{ "type": "URL", "indicator": "https://pet.fonicweb.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://pet.fonicweb.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3769403267, "indicator": "https://pet.fonicweb.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 11, "pulses": [ { "id": "68abf66e97031d0ff0c04fed", "name": "Packed sentient.industries links to a targets business website", "description": "Very malicious link found in a targets business.\nPacked. Needs to be categorized.\n(FoundryPalantir rich?) Tracking, hacking, and serious espionage.\nAvailable public Information: \nSENTIENT INDUSTRIES\nsentient.industries\nSentient industries provides design and engineering services, from prototyping to small-batch manufacturing, empowering clients to overcome complex challenges. |\nMore about sentient\nMission sentient accelerates mission critical technology for\u2026\nSENTIENT INDUSTRIES\nAccelerating mission-critical tech for disaster response, defense ...\nContact Now\nAustin, tx 78758. United States. EMAIL us. info@sentient \n\nWorse than it looks. Spying on a several threat researchers.", "modified": "2025-09-24T04:04:05.604000", "created": "2025-08-25T05:36:46.327000", "tags": [ "moved", "body", "x cache", "cloudfront x", "cph50 c2", "certificate", "record value", "title", "h1 center", "server", "redacted for", "servers", "name redacted", "for privacy", "name servers", "org data", "privacy city", "privacy country", "ca creation", "passive dns", "urls", "files", "ip address", "asn as57033", "less whois", "registrar", "tucows domains", "key identifier", "data", "v3 serial", "number", "cat ozerossl", "cnzerossl ecc", "domain secure", "site ca", "validity", "subject public", "extraction", "data upload", "extra data", "include review", "find", "failed", "typ no", "ms windows", "intel", "pe32", "united", "search", "as16509", "from win32bios", "show", "high", "medium", "delphi", "copy", "write", "launcher", "next", "present aug", "present jul", "lowfi", "win32", "a div", "div div", "learn xml", "babylon", "win64", "trojan", "colors", "python", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "mitre att", "ck techniques", "et info", "tls handshake", "bad traffic", "failure", "date", "august", "hybrid", "general", "path", "starfield", "click", "strings", "se bethseda", "n bethseda", "n data", "error", "date checked", "url hostname", "server response", "google safe", "results aug", "read c", "tlsv1", "port", "destination", "module load", "execution", "dock", "persistence", "malware", "unknown", "cname", "aaaa", "creation date", "showing", "domain", "dga domains", "palantirfoundry", "foundry", "status", "unknown ns", "g2 tls", "rsa sha256", "italy unknown", "mtb may", "trojandropper", "invalid url", "next associated", "ddos", "body html", "hacktool", "ipv4", "url analysis", "ukraine", "encrypt", "rl add", "http", "hostname", "files domain", "files related", "related tags", "present jun", "entries", "title error", "all ipv4", "reverse dns", "yara detections", "top source", "top destination", "source source", "sha256 add", "pulse pulses", "av detections", "ids detections", "alerts", "analysis date", "address range", "cidr", "network name", "allocation type", "whois server", "entity amazon4", "handle", "canada unknown", "content type", "javascript src", "script script", "x powered", "ipv4 add", "pulse submit", "submit url", "analysis", "url add", "related nids", "files location", "canada flag", "canada hostname", "unknown aaaa", "ascii text", "user agent", "powershell", "agent", "czechia unknown", "domain add", "dynamicloader", "hostname add", "pentagon", "defense" ], "references": [ "sentient.industries affects independent artists. Affects several others.", "Bethseda Map - Yara Detections Delphi , InnoSetupInstaller", "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions", "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook", "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files", "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware", "Bethseda Map - High Priority Alerts: antiemu_wine banker_zeus_p2p", "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe", "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers", "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022", "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com", "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty", "Interesting widgets: https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html", "http://link.monetizer101.com/widget/custom-2.0.2/templates/1", "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022 https://stella.demand-iq.com/widget", "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/", "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022", "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js", "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js", "https://link.monetizer101.com/widget/code/dailystaruk.js", "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe", "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)", "Interesting Strings: https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical", "(Can't access file- Malware infection files)", "Potential reparations: Spyware , Trojan , Pegasus , DNS , Graphite , Paragon , NSO Group , Endgame , Cloudfront", "constellation.pcfrpegaservice.net (Pegasus related? idk)", "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service", "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]", "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post", "Remotewd.com devices", "If you find anything interesting please research it." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "nUFS_inno", "display_name": "nUFS_inno", "target": null }, { "id": "#Lowfi:HSTR:MSIL/Malicious", "display_name": "#Lowfi:HSTR:MSIL/Malicious", "target": null }, { "id": "ALF:JASYP:PUA:Win32/Bibado", "display_name": "ALF:JASYP:PUA:Win32/Bibado", "target": null }, { "id": "Trojan:Win32/Toga", "display_name": "Trojan:Win32/Toga", "target": "/malware/Trojan:Win32/Toga" }, { "id": "Win32:Downloader-GJK\\ [Trj]", "display_name": "Win32:Downloader-GJK\\ [Trj]", "target": null }, { "id": "Win.Downloader.109205-1", "display_name": "Win.Downloader.109205-1", "target": null }, { "id": "Custom Malware", "display_name": "Custom Malware", "target": null }, { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Win32:Downloader-GJK\\ [Trj]", "display_name": "Win32:Downloader-GJK\\ [Trj]", "target": null }, { "id": "Win.Downloader.109205-1", "display_name": "Win.Downloader.109205-1", "target": null }, { "id": "Win.Trojan.Jorik-149", "display_name": "Win.Trojan.Jorik-149", "target": null }, { "id": "#LowFiDetectsVmWare", "display_name": "#LowFiDetectsVmWare", "target": null }, { "id": "Win.Trojan.Jorik-130", "display_name": "Win.Trojan.Jorik-130", "target": null }, { "id": "Win.Trojan.Fakecodecs-119", "display_name": "Win.Trojan.Fakecodecs-119", "target": null }, { "id": "Trojan:Win32/Zombie.A", "display_name": "Trojan:Win32/Zombie.A", "target": "/malware/Trojan:Win32/Zombie.A" }, { "id": "Win.Trojan.Bulz-9860169-0", "display_name": "Win.Trojan.Bulz-9860169-0", "target": null }, { "id": "Win.Malware.Midie-6847892-0", "display_name": "Win.Malware.Midie-6847892-0", "target": null }, { "id": "TrojanDropper:Win32/Muldrop.V!MTB", "display_name": "TrojanDropper:Win32/Muldrop.V!MTB", "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB" }, { "id": "Win.Packed.Razy-9785185-0", "display_name": "Win.Packed.Razy-9785185-0", "target": null }, { "id": "Trojan:Win32/Glupteba.MT!MTB", "display_name": "Trojan:Win32/Glupteba.MT!MTB", "target": "/malware/Trojan:Win32/Glupteba.MT!MTB" }, { "id": "PWS", "display_name": "PWS", "target": null }, { "id": "DDOS:Win32/Stormser.A", "display_name": "DDOS:Win32/Stormser.A", "target": "/malware/DDOS:Win32/Stormser.A" }, { "id": "ALF:HSTR:DotNET", "display_name": "ALF:HSTR:DotNET", "target": null }, { "id": "DotNET", "display_name": "DotNET", "target": null }, { "id": "Script Exploit", "display_name": "Script Exploit", "target": null }, { "id": "HackTool:Win32/AutoKMS", "display_name": "HackTool:Win32/AutoKMS", "target": "/malware/HackTool:Win32/AutoKMS" }, { "id": "Xanfpezes.A", "display_name": "Xanfpezes.A", "target": null }, { "id": "Trojan:Win32/Gandcrab", "display_name": "Trojan:Win32/Gandcrab", "target": "/malware/Trojan:Win32/Gandcrab" }, { "id": "Win.Trojan.Generic-9862772-0", "display_name": "Win.Trojan.Generic-9862772-0", "target": null }, { "id": "Trojan:Win32/Zbot.SIBL!MTB", "display_name": "Trojan:Win32/Zbot.SIBL!MTB", "target": "/malware/Trojan:Win32/Zbot.SIBL!MTB" }, { "id": "Win32/Nemucod", "display_name": "Win32/Nemucod", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn", "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn", "target": null }, { "id": "Trojan:Win32/Blihan.A", "display_name": "Trojan:Win32/Blihan.A", "target": "/malware/Trojan:Win32/Blihan.A" }, { "id": "TrojanDropper:Win32/Muldrop", "display_name": "TrojanDropper:Win32/Muldrop", "target": "/malware/TrojanDropper:Win32/Muldrop" }, { "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47", "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47", "target": null }, { "id": "Win.Malware.Kolab-9885903-0", "display_name": "Win.Malware.Kolab-9885903-0", "target": null }, { "id": "Win.Malware (30)", "display_name": "Win.Malware (30)", "target": null }, { "id": "Ransom", "display_name": "Ransom", "target": null }, { "id": "#Lowfi:HSTR:MSIL/Malicious.Decryption", "display_name": "#Lowfi:HSTR:MSIL/Malicious.Decryption", "target": null }, { "id": "E5", "display_name": "E5", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null } ], "attack_ids": [ { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1003.008", "name": "/etc/passwd and /etc/shadow", "display_name": "T1003.008 - /etc/passwd and /etc/shadow" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 6232, "URL": 24908, "hostname": 7993, "FileHash-SHA256": 11128, "email": 6, "FileHash-MD5": 1054, "FileHash-SHA1": 932, "SSLCertFingerprint": 14, "CIDR": 3, "CVE": 3 }, "indicator_count": 52273, "is_author": false, "is_subscribing": null, "subscriber_count": 146, "modified_text": "207 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a989843b7acf6d0a79ac", "name": "Qakbot. Again. Today. Pulled from own device. Quasar RAT, Malvertizing", "description": "", "modified": "2023-12-06T17:04:09.133000", "created": "2023-12-06T17:04:09.133000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "domain": 290, "FileHash-SHA256": 1478, "hostname": 1047, "URL": 4055, "FileHash-MD5": 89, "FileHash-SHA1": 85, "email": 1, "FilePath": 2, "Mutex": 1, "CIDR": 1 }, "indicator_count": 7051, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65331eeded285a25c31d63a4", "name": "Tracking and Botnet campaign", "description": "US attackers making an exit by dumping to my devices & spreading to various other unsuspecting?\nRevenge for researching? Dumping to make it hard to implicate a single source. \nDump of Tsara Brashears and other adult content , malvertizing by a cyber stalker campaigners. As reported previously, entered my device and took control. Evidence pulled from a device while attack in progress. Device read Michigan, shopping, advertising, news, etc. Location not associated with any failed privacy controls on devices listing other locations.\nI listed a few IOC's Dumped to device in references. \nDump was continuous. Device modification for storage, new systems interface created upon device update. Moderete byte load per minute. Example 227 KB per minute. Prism command line tool\nChina foolish enough to implicate themselves for unclear crimes against American citizens? If an alleged crime against a target was allegedly committed in US someone is silencing her big time. There are a few other names as well. Targets?", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T00:44:29.344000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 46, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653323d24f9946946c804be4", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "Sounds crazy made up. This is an expensive campaign. Talented, lost individuals.\nI'm naming this campaign.\n'Canto XXVI' Bolgia 8 \u2013 Counsellors of Fraud\nThat's where they'll return.", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T01:05:22.903000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653323de61317f6ca7a3e875", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "Sounds crazy made up. This is an expensive campaign. Talented, lost individuals.\nI'm naming this campaign.\n'Canto XXVI' Bolgia 8 \u2013 Counsellors of Fraud\nThat's where they'll return.", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T01:05:34.166000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6533b20cf4ad384a0193c655", "name": "114.114.114.114 Tracking | Botnet | Malvertizing ", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T11:12:12.005000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323d24f9946946c804be4", "export_count": 53, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1ffb074d89724cb81371", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:16:11.181000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323de61317f6ca7a3e875", "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f200c20e12f03f749c403", "name": "114.114.114.114 Tracking | Botnet | Malvertizing", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:16:28.252000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "6533b20cf4ad384a0193c655", "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f205bac4b92f025125962", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:17:47.051000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323d24f9946946c804be4", "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65580ba704bae549b90948b5", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-11-18T00:56:07.651000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653f1ffb074d89724cb81371", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "652cc4de6aa3848c3722e9a6", "name": "Qakbot. Again. Today. Pulled from own device. Quasar RAT, Malvertizing", "description": "Serious concerns. Approached, threatened & told no cyber tool or literature would help me by a stranger in public place seconds after a male demanded to know if I had a SQL book or knowledge, asked for phone #, a date , to buy only 2 books and come with him? WHAT? He really wanted my number not me. he got so close to, I thought he had a wearable hacktool device. Ongoing. I realized dumping when I typed, the letter T only for another search term, results = Tsara Brashears dead? Clean search browser history. No Auto DL file titled: government Qbot Qakbot?! I couldn't open it. Last night I got a free unauthorized penetration test, apps, awful attack. Adult content dumping from listed in references. . I don't attack is China based despite server locations.. It's too easy to appear to be attacking from another country. Can't make it up. Ongoing long. Major disruption. Issue predates research.", "modified": "2023-11-15T01:03:46.666000", "created": "2023-10-16T05:06:38.412000", "tags": [ "whois record", "tsara brashears", "contacted", "threat roundup", "whois whois", "remcos", "iocs", "cyberstalking", "cry kill", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "malware", "awful", "open", "korplug", "execution", "pe resource", "referrer", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "quasar", "ursnif", "name verdict", "falcon sandbox", "sha256", "size", "sha1", "show process", "runtime process", "unicode", "crlf line", "ascii text", "mitre att", "type data", "hybrid", "general", "local", "path", "click", "strings", "nanjing xinfeng", "xiongmao group", "road descr", "district", "nanjing", "jiangsu", "china country", "apnic irt", "beijing", "china email", "copy md5", "copy sha1", "copy sha256", "AMERICA", "threat", "cyber criminal", "teams", "bounce", "Please Stop \u2205", "eminent threat", "Apple", "Android", "adversarial", "injection", "Tulach.cc malware", "scanning_host", "exploit_source", "ransomware" ], "references": [ "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e", "114.114.114.114", "http://login.live.com/oauth20_remoteconnect.srf", "a-poster.info", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.sweetheartvideo.com/tsara-brashears/", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian" ], "public": 1, "adversary": "[Unnamed Teams Hacking Group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Wanna Cry Kill Switch", "display_name": "Wanna Cry Kill Switch", "target": null }, { "id": "RansomEXX (Windows)", "display_name": "RansomEXX (Windows)", "target": null }, { "id": "Nanocore RAT", "display_name": "Nanocore RAT", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Dark Power", "display_name": "Dark Power", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4055, "FileHash-MD5": 89, "FileHash-SHA1": 85, "FileHash-SHA256": 1478, "domain": 290, "hostname": 1047, "FilePath": 2, "Mutex": 1, "CVE": 2, "CIDR": 1, "email": 1 }, "indicator_count": 7051, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "886 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "www.sweetheartvideo.com Tracking and Botnet campaign", "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "110.249.196.101. malware_hosting", "64.190.63.136 Malicious. IP: Sedo GmbH", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "tv.apple.com Apple hacking", "https://www.sweetheartvideo.com/tsara-brashears/", "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022", "http://karnalketo.com/sound-found error code 432 server nginx", "(Can't access file- Malware infection files)", "www.sweetheartvideo.com", "https://gpt.ocloo.cn/auth", "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://www.pornhub.com prism.exe [Massachusetts, US]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "Potential reparations: Spyware , Trojan , Pegasus , DNS , Graphite , Paragon , NSO Group , Endgame , Cloudfront", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022", "newrelic.se New Update Apple iPhone 199.59.243.222", "20.99.186.246 exploit_source", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "1.62.64.108 malware_hosting", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://tulach.cc/ phishing | Proxy | Skynet", "itunes.apple.com. [https:///app/apple-store", "vmwarevmc.com", "Interesting Strings: https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service", "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware", "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022 https://stella.demand-iq.com/widget", "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "114.114.114.114", "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "www.anyxxxtube.net prism.exe", "Bethseda Map - High Priority Alerts: antiemu_wine banker_zeus_p2p", "https://link.monetizer101.com/widget/code/dailystaruk.js", "CVE-2022-26134", "199.249.230.74 traffic group 78", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com", "a-poster.info [tagging tool]", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)", "Interesting widgets: https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html", "http://login.live.com/oauth20_remoteconnect.srf", "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files", "http://link.monetizer101.com/widget/custom-2.0.2/templates/1", "Bethseda Map - Yara Detections Delphi , InnoSetupInstaller", "Remotewd.com devices", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]", "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js", "114.114.1114.114", "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions", "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty", "sentient.industries affects independent artists. Affects several others.", "wallpapers-nature.com", "a-poster.info", "nr-data.net Private Apple data collection", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "If you find anything interesting please research it.", "https://twitter.com/ catapult spider/spider", "constellation.pcfrpegaservice.net (Pegasus related? idk)" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "[Unnamed Teams Hacking Group]", "[Unnamed US Teams and Hacker group]" ], "malware_families": [ "Trojandropper:win32/muldrop.v!mtb", "Trojan:win32/blihan.a", "Pws", "Ddos:win32/stormser.a", "Qakbot - s0650", "Ransomexx", "Ransomexx (windows)", "Skynet", "Alf:jasyp:pua:win32/bibado", "Azorult - s0344", "Quasar rat", "Nufs_inno", "Dark power", "Ursnif - s0386", "Ransom", "Alf:heraklezeval:trojan:win32/ymacco.aa47", "Script exploit", "Bitcoinaussie", "Trojan:win32/glupteba.mt!mtb", "Win.malware.midie-6847892-0", "Colibri loader", "Win32:downloader-gjk\\ [trj]", "Win.packed.razy-9785185-0", "Daxin", "E5", "Alf:hstr:dotnet", "Virus:wm/look", "Hacktool:win32/autokms", "Trojan:win32/zombie.a", "#lowfi:hstr:msil/malicious.decryption", "#lowfi:hstr:msil/malicious", "Cobalt strike", "Win.trojan.jorik-149", "Win32/nemucod", "Alf:heraklezeval:trojandownloader:html/adodb!rfn", "Remcos", "Emotet", "Tulach", "Win.trojan.jorik-130", "Korplug", "Xanfpezes.a", "Nokoyawa", "Trojan:win32/gandcrab", "Colbalt strike", "Win.trojan.bulz-9860169-0", "Wanna cry kill switch", "Formbook", "Nanocore rat", "Win.malware.kolab-9885903-0", "Trojan:win32/zbot.sibl!mtb", "Chaos", "Win.malware (30)", "Mydoom", "Njrat - s0385", "Win.trojan.generic-9862772-0", "Trojandropper:win32/muldrop", "Trojan:win32/toga", "#lowfienabledtcontinueafterunpacking", "Dotnet", "Virus:dos/nanjing", "Ketogenic switch", "Win.trojan.fakecodecs-119", "Win.downloader.109205-1", "Custom malware", "#lowfidetectsvmware", "Ransomware" ], "industries": [], "unique_indicators": 66516 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/fonicweb.com", "whois": "http://whois.domaintools.com/fonicweb.com", "domain": "fonicweb.com", "hostname": "pet.fonicweb.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 11, "pulses": [ { "id": "68abf66e97031d0ff0c04fed", "name": "Packed sentient.industries links to a targets business website", "description": "Very malicious link found in a targets business.\nPacked. Needs to be categorized.\n(FoundryPalantir rich?) Tracking, hacking, and serious espionage.\nAvailable public Information: \nSENTIENT INDUSTRIES\nsentient.industries\nSentient industries provides design and engineering services, from prototyping to small-batch manufacturing, empowering clients to overcome complex challenges. |\nMore about sentient\nMission sentient accelerates mission critical technology for\u2026\nSENTIENT INDUSTRIES\nAccelerating mission-critical tech for disaster response, defense ...\nContact Now\nAustin, tx 78758. United States. EMAIL us. info@sentient \n\nWorse than it looks. Spying on a several threat researchers.", "modified": "2025-09-24T04:04:05.604000", "created": "2025-08-25T05:36:46.327000", "tags": [ "moved", "body", "x cache", "cloudfront x", "cph50 c2", "certificate", "record value", "title", "h1 center", "server", "redacted for", "servers", "name redacted", "for privacy", "name servers", "org data", "privacy city", "privacy country", "ca creation", "passive dns", "urls", "files", "ip address", "asn as57033", "less whois", "registrar", "tucows domains", "key identifier", "data", "v3 serial", "number", "cat ozerossl", "cnzerossl ecc", "domain secure", "site ca", "validity", "subject public", "extraction", "data upload", "extra data", "include review", "find", "failed", "typ no", "ms windows", "intel", "pe32", "united", "search", "as16509", "from win32bios", "show", "high", "medium", "delphi", "copy", "write", "launcher", "next", "present aug", "present jul", "lowfi", "win32", "a div", "div div", "learn xml", "babylon", "win64", "trojan", "colors", "python", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "mitre att", "ck techniques", "et info", "tls handshake", "bad traffic", "failure", "date", "august", "hybrid", "general", "path", "starfield", "click", "strings", "se bethseda", "n bethseda", "n data", "error", "date checked", "url hostname", "server response", "google safe", "results aug", "read c", "tlsv1", "port", "destination", "module load", "execution", "dock", "persistence", "malware", "unknown", "cname", "aaaa", "creation date", "showing", "domain", "dga domains", "palantirfoundry", "foundry", "status", "unknown ns", "g2 tls", "rsa sha256", "italy unknown", "mtb may", "trojandropper", "invalid url", "next associated", "ddos", "body html", "hacktool", "ipv4", "url analysis", "ukraine", "encrypt", "rl add", "http", "hostname", "files domain", "files related", "related tags", "present jun", "entries", "title error", "all ipv4", "reverse dns", "yara detections", "top source", "top destination", "source source", "sha256 add", "pulse pulses", "av detections", "ids detections", "alerts", "analysis date", "address range", "cidr", "network name", "allocation type", "whois server", "entity amazon4", "handle", "canada unknown", "content type", "javascript src", "script script", "x powered", "ipv4 add", "pulse submit", "submit url", "analysis", "url add", "related nids", "files location", "canada flag", "canada hostname", "unknown aaaa", "ascii text", "user agent", "powershell", "agent", "czechia unknown", "domain add", "dynamicloader", "hostname add", "pentagon", "defense" ], "references": [ "sentient.industries affects independent artists. Affects several others.", "Bethseda Map - Yara Detections Delphi , InnoSetupInstaller", "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions", "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook", "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files", "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware", "Bethseda Map - High Priority Alerts: antiemu_wine banker_zeus_p2p", "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe", "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers", "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022", "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com", "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty", "Interesting widgets: https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html", "http://link.monetizer101.com/widget/custom-2.0.2/templates/1", "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022 https://stella.demand-iq.com/widget", "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/", "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022", "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js", "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js", "https://link.monetizer101.com/widget/code/dailystaruk.js", "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe", "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)", "Interesting Strings: https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical", "(Can't access file- Malware infection files)", "Potential reparations: Spyware , Trojan , Pegasus , DNS , Graphite , Paragon , NSO Group , Endgame , Cloudfront", "constellation.pcfrpegaservice.net (Pegasus related? idk)", "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service", "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]", "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post", "Remotewd.com devices", "If you find anything interesting please research it." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "nUFS_inno", "display_name": "nUFS_inno", "target": null }, { "id": "#Lowfi:HSTR:MSIL/Malicious", "display_name": "#Lowfi:HSTR:MSIL/Malicious", "target": null }, { "id": "ALF:JASYP:PUA:Win32/Bibado", "display_name": "ALF:JASYP:PUA:Win32/Bibado", "target": null }, { "id": "Trojan:Win32/Toga", "display_name": "Trojan:Win32/Toga", "target": "/malware/Trojan:Win32/Toga" }, { "id": "Win32:Downloader-GJK\\ [Trj]", "display_name": "Win32:Downloader-GJK\\ [Trj]", "target": null }, { "id": "Win.Downloader.109205-1", "display_name": "Win.Downloader.109205-1", "target": null }, { "id": "Custom Malware", "display_name": "Custom Malware", "target": null }, { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Win32:Downloader-GJK\\ [Trj]", "display_name": "Win32:Downloader-GJK\\ [Trj]", "target": null }, { "id": "Win.Downloader.109205-1", "display_name": "Win.Downloader.109205-1", "target": null }, { "id": "Win.Trojan.Jorik-149", "display_name": "Win.Trojan.Jorik-149", "target": null }, { "id": "#LowFiDetectsVmWare", "display_name": "#LowFiDetectsVmWare", "target": null }, { "id": "Win.Trojan.Jorik-130", "display_name": "Win.Trojan.Jorik-130", "target": null }, { "id": "Win.Trojan.Fakecodecs-119", "display_name": "Win.Trojan.Fakecodecs-119", "target": null }, { "id": "Trojan:Win32/Zombie.A", "display_name": "Trojan:Win32/Zombie.A", "target": "/malware/Trojan:Win32/Zombie.A" }, { "id": "Win.Trojan.Bulz-9860169-0", "display_name": "Win.Trojan.Bulz-9860169-0", "target": null }, { "id": "Win.Malware.Midie-6847892-0", "display_name": "Win.Malware.Midie-6847892-0", "target": null }, { "id": "TrojanDropper:Win32/Muldrop.V!MTB", "display_name": "TrojanDropper:Win32/Muldrop.V!MTB", "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB" }, { "id": "Win.Packed.Razy-9785185-0", "display_name": "Win.Packed.Razy-9785185-0", "target": null }, { "id": "Trojan:Win32/Glupteba.MT!MTB", "display_name": "Trojan:Win32/Glupteba.MT!MTB", "target": "/malware/Trojan:Win32/Glupteba.MT!MTB" }, { "id": "PWS", "display_name": "PWS", "target": null }, { "id": "DDOS:Win32/Stormser.A", "display_name": "DDOS:Win32/Stormser.A", "target": "/malware/DDOS:Win32/Stormser.A" }, { "id": "ALF:HSTR:DotNET", "display_name": "ALF:HSTR:DotNET", "target": null }, { "id": "DotNET", "display_name": "DotNET", "target": null }, { "id": "Script Exploit", "display_name": "Script Exploit", "target": null }, { "id": "HackTool:Win32/AutoKMS", "display_name": "HackTool:Win32/AutoKMS", "target": "/malware/HackTool:Win32/AutoKMS" }, { "id": "Xanfpezes.A", "display_name": "Xanfpezes.A", "target": null }, { "id": "Trojan:Win32/Gandcrab", "display_name": "Trojan:Win32/Gandcrab", "target": "/malware/Trojan:Win32/Gandcrab" }, { "id": "Win.Trojan.Generic-9862772-0", "display_name": "Win.Trojan.Generic-9862772-0", "target": null }, { "id": "Trojan:Win32/Zbot.SIBL!MTB", "display_name": "Trojan:Win32/Zbot.SIBL!MTB", "target": "/malware/Trojan:Win32/Zbot.SIBL!MTB" }, { "id": "Win32/Nemucod", "display_name": "Win32/Nemucod", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn", "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn", "target": null }, { "id": "Trojan:Win32/Blihan.A", "display_name": "Trojan:Win32/Blihan.A", "target": "/malware/Trojan:Win32/Blihan.A" }, { "id": "TrojanDropper:Win32/Muldrop", "display_name": "TrojanDropper:Win32/Muldrop", "target": "/malware/TrojanDropper:Win32/Muldrop" }, { "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47", "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47", "target": null }, { "id": "Win.Malware.Kolab-9885903-0", "display_name": "Win.Malware.Kolab-9885903-0", "target": null }, { "id": "Win.Malware (30)", "display_name": "Win.Malware (30)", "target": null }, { "id": "Ransom", "display_name": "Ransom", "target": null }, { "id": "#Lowfi:HSTR:MSIL/Malicious.Decryption", "display_name": "#Lowfi:HSTR:MSIL/Malicious.Decryption", "target": null }, { "id": "E5", "display_name": "E5", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null } ], "attack_ids": [ { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1003.008", "name": "/etc/passwd and /etc/shadow", "display_name": "T1003.008 - /etc/passwd and /etc/shadow" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 6232, "URL": 24908, "hostname": 7993, "FileHash-SHA256": 11128, "email": 6, "FileHash-MD5": 1054, "FileHash-SHA1": 932, "SSLCertFingerprint": 14, "CIDR": 3, "CVE": 3 }, "indicator_count": 52273, "is_author": false, "is_subscribing": null, "subscriber_count": 146, "modified_text": "207 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a989843b7acf6d0a79ac", "name": "Qakbot. Again. Today. Pulled from own device. Quasar RAT, Malvertizing", "description": "", "modified": "2023-12-06T17:04:09.133000", "created": "2023-12-06T17:04:09.133000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "domain": 290, "FileHash-SHA256": 1478, "hostname": 1047, "URL": 4055, "FileHash-MD5": 89, "FileHash-SHA1": 85, "email": 1, "FilePath": 2, "Mutex": 1, "CIDR": 1 }, "indicator_count": 7051, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65331eeded285a25c31d63a4", "name": "Tracking and Botnet campaign", "description": "US attackers making an exit by dumping to my devices & spreading to various other unsuspecting?\nRevenge for researching? Dumping to make it hard to implicate a single source. \nDump of Tsara Brashears and other adult content , malvertizing by a cyber stalker campaigners. As reported previously, entered my device and took control. Evidence pulled from a device while attack in progress. Device read Michigan, shopping, advertising, news, etc. Location not associated with any failed privacy controls on devices listing other locations.\nI listed a few IOC's Dumped to device in references. \nDump was continuous. Device modification for storage, new systems interface created upon device update. Moderete byte load per minute. Example 227 KB per minute. Prism command line tool\nChina foolish enough to implicate themselves for unclear crimes against American citizens? If an alleged crime against a target was allegedly committed in US someone is silencing her big time. There are a few other names as well. Targets?", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T00:44:29.344000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 46, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653323d24f9946946c804be4", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "Sounds crazy made up. This is an expensive campaign. Talented, lost individuals.\nI'm naming this campaign.\n'Canto XXVI' Bolgia 8 \u2013 Counsellors of Fraud\nThat's where they'll return.", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T01:05:22.903000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653323de61317f6ca7a3e875", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "Sounds crazy made up. This is an expensive campaign. Talented, lost individuals.\nI'm naming this campaign.\n'Canto XXVI' Bolgia 8 \u2013 Counsellors of Fraud\nThat's where they'll return.", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T01:05:34.166000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6533b20cf4ad384a0193c655", "name": "114.114.114.114 Tracking | Botnet | Malvertizing ", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-21T11:12:12.005000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323d24f9946946c804be4", "export_count": 53, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1ffb074d89724cb81371", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:16:11.181000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323de61317f6ca7a3e875", "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f200c20e12f03f749c403", "name": "114.114.114.114 Tracking | Botnet | Malvertizing", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:16:28.252000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "6533b20cf4ad384a0193c655", "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f205bac4b92f025125962", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-10-30T03:17:47.051000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653323d24f9946946c804be4", "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65580ba704bae549b90948b5", "name": "Tracker and Botnet campaign - Canto XXVI", "description": "", "modified": "2023-11-19T00:04:57.528000", "created": "2023-11-18T00:56:07.651000", "tags": [ "contacted", "tsara brashears", "whois record", "whois whois", "threat roundup", "december", "execution", "referrer", "pe resource", "remcos", "malware", "quasar", "nanocore", "attack", "core", "qakbot", "azorult", "njrat", "colibri loader", "metro", "nokoyawa", "formbook", "bank", "installer", "daxin", "awful", "open", "korplug", "dark power", "cobalt strike", "hacktool", "emotet", "chaos", "ransomexx", "ursnif", "ransomware", "pattern match", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "beginstring", "script", "segoe ui", "null", "error", "unknown", "span", "date", "body", "refresh", "class", "critical", "tools", "look", "verify", "restart", "hybrid", "general", "click", "strings", "meta", "xiongmao group", "district", "nanjing", "china country", "beijing", "please", "apnic person", "road", "china phone", "whois lookup", "cnnic", "dns replication", "domain", "win32 exe", "files", "detections type", "name", "notepad", "java", "update checker", "type name", "android", "win32 dll", "cyber criminals", "cyber stalking", "cyber warfare", "framing", "tulach.cc", "exploit_source", "scanning_host", "phishing", "adware", "command_and_control", "C2", "technology", "virustotal xn", "technology xn", "rich text", "format po", "jyoti cnc", "detection list", "blacklist", "noname057", "proxy", "prism.exe", "password cracker", "skynet", "malvertizing", "spyware", "colorado", "arizona", "prism command line tool", "keyloggers", "apple", "I'm being followed", "threats", "sha256", "osint", "vmware", "gpt", "nginx", "piracy", "intellectual property", "spammer", "honeypot", "tracker", "tracking campaign", "Botnet campaign" ], "references": [ "114.114.1114.114", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net \tketogenic switch , BitcoinAussie", "wallpapers-nature.com", "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io BitcoinAussie", "www.sweetheartvideo.com", "https://www.sweetheartvideo.com/tsara-brashears/Tracker and Botnet campaign", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian password cracker", "a-poster.info [tagging tool]", "https://tulach.cc/ phishing | Proxy | Skynet", "67.227.226.240 command_and_control. [lb01.parklogic.com] Lansing Michigan", "20.99.186.246 exploit_source", "https://www.hybrid-analysis.com/sample/06558031f63aca4f043b4770ae780337408b276df3b1e3e05b3d536839c3ad9e/652c962002e18b99e20e891a", "1.62.64.108 malware_hosting", "110.249.196.101. malware_hosting", "CVE-2022-26134", "www.anyxxxtube.net prism.exe", "https://www.pornhub.com prism.exe [Massachusetts, US]", "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 [Colorado, US referenced malvertizing outfit]", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 [Colorado, US references]", "https://twitter.com/PORNO_SEXYBABES - Nokoyawa catapult spider", "https://twitter.com/ catapult spider/spider", "nr-data.net Private Apple data collection", "tv.apple.com Apple hacking", "newrelic.se New Update Apple iPhone 199.59.243.222", "0.0.0.0 iplocal=comcast [iplocalpple.com, possibly misconfigured] exploit", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 exploit [You can pair older Samsung watches with an iPhone by downloading the Samsung Galaxy Watch (Gear S) app from the iOS App. Abused remotely?]", "itunes.apple.com. [https:///app/apple-store", "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [HappyRabbit]", "a0bc39001c6efcf39dbc6b7684232cce5126dcf0364c37e902714898ec097e94 [apple to windows China ??]", "https://otx.alienvault.com/indicator/url/https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 ? A target on my devices?", "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017 Another target?", "https://lelosexgame.com/datingsm?ad_campaign_id=3161239&cost=0&creative_id=2032565&external_id=0&keyword=%25KW%25&ref=https://example.com&ref_domain=example.com&server_node=0&source=0", "199.249.230.74 traffic group 78", "https://gpt.ocloo.cn/auth", "vmwarevmc.com", "http://karnalketo.com/sound-found error code 432 server nginx", "http://ww1.karnalketo.com/astroshift-soundtrack-cheat-code-incl-product-key-download-3264bit-latest/ error code 432 server nginx", "64.190.63.136 Malicious. IP: Sedo GmbH", "www.sweetheartvideo.com Tracking and Botnet campaign" ], "public": 1, "adversary": "[Unnamed US Teams and Hacker group]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "QakBot - S0650", "display_name": "QakBot - S0650", "target": null }, { "id": "Ransomexx", "display_name": "Ransomexx", "target": null }, { "id": "Azorult - S0344", "display_name": "Azorult - S0344", "target": null }, { "id": "Formbook", "display_name": "Formbook", "target": null }, { "id": "Korplug", "display_name": "Korplug", "target": null }, { "id": "Colbalt Strike", "display_name": "Colbalt Strike", "target": null }, { "id": "Remcos", "display_name": "Remcos", "target": null }, { "id": "Colibri Loader", "display_name": "Colibri Loader", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Nokoyawa", "display_name": "Nokoyawa", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "njRAT - S0385", "display_name": "njRAT - S0385", "target": null }, { "id": "Chaos", "display_name": "Chaos", "target": null }, { "id": "Ursnif - S0386", "display_name": "Ursnif - S0386", "target": null }, { "id": "Virus:DOS/Nanjing", "display_name": "Virus:DOS/Nanjing", "target": "/malware/Virus:DOS/Nanjing" }, { "id": "Daxin", "display_name": "Daxin", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "Virus:WM/Look", "display_name": "Virus:WM/Look", "target": "/malware/Virus:WM/Look" }, { "id": "Skynet", "display_name": "Skynet", "target": null }, { "id": "ketogenic switch", "display_name": "ketogenic switch", "target": null }, { "id": "BitcoinAussie", "display_name": "BitcoinAussie", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" } ], "industries": [], "TLP": "green", "cloned_from": "653f1ffb074d89724cb81371", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 166, "FileHash-SHA256": 2841, "URL": 6670, "CVE": 4, "domain": 684, "hostname": 1930, "CIDR": 2, "email": 3 }, "indicator_count": 12473, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "882 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://pet.fonicweb.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://pet.fonicweb.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776639038.7059915 }