois", "emotet", "powershell", "hacktool", "crypto", "pornhub", "tulach", "tsara", "camera", "connect", "tsara brashears", "brashears", "scanning_host", "trojan", "phishing", "afro", "june", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "http traffic", "suricata alerts", "event category", "description sid", "websma", "webabo", "cisco umbrella", "site", "safe site", "alexa top", "million", "malware", "alexa", "heur", "malicious site", "malicious url", "unsafe", "agent", "phishing", "riskware", "bank", "iframe", "downldr", "presenoker", "artemis", "genkryptik", "fuery", "wacatac", "azorult", "service", "runescape", "facebook", "download", "union", "team", "opencandy", "exploit", "mimikatz", "blacklist https", "a1mara" ], "references": [ "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "Research and Data Analysis", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8" ], "public": 1, "adversary": "Tulach", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1070.003", "name": "Clear Command History", "display_name": "T1070.003 - Clear Command History" } ], "industries": [], "TLP": "white", "cloned_from": "65204565ac1e8bce4de26df3", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56, "FileHash-SHA256": 1943, "domain": 3202, "hostname": 3487, "CVE": 5 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "896 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "199.249.230.74 traffic group 78", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "tv.apple.com Apple hacking", "http://karnalketo.com/sound-found error code 432 server nginx", "1.62.64.108 malware_hosting", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "110.249.196.101. malware_hosting", "CVE-2022-26134", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150", "Research and Data Analysis", "newrelic.se New Update Apple iPhone 199.59.243.222", "www.sweetheartvideo.com Tracking and Botnet campaign", "64.190.63.136 Malicious. IP: Sedo GmbH", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "vmwarevmc.com", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "a-poster.info [tagging tool]", "20.99.186.246 exploit_source", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://gpt.ocloo.cn/auth", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "114.114.1114.114", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "www.anyxxxtube.net prism.exe", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://tulach.cc/ phishing | Proxy | Skynet", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "nr-data.net Private Apple data collection", "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8", "www.sweetheartvideo.com", "https://twitter.com/ catapult spider/spider" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "[Unnamed US Teams and Hacker group]", "Tulach" ], "malware_families": [ "Bitcoinaussie", "Colibri loader", "Skynet", "Virus:dos/nanjing", "Formbook", "Colbalt strike", "Ransomware", "Njrat - s0385", "Azorult - s0344", "Daxin", "Korplug", "Nokoyawa", "Tulach", "Emotet", "Ransomexx", "Ketogenic switch", "Qakbot - s0650", "Virus:wm/look", "Quasar rat", "Ursnif - s0386", "Chaos", "Remcos" ], "industries": [], "unique_indicators": 41184 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/megabizdir.com", "whois": "http://whois.domaintools.com/megabizdir.com", "domain": "megabizdir.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 14, "pulses": [ { "id": "6570a7fc464f9f56ac33a389", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-12-06T16:57:32.030000", "created": "2023-12-06T16:57:32.030000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "domain": 3202, "CVE": 5, "FileHash-SHA256": 1943, "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 114, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a7e7daf278491d9f9eb4", "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet", "description": "", "modified": "2023-12-06T16:57:11.228000", "created": "2023-12-06T16:57:11.228000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "domain": 3202, "CVE": 5, "FileHash-SHA256": 1943, "URL": 14072, "FileHash-MD5": 70, "FileHash-SHA1": 56 }, "indicator_count": 22835, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653352d8b003257d7a22d0de", "name": "CVE-2018-13379", "description": "The full text of the latest security vulnerability (CVE) released by the US Department of Homeland Security (DoH) at the World Security Conference in New York on Wednesday, 2 January 2019..", "modified": "2023-11-20T04:03:14.293000", "created": "2023-10-21T04:26:00.685000", "tags": [ "fortios", "targeted", "alien labs", "government", "financial", "scoring system", "epss", "impact", "scan endpoints", "all cve", "critical", "media", "energy", "defense", "metasploit" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ellenmmm", "id": "233693", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-MD5": 733, "FileHash-SHA1": 699, "FileHash-SHA256": 3837, "URL": 736, "domain": 402, "hostname": 346, "email": 5 }, "indicator_count": 6759, "is_author": false, "is_subscribing": null, "subscriber_count": 83, "modified_text": "881 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65331eeded285a25c31d63a4", "name": "Tracking and Botnet campaign", "description": "US attackers making an exit by dumping to my devices & spreading to various other unsuspecting?\nRevenge for researching? Dumping to make it hard to implicate a single source. \nDump of Tsara Brashears and other adult content , malvertizing by a cyber stalker campaigners. As reported previously, entered my device and took control. Evidence pulled from a device while attack in progress. Device read Michigan, shopping, advertising, news, etc. Location not associated with any failed privacy controls on devices listing other locations.\nI listed a few IOC's Dumped to device in references. \nDump was continuous. Device modification for storage, new systems interface created upon device update. Moderete byte load per minute. Example 227 KB per minute. Prism command line tool\nChina foolish enough to implicate themselves for unclear crimes against American citizens? If an alleged crime against a target was allegedly committed in US someone is silencing her big time. There are a few other names as well. Targets?", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T00:44:29.344000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 46, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653323d24f9946946c804be4", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "Sounds crazy made up. This is an expensive campaign. Talented, lost individuals.\nI'm naming this campaign.\n'Canto XXVI' Bolgia 8 \u2013 Counsellors of Fraud\nThat's where they'll return.", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T01:05:22.903000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653323de61317f6ca7a3e875", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "Sounds crazy made up. This is an expensive campaign. Talented, lost individuals.\nI'm naming this campaign.\n'Canto XXVI' Bolgia 8 \u2013 Counsellors of Fraud\nThat's where they'll return.", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T01:05:34.166000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6533b20cf4ad384a0193c655", "name": "114.114.114.114 Tracking | Botnet | Malvertizing ", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T11:12:12.005000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323d24f9946946c804be4", "export_count": 53, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1ffb074d89724cb81371", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:16:11.181000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323de61317f6ca7a3e875", "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f200c20e12f03f749c403", "name": "114.114.114.114 Tracking | Botnet | Malvertizing", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:16:28.252000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "6533b20cf4ad384a0193c655", "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f205bac4b92f025125962", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:17:47.051000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323d24f9946946c804be4", "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://megabizdir.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://megabizdir.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776638997.571558 }