{ "type": "URL", "indicator": "https://shizukuoshi.work", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://shizukuoshi.work", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3908939400, "indicator": "https://shizukuoshi.work", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 7, "pulses": [ { "id": "69decb6dd1bd6da78fc72d0a", "name": "Solarwinds Similarties? Tactics ASP.Net IoC\u2019s ISOLATED", "description": "Does this have similarities to the SolarWinds Attack? Anyone?\n\nASP.NET is a web application framework created by Microsoft for building dynamic web applications.\nIt enables developers to create web pages that can interact with databases and respond to user inputs.\nASP.NET supports various programming languages, including C# and VB.NET.\nContext: ASP.NET is widely used for developing modern web applications and services. It allows developers to create interactive and data-driven web pages that can run on various operating systems, including Windows, Linux, and macOS. The framework is open-source and supports various architectures, including MVC (Model-View-Controller) and Web API, which facilitate the organization and development of complex applications.\nIn many instances ASP.net has been seen connected to malicious Tulach , Apple , a browser agent that transmits data to New Relic's collectors by using either of the domains bam.nr-data.net or bam-cell.nr-data.net.", "modified": "2026-04-14T23:19:09.495000", "created": "2026-04-14T23:19:09.495000", "tags": [ "united", "aaaa", "certificate", "error", "read c", "rgba", "unicode", "memcommit", "delete", "dock", "execution", "command decode", "suricata ipv4", "suricata tcpv4", "flag", "localappdata", "windir", "openurl c", "programfiles", "suricata udpv4", "win64", "click", "strings", "anon", "username", "userprofile", "mitre att", "ck id", "ck matrix", "appdata", "comspec", "model", "path", "april", "hybrid", "general", "learn", "suspicious", "informative", "adversaries", "command", "spawns", "ck techniques", "mtb apr", "exploit", "trojan", "backdoor", "please", "x msedge", "all ipv4", "ransom", "date hash", "avast avg", "win32orbus apr", "dynamicloader", "yara rule", "high", "tofsee", "rndhex", "rndchar", "loaderid", "lidfileupd", "localcfg", "write", "stream", "push", "mtb alerts", "ee fc", "ff d5", "lredmond", "malware", "msie", "windows nt", "wow64", "slcc2", "media center", "yara detections", "av detections", "ids detections", "hostile", "unknown", "extraction", "data upload", "failed", "include review", "stop data", "typ url", "url data", "typ no", "th all", "stop", "port", "destination", "ds detections", "tls sni", "nrv2x", "upxoepplace", "alerts", "contacted", "markus", "hostile alerts", "less see", "all ip", "tulach", "brian sabey", "quasi", "link", "script urls", "record value", "script domains", "fireeye", "create c", "as15169", "next", "all url", "http", "related pulses", "related tags", "google safe", "code", "y se", "included review", "io excluded", "suggeste", "ipv4", "unknown ns", "redacted admin", "fax redacted", "name redacted", "phone redacted", "code redacted", "redacted tech", "christopher ahmann", "solarwinds like?" ], "references": [ "asp.net \u2022 cdnsrc.asp.net", "https://www.countercept.com/assets/Uploads/whitepapers/MWRI-Countercept-Machine-Learning-Whitepaper-2017-04-01.pdf", "http://www.phonefactor.com/PfPaWs/ConfirmActivation", "IPv4 13.107.253.70 exploit_source \u2022 IPv4 13.107.226.70 malware_hosting", "https://wsps.ourschoolpages.com/Account/ForgotPasswor (typo", "https://hybrid-analysis.com/sample/529a0b900eef6657ce6c98b1b5bccebe6db2e021aa02a316b7eb2604df810d3f/69de30ef0a22c3b506077a8c", "www.fireeye.com", "danilovstyle.ru", "ns4-04.azure-dns.info", "ns4-04.azure-dns.info danilovst) ns4-04.azure-dns.info", "www.fireeye.com .", "https://hypic-anaivsis.com/sambrerb/a0p9veebo", "Are these table SolarWinds attackers? Using same tacktics, good? Unsure.", "Tulach\u2019s ASP.Net Open Source destruction" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Ransom:Win32/SodinokibiCrypt.SK!MTB", "display_name": "Ransom:Win32/SodinokibiCrypt.SK!MTB", "target": "/malware/Ransom:Win32/SodinokibiCrypt.SK!MTB" }, { "id": "Win.Ransomware.Tofsee-10015002", "display_name": "Win.Ransomware.Tofsee-10015002", "target": null }, { "id": "Trojan:Win32/Comisproc!gmb I", "display_name": "Trojan:Win32/Comisproc!gmb I", "target": "/malware/Trojan:Win32/Comisproc!gmb I" } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1132.001", "name": "Standard Encoding", "display_name": "T1132.001 - Standard Encoding" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 88, "FileHash-MD5": 211, "FileHash-SHA1": 186, "FileHash-SHA256": 1366, "URL": 1848, "domain": 418, "email": 4, "hostname": 622, "SSLCertFingerprint": 21 }, "indicator_count": 4764, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "5 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d8a665177b8f64c7ce5fca", "name": "LibraryLoader \u2022 Samuel Tulach | Abuse of malicious sssets engineered by DevOp & Security Researcher", "description": "Samuel Tulach is involved in various projects related to government work, particularly in areas like DevSecOps and app modernization. \nOverview of Samuel Tulach's \"uploader.exe\"\nThe file \"uploader.exe\" created by Samuel Tulach has been identified as malicious by several security engines. This classification indicates that the file poses a potential threat to users' systems.\nSecurity Engine Flags. Several security engines have flagged \"uploader.exe\" as malicious.\nSecureAge APEX\tMalicious\nSentinelOne\tMalicious\nImplications of Malicious Flags\nPotential Risks: Files flagged as malicious can lead to various security issues, including data theft, unauthorized access, or system damage.\nRecommended Actions: Users should avoid downloading or executing this file. If already downloaded, it is advisable to delete it and run a full system scan using reputable antivirus software.", "modified": "2026-04-10T07:27:33.587000", "created": "2026-04-10T07:27:33.587000", "tags": [ "x vercel", "united", "america", "germany malware", "family", "ck ids", "packing", "tulach", "ocsp", "extraction", "data upload", "enter sc", "extra data", "include review", "exclude sugges", "find s", "failed", "typ no", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "command", "initial access", "defense evasion", "pattern match", "mitre att", "ascii text", "span", "title", "meta", "path", "april", "hybrid", "general", "local", "encrypt", "click", "strings", "main", "footer", "pcsb", "naga", "magda", "no expiration", "url https", "domain", "github pages", "a domains", "passive dns", "mtb jan", "class", "sea x", "accept encoding", "trojanspy", "accept", "otx logo", "all ipv4", "urls", "files", "america flag", "space", "ck matrix", "handle", "winvmaddress", "cdecl crashpad", "null", "software", "comment", "entity", "internal", "blank", "magic", "infinity", "first", "valentine", "error", "webview", "front", "patched", "root", "tristate", "libraryloader", "packing t1045", "icmp traffic", "memcommit", "pe section", "low software", "pe resource", "filehash", "win32", "malware", "write", "backdoor", "present apr", "lowfi", "aaaa", "lowfijavazkm", "x.com", "dynamicloader", "crlf line", "unicode text", "utf8", "ee fc", "ff d5", "yara rule", "f0 ff", "eb e1", "unknown", "trojan", "zeppelin", "autorun", "united states", "china unknown", "div div", "ip address", "record value", "samuel tulach", "czechia unknown", "italy unknown", "gmt server", "all domain", "next associated", "reverse dns", "location czech", "all filehash", "md5 add", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "file score", "file type", "telfhash", "virustotal api", "vendor finding", "notes clamav", "files matching", "number", "t1045", "search", "directui", "element", "medium", "classinfobase", "value", "write c", "hwndhost", "sapeav12", "worm", "explorer", "insert", "movie", "mtb apr", "mtb mar", "trojandropper", "displayname", "windows", "high", "delete c", "tofsee", "stream", "push", "url http", "c mar", "virtool", "c jan", "c dec", "toolbar", "ransom", "article", "windows nt", "gmtvia", "html", "bad traffic", "et info", "tls handshake", "belgium", "present dec", "present feb", "intel", "elf upx", "medium risk", "info", "moved", "hostname add", "whois registrar", "media", "delphi", "guard", "code", "devsecops", "github", "github internet", "archive samuel", "tulach", "government work", "key areas", "devops process", "security engine", "flags", "apex malicious", "implications", "malicious flags", "potential risks", "name servers", "apple id", "script urls", "show process", "secure", "win64", "khtml", "gecko", "programfiles", "cookie", "comspec", "model", "june", "spawns", "id name", "malicious", "gui", "anti cheats", "game tech", "c++" ], "references": [ "https://nextcloud.tulach.cc/ \u2022 https://nextcloud.tulach.cc/", "bleepingcomputer.com \u2022 CliffsNotes", "x.com - Malware Packed", "nr-data.net \u2022 www.youtube.com", "Alerts network_icmp allocates_rwx packer_entropy pe_features pe_unknown_resource_name Related Pulses", "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8", "discord.com \u2022 discord.gg", "api.item.yixun.com", "Unix.Trojan.Mirai-9441505-0 Yara Detections is__elf \u2022 217.11.249.145", "Domains Contacted: fenbushijujuefuwu.com", "angryblackwomyn.com", "https://medium.com/the-pink/how-a-white-womans-anger-makes-her-racism-spill-out-563853905a42", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/41ad1d349716b3e62f914c0907323ae8e0a37198d237a02d71a0d5e05ffaa727", "https://www.forpsi.com domain forpsi.com\t Domain asp.net", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "www.youtube.com/watch?v=GyuMozsVyYs (why would targets channel be controlled by Tulach)", "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw", "x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290", "cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz", "porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop", "https://api.w.org/ \u2022 api.w.org", "remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png", "https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-assets-Twitter.b90ee19de735e00fb4a0.js", "developer.x.com \u2022 https://twitter.com/githubstatus", "https://twitter.com/juvlarN", "appleid.cdn-apple.com", "https://static.digitecgalaxus.ch/Files/communication/app-download-badges/apple_email_rasterized_2x/fr.png", "Samuel Tulach , an engineer writes about game security, Unity engine, and anti-cheat systems on his blog at tulach.cc", "Mr. Tulach \u2022 known for his work in cybersecurity, particularly in reverse engineering & malware analysis", "\"uploader.exe\" created by Samuel Tulach has been identified as malicious by several security engines", "Due to Samuel Tulach\u2019s good reputation , assume his assets are being abused by threat actors targeting", "I haven\u2019t yet concluded why Tulach.cc is deeply interwoven in a malicious media campaign", "Samuel Tulach\u2019s assets have been tightly connected to M. Brian Sabey, Esq", "The next pulse will show Apple IoC\u2019s related to Tulach.cc" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "LibraryLoader", "display_name": "LibraryLoader", "target": null }, { "id": "ALF:HeraklezEval:Trojan:Win32/Azorult.FW!rfn", "display_name": "ALF:HeraklezEval:Trojan:Win32/Azorult.FW!rfn", "target": null }, { "id": "Win.Packed.Botx-10021462-0", "display_name": "Win.Packed.Botx-10021462-0", "target": null }, { "id": "Win.Malware.Cymt-10023133-0", "display_name": "Win.Malware.Cymt-10023133-0", "target": null }, { "id": "TrojanDownloader:Win32/Nemucod", "display_name": "TrojanDownloader:Win32/Nemucod", "target": "/malware/TrojanDownloader:Win32/Nemucod" }, { "id": "Win.Trojan.VBGeneric-6735875-0", "display_name": "Win.Trojan.VBGeneric-6735875-0", "target": null }, { "id": "Worm:Win32/Mofksys.RND!MTB", "display_name": "Worm:Win32/Mofksys.RND!MTB", "target": "/malware/Worm:Win32/Mofksys.RND!MTB" }, { "id": "Win.Malware.Generickdz-9937235-0", "display_name": "Win.Malware.Generickdz-9937235-0", "target": null }, { "id": "Win.Malware.Razy-6979265-0", "display_name": "Win.Malware.Razy-6979265-0", "target": null }, { "id": "TrojanSpy:Win32/Nivdort", "display_name": "TrojanSpy:Win32/Nivdort", "target": "/malware/TrojanSpy:Win32/Nivdort" }, { "id": "Trojan:Win32/Mydoom", "display_name": "Trojan:Win32/Mydoom", "target": "/malware/Trojan:Win32/Mydoom" }, { "id": "TrojanSpy:Win32/Nivdort.DE", "display_name": "TrojanSpy:Win32/Nivdort.DE", "target": "/malware/TrojanSpy:Win32/Nivdort.DE" }, { "id": "SLF:Win32/Elenquay.A", "display_name": "SLF:Win32/Elenquay.A", "target": "/malware/SLF:Win32/Elenquay.A" }, { "id": "Win.Dropper.QuasarRAT-10023124-0", "display_name": "Win.Dropper.QuasarRAT-10023124-0", "target": null }, { "id": "Win.Trojan.Zegost-9769410-0", "display_name": "Win.Trojan.Zegost-9769410-0", "target": null }, { "id": "ALF:HSTR:VirTool:Win32/Obfuscator!PECancer", "display_name": "ALF:HSTR:VirTool:Win32/Obfuscator!PECancer", "target": null }, { "id": "Win.Malware.Moonlight-9919383-0", "display_name": "Win.Malware.Moonlight-9919383-0", "target": null }, { "id": "Worm:Win32/Lightmoon.H", "display_name": "Worm:Win32/Lightmoon.H", "target": "/malware/Worm:Win32/Lightmoon.H" }, { "id": "Backdoor:Win32/Tofsee.", "display_name": "Backdoor:Win32/Tofsee.", "target": "/malware/Backdoor:Win32/Tofsee." }, { "id": "#LowfiJavaZKM", "display_name": "#LowfiJavaZKM", "target": null }, { "id": "Win.Malware.Swisyn-7610494-0", "display_name": "Win.Malware.Swisyn-7610494-0", "target": null }, { "id": "PWS:Win32/Ymacco.AA50", "display_name": "PWS:Win32/Ymacco.AA50", "target": "/malware/PWS:Win32/Ymacco.AA50" }, { "id": "Win.Packed.Stealerc-10017074-0", "display_name": "Win.Packed.Stealerc-10017074-0", "target": null }, { "id": "#Lowfi:Win32/AutoIt", "display_name": "#Lowfi:Win32/AutoIt", "target": "/malware/#Lowfi:Win32/AutoIt" }, { "id": "Html.Trojan.Ascii212_44_64_202-1", "display_name": "Html.Trojan.Ascii212_44_64_202-1", "target": null }, { "id": "ALFPER:HSTR:WizremURL.A1", "display_name": "ALFPER:HSTR:WizremURL.A1", "target": null }, { "id": "Win.Malware.Jaik-9968280-0", "display_name": "Win.Malware.Jaik-9968280-0", "target": null }, { "id": "Win.Trojan.Tofsee-7102058-0", "display_name": "Win.Trojan.Tofsee-7102058-0", "target": null }, { "id": "Backdoor:Win32/Tofsee.T", "display_name": "Backdoor:Win32/Tofsee.T", "target": "/malware/Backdoor:Win32/Tofsee.T" }, { "id": "Win.Malware.Jaik-9968280-0", "display_name": "Win.Malware.Jaik-9968280-0", "target": null }, { "id": "Win.Packer.pkr_ce1a-9980177-0", "display_name": "Win.Packer.pkr_ce1a-9980177-0", "target": null }, { "id": "Win.Trojan.Tofsee-7102058-0", "display_name": "Win.Trojan.Tofsee-7102058-0", "target": null }, { "id": "Win.Malware.Midie-6847893-0", "display_name": "Win.Malware.Midie-6847893-0", "target": null }, { "id": "TrojanDropper:Win32/Muldrop.V!MTB", "display_name": "TrojanDropper:Win32/Muldrop.V!MTB", "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB" }, { "id": "Win.Malware.Aauto-9839281-0", "display_name": "Win.Malware.Aauto-9839281-0", "target": null }, { "id": "Win.Trojan.Agent-1371484", "display_name": "Win.Trojan.Agent-1371484", "target": null }, { "id": "SLFPER:SoftwareBundler:Win32/ICLoader.A", "display_name": "SLFPER:SoftwareBundler:Win32/ICLoader.A", "target": null }, { "id": "ALF:Trojan:Win32/Cassini_412f60c8!ibt", "display_name": "ALF:Trojan:Win32/Cassini_412f60c8!ibt", "target": null }, { "id": "Worm:Win32/Mofksys.RND!MTB", "display_name": "Worm:Win32/Mofksys.RND!MTB", "target": "/malware/Worm:Win32/Mofksys.RND!MTB" }, { "id": "Win.Packed.Generic-9967832-0", "display_name": "Win.Packed.Generic-9967832-0", "target": null }, { "id": "Win.Trojan.Barys-10005825-0", "display_name": "Win.Trojan.Barys-10005825-0", "target": null }, { "id": "Unix.Trojan.Mirai-9441505-0", "display_name": "Unix.Trojan.Mirai-9441505-0", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2710, "domain": 1227, "hostname": 1206, "FileHash-SHA256": 3867, "IPv4": 318, "FileHash-MD5": 593, "FileHash-SHA1": 459, "IPv6": 1, "SSLCertFingerprint": 19, "email": 20, "CVE": 1 }, "indicator_count": 10421, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "693148dc0eb85adc8edfe1a2", "name": "BeeLineRouter.Net \u2022 Isolated / Apple Baxkdoor", "description": "", "modified": "2026-01-03T07:00:45.529000", "created": "2025-12-04T08:39:56.180000", "tags": [ "mitre att", "network traffic", "ck id", "show technique", "ck matrix", "threat score", "december", "default browser", "guest system", "united", "dynadot inc", "name server", "contacted hosts", "process details", "windir", "openurl c", "prefetch2", "learn", "name tactics", "suspicious", "informative", "adversaries", "command", "spawns", "access att", "t1566 phishing", "ascii text", "pattern match", "show process", "t1071", "general", "local", "path", "click", "beelinerouter", "access", "router", "apple", "regopenkeyexw", "regsz", "process32nextw", "english", "post http", "search", "observed dns", "query", "sinkhole cookie", "malware", "possible", "win32", "updater", "write", "next", "found", "ip address", "domain", "name servers", "unknown ns", "ip whois", "registrar", "cloudflare", "title", "passive dns", "urls", "files", "location united", "asn as14618", "bq dec", "virtool", "backdoor", "checkin", "ipv4 add", "trojan", "dynamicloader", "msie", "windows nt", "slcc2", "media center", "unknown", "show", "internal", "encrypt", "veailmboprd", "dns query", "wow64", "gecko http", "entries", "medium", "ransom", "khtml", "gecko", "delete", "installer", "win32cve may", "america flag", "overview ip", "asn as20940", "expiration", "url https", "no expiration", "url http", "pulse show", "type indicator", "role title", "related pulses", "record value", "domain xn" ], "references": [ "HTTPS://BeeLineRouter.Net", "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com", "https://appleid.xn--appe-70a.com/", "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069", "https://wallpapers-nature.com/tsara-brashears/urlscan-io", "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.sweetheartvideo.com/tsara-brashears", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://vgt.pl/r.n%20-", "8-25-220-162-static.reverse.queryfoundry.net", "queryfoundry.net", "http://81-26-68-38-static.reverse.queryfoundry.net/", "http://117-114-251-162-static.reverse.queryfoundry.net/", "http://81-26-68-38-static.reverse.queryfoundry.net/", "http://68-178-128-104-static.reverse.queryfoundry.net/", "0-209-98-172-static.reverse.queryfoundry.net", "154-143-182-107-static.reverse.queryfoundry.net", "http://51-235-245-104-static.reverse.queryfoundry.net/", "167-16-68-38-static.reverse.queryfoundry.net", "http://49-116-251-162-static.reverse.queryfoundry./net/", "177-231-69-38-static.reverse.queryfoundry.net", "http://36-243-60-103-static.reverse.queryfoundry.net/", "http://237-189-251-104-static.reverse.queryfoundry.net/", "http://227-98-248-162-static.reverse.queryfoundry.net/", "237-189-251-104-static.reverse.queryfoundry.net", "http://207-214-98-172-static.reverse.queryfoundry.net/", "181-135-182-107-static.reverse.queryfoundry.net", "http://201-191-251-104-static.reverse.queryfoundry.net/", "67-228-69-38-static.reverse.queryfoundry.net", "http://0-209-98-172-static.reverse.queryfoundry.net/", "http://10-241-60-103-static.reverse.queryfoundry.net/", "http://142-232-245-104-static.reverse.queryfoundry.net/", "http://154-143-182-107-static.reverse.queryfoundry.net/", "http://167-16-68-38-static.reverse.queryfoundry.net/", "http://177-231-69-38-static.reverse.queryfoundry.net/", "http://181-135-182-107-static.reverse.queryfoundry.net/", "http://195-214-98-172-static.reverse.queryfoundry.net/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Simda", "display_name": "Simda", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null }, { "id": "GandCrab Ransomware", "display_name": "GandCrab Ransomware", "target": null }, { "id": "Win.Virus.Expiro", "display_name": "Win.Virus.Expiro", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null }, { "id": "#VirTool:Win32/Obfuscator.ADB", "display_name": "#VirTool:Win32/Obfuscator.ADB", "target": "/malware/#VirTool:Win32/Obfuscator.ADB" } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1049, "URL": 5839, "hostname": 1944, "FileHash-SHA256": 3634, "FileHash-MD5": 310, "FileHash-SHA1": 295, "CVE": 2, "email": 15, "SSLCertFingerprint": 2 }, "indicator_count": 13090, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "106 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69314920e287845f6b36a265", "name": "BeeLineRouter.Net \u2022 Apple Access", "description": "", "modified": "2026-01-03T07:00:45.529000", "created": "2025-12-04T08:41:04.190000", "tags": [ "mitre att", "network traffic", "ck id", "show technique", "ck matrix", "threat score", "december", "default browser", "guest system", "united", "dynadot inc", "name server", "contacted hosts", "process details", "windir", "openurl c", "prefetch2", "learn", "name tactics", "suspicious", "informative", "adversaries", "command", "spawns", "access att", "t1566 phishing", "ascii text", "pattern match", "show process", "t1071", "general", "local", "path", "click", "beelinerouter", "access", "router", "apple", "regopenkeyexw", "regsz", "process32nextw", "english", "post http", "search", "observed dns", "query", "sinkhole cookie", "malware", "possible", "win32", "updater", "write", "next", "found", "ip address", "domain", "name servers", "unknown ns", "ip whois", "registrar", "cloudflare", "title", "passive dns", "urls", "files", "location united", "asn as14618", "bq dec", "virtool", "backdoor", "checkin", "ipv4 add", "trojan", "dynamicloader", "msie", "windows nt", "slcc2", "media center", "unknown", "show", "internal", "encrypt", "veailmboprd", "dns query", "wow64", "gecko http", "entries", "medium", "ransom", "khtml", "gecko", "delete", "installer", "win32cve may", "america flag", "overview ip", "asn as20940", "expiration", "url https", "no expiration", "url http", "pulse show", "type indicator", "role title", "related pulses", "record value", "domain xn" ], "references": [ "HTTPS://BeeLineRouter.Net", "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com", "https://appleid.xn--appe-70a.com/", "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069", "https://wallpapers-nature.com/tsara-brashears/urlscan-io", "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.sweetheartvideo.com/tsara-brashears", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://vgt.pl/r.n%20-", "8-25-220-162-static.reverse.queryfoundry.net", "queryfoundry.net", "http://81-26-68-38-static.reverse.queryfoundry.net/", "http://117-114-251-162-static.reverse.queryfoundry.net/", "http://81-26-68-38-static.reverse.queryfoundry.net/", "http://68-178-128-104-static.reverse.queryfoundry.net/", "0-209-98-172-static.reverse.queryfoundry.net", "154-143-182-107-static.reverse.queryfoundry.net", "http://51-235-245-104-static.reverse.queryfoundry.net/", "167-16-68-38-static.reverse.queryfoundry.net", "http://49-116-251-162-static.reverse.queryfoundry./net/", "177-231-69-38-static.reverse.queryfoundry.net", "http://36-243-60-103-static.reverse.queryfoundry.net/", "http://237-189-251-104-static.reverse.queryfoundry.net/", "http://227-98-248-162-static.reverse.queryfoundry.net/", "237-189-251-104-static.reverse.queryfoundry.net", "http://207-214-98-172-static.reverse.queryfoundry.net/", "181-135-182-107-static.reverse.queryfoundry.net", "http://201-191-251-104-static.reverse.queryfoundry.net/", "67-228-69-38-static.reverse.queryfoundry.net", "http://0-209-98-172-static.reverse.queryfoundry.net/", "http://10-241-60-103-static.reverse.queryfoundry.net/", "http://142-232-245-104-static.reverse.queryfoundry.net/", "http://154-143-182-107-static.reverse.queryfoundry.net/", "http://167-16-68-38-static.reverse.queryfoundry.net/", "http://177-231-69-38-static.reverse.queryfoundry.net/", "http://181-135-182-107-static.reverse.queryfoundry.net/", "http://195-214-98-172-static.reverse.queryfoundry.net/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Simda", "display_name": "Simda", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null }, { "id": "GandCrab Ransomware", "display_name": "GandCrab Ransomware", "target": null }, { "id": "Win.Virus.Expiro", "display_name": "Win.Virus.Expiro", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null }, { "id": "#VirTool:Win32/Obfuscator.ADB", "display_name": "#VirTool:Win32/Obfuscator.ADB", "target": "/malware/#VirTool:Win32/Obfuscator.ADB" } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 295, "FileHash-SHA256": 3634, "URL": 5839, "CVE": 2, "domain": 1048, "email": 15, "hostname": 1944, "SSLCertFingerprint": 2 }, "indicator_count": 13089, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "106 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69314926519256e3ef0a9358", "name": "BeeLineRouter.Net \u2022 Apple Access", "description": "", "modified": "2026-01-03T07:00:45.529000", "created": "2025-12-04T08:41:06.657000", "tags": [ "mitre att", "network traffic", "ck id", "show technique", "ck matrix", "threat score", "december", "default browser", "guest system", "united", "dynadot inc", "name server", "contacted hosts", "process details", "windir", "openurl c", "prefetch2", "learn", "name tactics", "suspicious", "informative", "adversaries", "command", "spawns", "access att", "t1566 phishing", "ascii text", "pattern match", "show process", "t1071", "general", "local", "path", "click", "beelinerouter", "access", "router", "apple", "regopenkeyexw", "regsz", "process32nextw", "english", "post http", "search", "observed dns", "query", "sinkhole cookie", "malware", "possible", "win32", "updater", "write", "next", "found", "ip address", "domain", "name servers", "unknown ns", "ip whois", "registrar", "cloudflare", "title", "passive dns", "urls", "files", "location united", "asn as14618", "bq dec", "virtool", "backdoor", "checkin", "ipv4 add", "trojan", "dynamicloader", "msie", "windows nt", "slcc2", "media center", "unknown", "show", "internal", "encrypt", "veailmboprd", "dns query", "wow64", "gecko http", "entries", "medium", "ransom", "khtml", "gecko", "delete", "installer", "win32cve may", "america flag", "overview ip", "asn as20940", "expiration", "url https", "no expiration", "url http", "pulse show", "type indicator", "role title", "related pulses", "record value", "domain xn" ], "references": [ "HTTPS://BeeLineRouter.Net", "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com", "https://appleid.xn--appe-70a.com/", "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069", "https://wallpapers-nature.com/tsara-brashears/urlscan-io", "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.sweetheartvideo.com/tsara-brashears", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://vgt.pl/r.n%20-", "8-25-220-162-static.reverse.queryfoundry.net", "queryfoundry.net", "http://81-26-68-38-static.reverse.queryfoundry.net/", "http://117-114-251-162-static.reverse.queryfoundry.net/", "http://81-26-68-38-static.reverse.queryfoundry.net/", "http://68-178-128-104-static.reverse.queryfoundry.net/", "0-209-98-172-static.reverse.queryfoundry.net", "154-143-182-107-static.reverse.queryfoundry.net", "http://51-235-245-104-static.reverse.queryfoundry.net/", "167-16-68-38-static.reverse.queryfoundry.net", "http://49-116-251-162-static.reverse.queryfoundry./net/", "177-231-69-38-static.reverse.queryfoundry.net", "http://36-243-60-103-static.reverse.queryfoundry.net/", "http://237-189-251-104-static.reverse.queryfoundry.net/", "http://227-98-248-162-static.reverse.queryfoundry.net/", "237-189-251-104-static.reverse.queryfoundry.net", "http://207-214-98-172-static.reverse.queryfoundry.net/", "181-135-182-107-static.reverse.queryfoundry.net", "http://201-191-251-104-static.reverse.queryfoundry.net/", "67-228-69-38-static.reverse.queryfoundry.net", "http://0-209-98-172-static.reverse.queryfoundry.net/", "http://10-241-60-103-static.reverse.queryfoundry.net/", "http://142-232-245-104-static.reverse.queryfoundry.net/", "http://154-143-182-107-static.reverse.queryfoundry.net/", "http://167-16-68-38-static.reverse.queryfoundry.net/", "http://177-231-69-38-static.reverse.queryfoundry.net/", "http://181-135-182-107-static.reverse.queryfoundry.net/", "http://195-214-98-172-static.reverse.queryfoundry.net/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Simda", "display_name": "Simda", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null }, { "id": "GandCrab Ransomware", "display_name": "GandCrab Ransomware", "target": null }, { "id": "Win.Virus.Expiro", "display_name": "Win.Virus.Expiro", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null }, { "id": "#VirTool:Win32/Obfuscator.ADB", "display_name": "#VirTool:Win32/Obfuscator.ADB", "target": "/malware/#VirTool:Win32/Obfuscator.ADB" } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 295, "FileHash-SHA256": 3634, "URL": 5839, "CVE": 2, "domain": 1048, "email": 15, "hostname": 1944, "SSLCertFingerprint": 2 }, "indicator_count": 13089, "is_author": false, "is_subscribing": null, "subscriber_count": 146, "modified_text": "106 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68a0cb6a89a10d13623a0018", "name": "Medicaid Mirai Botnet | United Healthcare Mirai Botnet", "description": "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll. Medicaid Botnet work managed by Lumen Technologies as part of a massive silencing campaign. |\n\nPhone calls routed since forces and investigated disclosures of several attack resulting in great bodily harm and life threatening, ending injuries.\nThis campaign date has one start date 11/13/2013.\n#missed assaults internal investigated 10/08/2013 -11/31/ 2013.\nI\u2019m sure other targets are impacted . This stems from targets personal , documented experiences. \nFormerly k/a Century Link was confronted by associate of targets when a plain clothed male entered targets yard in 11/ 2013, told their box controlled entire neighborhood. Continuously accessed properties. \n\n\n\n#rip #lumen #botnet #fencing #malware #silencing #civil_liberties # monitored_target #remote #corruption #privacy_abuse #centurylink", "modified": "2025-09-15T16:04:47.043000", "created": "2025-08-16T18:18:18.657000", "tags": [ "url https", "search", "type indicator", "role title", "added active", "related pulses", "entries", "httponly", "samesitelax", "read c", "medium", "rgba", "unicode", "port", "memcommit", "delete", "next", "dock", "write", "execution", "present aug", "united", "ip address", "name servers", "unknown ns", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "spawns", "mitre att", "ck techniques", "evasion att", "pattern match", "show technique", "ck matrix", "refresh", "body", "span", "august", "hybrid", "general", "local", "path", "click", "strings", "error", "tools", "look", "verify", "restart", "href", "size", "t1480 execution", "file defense", "ascii text", "trojan", "passive dns", "trojandropper", "next associated", "fastly error", "please", "sea p", "mozilla", "accept", "ipv4 add", "urls", "files", "location united", "ipv4", "url analysis", "america flag", "america asn", "backdoor", "win32", "malware", "date", "domain", "segoe ui", "a domains", "security tls", "san jose", "asn8075", "reverse dns", "software", "resource hash", "general full", "status", "emails", "expiration date", "asp", "microsoft oem", "found", "running webserver", "netherlands", "creation date", "aaaa", "certificate", "protocol h2", "name value", "hash", "present jun", "present apr", "moved", "control att", "t1573 encrypted", "channel command", "decrypted ssl", "runtime process", "appdata", "windows nt", "svg scalable", "patch", "internal", "core", "high", "tcp syn", "icmp traffic", "dns query", "av detections", "ashburn", "ai device id", "telnet", "windows script", "microsoft", "host", "yara detections", "pdb path", "pe resource", "script host", "test", "hostname add", "files ip", "domains", "hashes", "ireland", "mtb jun", "mtb may", "device local", "remotewd", "nemtih", "url add", "http", "hostname", "files domain", "files related", "pulses otx", "present jul", "domain add", "colorado", "quasi", "contracts", "botnet", "remote access", "virginia", "c++", "hacking", "monitored target", "silencing campaign", "audio recording", "cameras", "full service", "tactics" ], "references": [ "Handled by Lumen Technologies | What kind of darkness is this?", "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll https://myhpnmedicaid.com/Provider", "dev.myhpnmedicaid.com", "ELF:Mirai-ATI | United Healthcare Dark? | https://otx.alienvault.com/indicator/ip/205.132.162.113", "https://hybrid-analysis.com/sample/e439d3dd3d943ecc702d12998a32e15c00008a8f276e6c89cb54f6de43f36de8/689fccb81c4f237eb6009b0f", "https://hybrid-analysis.com/sample/f095ee58f390749315e72cfa46d979cb25a15884b66c7951719c844ebc82b3a3/689fcc753aca4827cd036851", "https://hybrid-analysis.com/sample/dd09e575e6dfa77f081bf0014b2494e02f90cb23723fbb35d6b2a92e7c629920/689fcc40b786f8eaa20534b5", "Primary Request aspnet dotnet.microsoft.com/en-us/apps/ Redirect Chain http://asp.net/ https://asp.net/ https://www.asp.net/ https://dotnet.microsoft.com/en-us/apps/aspnet", "Redirect Chain http://asp.net/ https://asp.net/ https://www.asp.net/", "https://dotnet.microsoft.com/en-us/apps/aspnet", "ASP.net - Hack Together: Mar 1-15 Join the hack. Build an app with NET & Microsoft Graph for a\u2026 .", "ASP.net - chance to win prizes! \u53e3\u3001\u4ecb\u5973\u8fa3 All Microsoft Learn more ASP.NET Free. Cross-platform\u2026.", "ASP.net Open source. A framework for building web apps and services with .NET and C#", "Registrant Org: Japan Computer Emergency Response Team Coordination Center", "Interesting: unitedhealthcare cdn.member.unitedhealthcare.com \u2022 data.aca.unitedhealthcare.com \u2022 data.member.unitedhealthcare.com", "Interesting Domain Tactics: https://click.benefits.unitedhealthcare.com/", "Interesting: dev-optum-dataintelligence.com \u2022 optumcoding.xxx \u2022 optuminsightcoding.xxx \u2022 optumrx.xxx", "Interesting: memberforms.optumrx.com \u2022 myoptum.info \u2022 optumrx.com \u2022 cte-scl.new.optumrx.com \u2022 dev-scl.optumrx.com", "http://www.nexcentra.com/fox-news-faces-another-sexual-harassment-lawsuit" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Trojan:Win32/Zombie.A", "display_name": "Trojan:Win32/Zombie.A", "target": "/malware/Trojan:Win32/Zombie.A" }, { "id": "Win.Packed.Generic-9967832-0", "display_name": "Win.Packed.Generic-9967832-0", "target": null }, { "id": "Custom Malware", "display_name": "Custom Malware", "target": null }, { "id": "Trojan:Win32/Daws", "display_name": "Trojan:Win32/Daws", "target": "/malware/Trojan:Win32/Daws" }, { "id": "ELF:Mirai-ATI", "display_name": "ELF:Mirai-ATI", "target": null }, { "id": "Trojan:Win32/IRCbot", "display_name": "Trojan:Win32/IRCbot", "target": "/malware/Trojan:Win32/IRCbot" }, { "id": "alf:JASYP:Trojan:Win32/IRCbot!atmn", "display_name": "alf:JASYP:Trojan:Win32/IRCbot!atmn", "target": null }, { "id": "Trojandropper:Win32/Muldrop.V!MTB", "display_name": "Trojandropper:Win32/Muldrop.V!MTB", "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1092", "name": "Communication Through Removable Media", "display_name": "T1092 - Communication Through Removable Media" }, { "id": "T1433", "name": "Access Call Log", "display_name": "T1433 - Access Call Log" } ], "industries": [ "Technology", "Telecommunications", "Contracts", "Government", "Finance", "Insurance", "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 37, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4880, "domain": 575, "hostname": 1419, "FileHash-SHA256": 1745, "FileHash-MD5": 284, "FileHash-SHA1": 263, "email": 5, "CVE": 1 }, "indicator_count": 9172, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "216 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6674e062afd192ab545b1a04", "name": "Lazarus Group", "description": "Everyone? Why Brashears? You are all so brilliant! It's not to surprising. I acted on behalf of target to follow your report. I am not anywhere close to ever being as clever as thee. Are you hiring snoops? This took form in October 2013.\nThen a follower. Next hell week-years. Just because you can. Well toasts yourselves. It must be amazing to be able to live without the fear of consequences, with knowledge that you're probably right. You know the odds or even better, the government pays you to do it!\nI am truly fascinated as well as humbled by your abilities. You made her so very sad. If that's what you need. Really rethink you choices, it's so otherworldly; again making you all so \nbright. She's met some of you, spoken to some of you, shopped alongside, was surveilled, viewed. More popular than the Kardashian on your rogue channels. Now THAT'S Reality TV. Bieber & Tori Kelley got her song chops, Sony was hacked. Okay. I'm so impressed, Hire me.\n\nsmph. I don't get it. No one does. \nAll tags auto generated.", "modified": "2024-09-05T06:06:53.933000", "created": "2024-06-21T02:07:30.790000", "tags": [ "scripts", "redline stealer", "lazarus", "core", "no problems", "html internet", "html document", "ascii text", "language", "merkd1904", "code", "c++" ], "references": [], "public": 1, "adversary": "Lazarus Group", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "204.79.197.200", "display_name": "204.79.197.200", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6840, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-MD5": 50, "FileHash-SHA1": 43, "FileHash-SHA256": 850, "URL": 949, "domain": 141, "hostname": 410 }, "indicator_count": 2445, "is_author": false, "is_subscribing": null, "subscriber_count": 230, "modified_text": "591 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "Interesting: unitedhealthcare cdn.member.unitedhealthcare.com \u2022 data.aca.unitedhealthcare.com \u2022 data.member.unitedhealthcare.com", "https://hybrid-analysis.com/sample/dd09e575e6dfa77f081bf0014b2494e02f90cb23723fbb35d6b2a92e7c629920/689fcc40b786f8eaa20534b5", "http://117-114-251-162-static.reverse.queryfoundry.net/", "177-231-69-38-static.reverse.queryfoundry.net", "Due to Samuel Tulach\u2019s good reputation , assume his assets are being abused by threat actors targeting", "dev.myhpnmedicaid.com", "https://twitter.com/juvlarN", "http://vgt.pl/r.n%20-", "ASP.net - Hack Together: Mar 1-15 Join the hack. Build an app with NET & Microsoft Graph for a\u2026 .", "Interesting Domain Tactics: https://click.benefits.unitedhealthcare.com/", "Registrant Org: Japan Computer Emergency Response Team Coordination Center", "http://51-235-245-104-static.reverse.queryfoundry.net/", "http://177-231-69-38-static.reverse.queryfoundry.net/", "Unix.Trojan.Mirai-9441505-0 Yara Detections is__elf \u2022 217.11.249.145", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "Interesting: memberforms.optumrx.com \u2022 myoptum.info \u2022 optumrx.com \u2022 cte-scl.new.optumrx.com \u2022 dev-scl.optumrx.com", "porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop", "http://0-209-98-172-static.reverse.queryfoundry.net/", "181-135-182-107-static.reverse.queryfoundry.net", "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw", "\"uploader.exe\" created by Samuel Tulach has been identified as malicious by several security engines", "developer.x.com \u2022 https://twitter.com/githubstatus", "queryfoundry.net", "Samuel Tulach\u2019s assets have been tightly connected to M. Brian Sabey, Esq", "ASP.net - chance to win prizes! \u53e3\u3001\u4ecb\u5973\u8fa3 All Microsoft Learn more ASP.NET Free. Cross-platform\u2026.", "Are these table SolarWinds attackers? Using same tacktics, good? Unsure.", "https://www.sweetheartvideo.com/tsara-brashears", "ASP.net Open source. A framework for building web apps and services with .NET and C#", "https://hypic-anaivsis.com/sambrerb/a0p9veebo", "https://appleid.xn--appe-70a.com/", "http://227-98-248-162-static.reverse.queryfoundry.net/", "Interesting: dev-optum-dataintelligence.com \u2022 optumcoding.xxx \u2022 optuminsightcoding.xxx \u2022 optumrx.xxx", "https://www.countercept.com/assets/Uploads/whitepapers/MWRI-Countercept-Machine-Learning-Whitepaper-2017-04-01.pdf", "Samuel Tulach , an engineer writes about game security, Unity engine, and anti-cheat systems on his blog at tulach.cc", "https://www.forpsi.com domain forpsi.com\t Domain asp.net", "discord.com \u2022 discord.gg", "https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-assets-Twitter.b90ee19de735e00fb4a0.js", "http://68-178-128-104-static.reverse.queryfoundry.net/", "appleid.cdn-apple.com", "ns4-04.azure-dns.info danilovst) ns4-04.azure-dns.info", "67-228-69-38-static.reverse.queryfoundry.net", "asp.net \u2022 cdnsrc.asp.net", "Domains Contacted: fenbushijujuefuwu.com", "8-25-220-162-static.reverse.queryfoundry.net", "http://195-214-98-172-static.reverse.queryfoundry.net/", "http://49-116-251-162-static.reverse.queryfoundry./net/", "The next pulse will show Apple IoC\u2019s related to Tulach.cc", "Primary Request aspnet dotnet.microsoft.com/en-us/apps/ Redirect Chain http://asp.net/ https://asp.net/ https://www.asp.net/ https://dotnet.microsoft.com/en-us/apps/aspnet", "remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png", "0-209-98-172-static.reverse.queryfoundry.net", "https://medium.com/the-pink/how-a-white-womans-anger-makes-her-racism-spill-out-563853905a42", "http://142-232-245-104-static.reverse.queryfoundry.net/", "pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://api.w.org/ \u2022 api.w.org", "https://dotnet.microsoft.com/en-us/apps/aspnet", "167-16-68-38-static.reverse.queryfoundry.net", "angryblackwomyn.com", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/41ad1d349716b3e62f914c0907323ae8e0a37198d237a02d71a0d5e05ffaa727", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "http://207-214-98-172-static.reverse.queryfoundry.net/", "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069", "cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz", "154-143-182-107-static.reverse.queryfoundry.net", "https://nextcloud.tulach.cc/ \u2022 https://nextcloud.tulach.cc/", "ns4-04.azure-dns.info", "http://167-16-68-38-static.reverse.queryfoundry.net/", "www.fireeye.com .", "nr-data.net \u2022 www.youtube.com", "bleepingcomputer.com \u2022 CliffsNotes", "http://36-243-60-103-static.reverse.queryfoundry.net/", "Tulach\u2019s ASP.Net Open Source destruction", "http://154-143-182-107-static.reverse.queryfoundry.net/", "www.fireeye.com", "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8", "ELF:Mirai-ATI | United Healthcare Dark? | https://otx.alienvault.com/indicator/ip/205.132.162.113", "https://static.digitecgalaxus.ch/Files/communication/app-download-badges/apple_email_rasterized_2x/fr.png", "http://81-26-68-38-static.reverse.queryfoundry.net/", "https://hybrid-analysis.com/sample/f095ee58f390749315e72cfa46d979cb25a15884b66c7951719c844ebc82b3a3/689fcc753aca4827cd036851", "http://237-189-251-104-static.reverse.queryfoundry.net/", "HTTPS://BeeLineRouter.Net", "x.com - Malware Packed", "Alerts network_icmp allocates_rwx packer_entropy pe_features pe_unknown_resource_name Related Pulses", "https://hybrid-analysis.com/sample/e439d3dd3d943ecc702d12998a32e15c00008a8f276e6c89cb54f6de43f36de8/689fccb81c4f237eb6009b0f", "Redirect Chain http://asp.net/ https://asp.net/ https://www.asp.net/", "www.youtube.com/watch?v=GyuMozsVyYs (why would targets channel be controlled by Tulach)", "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll https://myhpnmedicaid.com/Provider", "api.item.yixun.com", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com", "http://10-241-60-103-static.reverse.queryfoundry.net/", "https://hybrid-analysis.com/sample/529a0b900eef6657ce6c98b1b5bccebe6db2e021aa02a316b7eb2604df810d3f/69de30ef0a22c3b506077a8c", "IPv4 13.107.253.70 exploit_source \u2022 IPv4 13.107.226.70 malware_hosting", "https://wallpapers-nature.com/tsara-brashears/urlscan-io", "x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290", "http://181-135-182-107-static.reverse.queryfoundry.net/", "Handled by Lumen Technologies | What kind of darkness is this?", "237-189-251-104-static.reverse.queryfoundry.net", "Mr. Tulach \u2022 known for his work in cybersecurity, particularly in reverse engineering & malware analysis", "http://201-191-251-104-static.reverse.queryfoundry.net/", "I haven\u2019t yet concluded why Tulach.cc is deeply interwoven in a malicious media campaign", "https://wsps.ourschoolpages.com/Account/ForgotPasswor (typo", "danilovstyle.ru", "http://www.nexcentra.com/fox-news-faces-another-sexual-harassment-lawsuit", "http://www.phonefactor.com/PfPaWs/ConfirmActivation", "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Lazarus Group" ], "malware_families": [ "Win.packed.botx-10021462-0", "Worm:win32/mofksys.rnd!mtb", "Trojan:win32/comisproc!gmb i", "Malware", "Alf:heraklezeval:trojan:win32/azorult.fw!rfn", "Trojandownloader:win32/nemucod", "Trojanspy:win32/nivdort", "Win.malware.moonlight-9919383-0", "Pws:win32/ymacco.aa50", "Tofsee", "Win.virus.expiro", "Trojanspy:win32/nivdort.de", "#virtool:win32/obfuscator.adb", "Ransom:win32/sodinokibicrypt.sk!mtb", "Slf:win32/elenquay.a", "Slfper:softwarebundler:win32/icloader.a", "Win.packed.generic-9967832-0", "Gandcrab ransomware", "Alf:jasyp:trojan:win32/ircbot!atmn", "#lowfijavazkm", "Win.malware.midie-6847893-0", "Elf:mirai-ati", "Win.trojan.barys-10005825-0", "Alfper:hstr:wizremurl.a1", "Trojan:win32/ircbot", "Win.trojan.agent-1371484", "Custom malware", "Redline stealer", "Win.malware.razy-6979265-0", "Backdoor:win32/tofsee.", "Win.trojan.tofsee-7102058-0", "Simda", "Libraryloader", "Alf:hstr:virtool:win32/obfuscator!pecancer", "Win.ransomware.tofsee-10015002", "Trojandropper:win32/muldrop.v!mtb", "Win.trojan.vbgeneric-6735875-0", "Trojan:win32/daws", "Win.malware.swisyn-7610494-0", "Win.malware.aauto-9839281-0", "Worm:win32/lightmoon.h", "#lowfi:win32/autoit", "Unix.trojan.mirai-9441505-0", "Trojan:win32/mydoom", "Html.trojan.ascii212_44_64_202-1", "Win.malware.cymt-10023133-0", "Win.dropper.quasarrat-10023124-0", "204.79.197.200", "Win.packer.pkr_ce1a-9980177-0", "Win.malware.jaik-9968280-0", "Alf:trojan:win32/cassini_412f60c8!ibt", "Trojan:win32/zombie.a", "Win.malware.generickdz-9937235-0", "Win.trojan.zegost-9769410-0", "Win.packed.stealerc-10017074-0", "Other malware", "Mydoom", "Backdoor:win32/tofsee.t" ], "industries": [ "Telecommunications", "Technology", "Finance", "Contracts", "Government", "Civil society", "Insurance" ], "unique_indicators": 38458 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/shizukuoshi.work", "whois": "http://whois.domaintools.com/shizukuoshi.work", "domain": "shizukuoshi.work", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 7, "pulses": [ { "id": "69decb6dd1bd6da78fc72d0a", "name": "Solarwinds Similarties? Tactics ASP.Net IoC\u2019s ISOLATED", "description": "Does this have similarities to the SolarWinds Attack? Anyone?\n\nASP.NET is a web application framework created by Microsoft for building dynamic web applications.\nIt enables developers to create web pages that can interact with databases and respond to user inputs.\nASP.NET supports various programming languages, including C# and VB.NET.\nContext: ASP.NET is widely used for developing modern web applications and services. It allows developers to create interactive and data-driven web pages that can run on various operating systems, including Windows, Linux, and macOS. The framework is open-source and supports various architectures, including MVC (Model-View-Controller) and Web API, which facilitate the organization and development of complex applications.\nIn many instances ASP.net has been seen connected to malicious Tulach , Apple , a browser agent that transmits data to New Relic's collectors by using either of the domains bam.nr-data.net or bam-cell.nr-data.net.", "modified": "2026-04-14T23:19:09.495000", "created": "2026-04-14T23:19:09.495000", "tags": [ "united", "aaaa", "certificate", "error", "read c", "rgba", "unicode", "memcommit", "delete", "dock", "execution", "command decode", "suricata ipv4", "suricata tcpv4", "flag", "localappdata", "windir", "openurl c", "programfiles", "suricata udpv4", "win64", "click", "strings", "anon", "username", "userprofile", "mitre att", "ck id", "ck matrix", "appdata", "comspec", "model", "path", "april", "hybrid", "general", "learn", "suspicious", "informative", "adversaries", "command", "spawns", "ck techniques", "mtb apr", "exploit", "trojan", "backdoor", "please", "x msedge", "all ipv4", "ransom", "date hash", "avast avg", "win32orbus apr", "dynamicloader", "yara rule", "high", "tofsee", "rndhex", "rndchar", "loaderid", "lidfileupd", "localcfg", "write", "stream", "push", "mtb alerts", "ee fc", "ff d5", "lredmond", "malware", "msie", "windows nt", "wow64", "slcc2", "media center", "yara detections", "av detections", "ids detections", "hostile", "unknown", "extraction", "data upload", "failed", "include review", "stop data", "typ url", "url data", "typ no", "th all", "stop", "port", "destination", "ds detections", "tls sni", "nrv2x", "upxoepplace", "alerts", "contacted", "markus", "hostile alerts", "less see", "all ip", "tulach", "brian sabey", "quasi", "link", "script urls", "record value", "script domains", "fireeye", "create c", "as15169", "next", "all url", "http", "related pulses", "related tags", "google safe", "code", "y se", "included review", "io excluded", "suggeste", "ipv4", "unknown ns", "redacted admin", "fax redacted", "name redacted", "phone redacted", "code redacted", "redacted tech", "christopher ahmann", "solarwinds like?" ], "references": [ "asp.net \u2022 cdnsrc.asp.net", "https://www.countercept.com/assets/Uploads/whitepapers/MWRI-Countercept-Machine-Learning-Whitepaper-2017-04-01.pdf", "http://www.phonefactor.com/PfPaWs/ConfirmActivation", "IPv4 13.107.253.70 exploit_source \u2022 IPv4 13.107.226.70 malware_hosting", "https://wsps.ourschoolpages.com/Account/ForgotPasswor (typo", "https://hybrid-analysis.com/sample/529a0b900eef6657ce6c98b1b5bccebe6db2e021aa02a316b7eb2604df810d3f/69de30ef0a22c3b506077a8c", "www.fireeye.com", "danilovstyle.ru", "ns4-04.azure-dns.info", "ns4-04.azure-dns.info danilovst) ns4-04.azure-dns.info", "www.fireeye.com .", "https://hypic-anaivsis.com/sambrerb/a0p9veebo", "Are these table SolarWinds attackers? Using same tacktics, good? Unsure.", "Tulach\u2019s ASP.Net Open Source destruction" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Ransom:Win32/SodinokibiCrypt.SK!MTB", "display_name": "Ransom:Win32/SodinokibiCrypt.SK!MTB", "target": "/malware/Ransom:Win32/SodinokibiCrypt.SK!MTB" }, { "id": "Win.Ransomware.Tofsee-10015002", "display_name": "Win.Ransomware.Tofsee-10015002", "target": null }, { "id": "Trojan:Win32/Comisproc!gmb I", "display_name": "Trojan:Win32/Comisproc!gmb I", "target": "/malware/Trojan:Win32/Comisproc!gmb I" } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1132.001", "name": "Standard Encoding", "display_name": "T1132.001 - Standard Encoding" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 88, "FileHash-MD5": 211, "FileHash-SHA1": 186, "FileHash-SHA256": 1366, "URL": 1848, "domain": 418, "email": 4, "hostname": 622, "SSLCertFingerprint": 21 }, "indicator_count": 4764, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "5 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d8a665177b8f64c7ce5fca", "name": "LibraryLoader \u2022 Samuel Tulach | Abuse of malicious sssets engineered by DevOp & Security Researcher", "description": "Samuel Tulach is involved in various projects related to government work, particularly in areas like DevSecOps and app modernization. \nOverview of Samuel Tulach's \"uploader.exe\"\nThe file \"uploader.exe\" created by Samuel Tulach has been identified as malicious by several security engines. This classification indicates that the file poses a potential threat to users' systems.\nSecurity Engine Flags. Several security engines have flagged \"uploader.exe\" as malicious.\nSecureAge APEX\tMalicious\nSentinelOne\tMalicious\nImplications of Malicious Flags\nPotential Risks: Files flagged as malicious can lead to various security issues, including data theft, unauthorized access, or system damage.\nRecommended Actions: Users should avoid downloading or executing this file. If already downloaded, it is advisable to delete it and run a full system scan using reputable antivirus software.", "modified": "2026-04-10T07:27:33.587000", "created": "2026-04-10T07:27:33.587000", "tags": [ "x vercel", "united", "america", "germany malware", "family", "ck ids", "packing", "tulach", "ocsp", "extraction", "data upload", "enter sc", "extra data", "include review", "exclude sugges", "find s", "failed", "typ no", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "command", "initial access", "defense evasion", "pattern match", "mitre att", "ascii text", "span", "title", "meta", "path", "april", "hybrid", "general", "local", "encrypt", "click", "strings", "main", "footer", "pcsb", "naga", "magda", "no expiration", "url https", "domain", "github pages", "a domains", "passive dns", "mtb jan", "class", "sea x", "accept encoding", "trojanspy", "accept", "otx logo", "all ipv4", "urls", "files", "america flag", "space", "ck matrix", "handle", "winvmaddress", "cdecl crashpad", "null", "software", "comment", "entity", "internal", "blank", "magic", "infinity", "first", "valentine", "error", "webview", "front", "patched", "root", "tristate", "libraryloader", "packing t1045", "icmp traffic", "memcommit", "pe section", "low software", "pe resource", "filehash", "win32", "malware", "write", "backdoor", "present apr", "lowfi", "aaaa", "lowfijavazkm", "x.com", "dynamicloader", "crlf line", "unicode text", "utf8", "ee fc", "ff d5", "yara rule", "f0 ff", "eb e1", "unknown", "trojan", "zeppelin", "autorun", "united states", "china unknown", "div div", "ip address", "record value", "samuel tulach", "czechia unknown", "italy unknown", "gmt server", "all domain", "next associated", "reverse dns", "location czech", "all filehash", "md5 add", "av detections", "ids detections", "yara detections", "alerts", "analysis date", "file score", "file type", "telfhash", "virustotal api", "vendor finding", "notes clamav", "files matching", "number", "t1045", "search", "directui", "element", "medium", "classinfobase", "value", "write c", "hwndhost", "sapeav12", "worm", "explorer", "insert", "movie", "mtb apr", "mtb mar", "trojandropper", "displayname", "windows", "high", "delete c", "tofsee", "stream", "push", "url http", "c mar", "virtool", "c jan", "c dec", "toolbar", "ransom", "article", "windows nt", "gmtvia", "html", "bad traffic", "et info", "tls handshake", "belgium", "present dec", "present feb", "intel", "elf upx", "medium risk", "info", "moved", "hostname add", "whois registrar", "media", "delphi", "guard", "code", "devsecops", "github", "github internet", "archive samuel", "tulach", "government work", "key areas", "devops process", "security engine", "flags", "apex malicious", "implications", "malicious flags", "potential risks", "name servers", "apple id", "script urls", "show process", "secure", "win64", "khtml", "gecko", "programfiles", "cookie", "comspec", "model", "june", "spawns", "id name", "malicious", "gui", "anti cheats", "game tech", "c++" ], "references": [ "https://nextcloud.tulach.cc/ \u2022 https://nextcloud.tulach.cc/", "bleepingcomputer.com \u2022 CliffsNotes", "x.com - Malware Packed", "nr-data.net \u2022 www.youtube.com", "Alerts network_icmp allocates_rwx packer_entropy pe_features pe_unknown_resource_name Related Pulses", "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8", "discord.com \u2022 discord.gg", "api.item.yixun.com", "Unix.Trojan.Mirai-9441505-0 Yara Detections is__elf \u2022 217.11.249.145", "Domains Contacted: fenbushijujuefuwu.com", "angryblackwomyn.com", "https://medium.com/the-pink/how-a-white-womans-anger-makes-her-racism-spill-out-563853905a42", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/41ad1d349716b3e62f914c0907323ae8e0a37198d237a02d71a0d5e05ffaa727", "https://www.forpsi.com domain forpsi.com\t Domain asp.net", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "www.youtube.com/watch?v=GyuMozsVyYs (why would targets channel be controlled by Tulach)", "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw", "x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290", "cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz", "porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop", "https://api.w.org/ \u2022 api.w.org", "remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png", "https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-assets-Twitter.b90ee19de735e00fb4a0.js", "developer.x.com \u2022 https://twitter.com/githubstatus", "https://twitter.com/juvlarN", "appleid.cdn-apple.com", "https://static.digitecgalaxus.ch/Files/communication/app-download-badges/apple_email_rasterized_2x/fr.png", "Samuel Tulach , an engineer writes about game security, Unity engine, and anti-cheat systems on his blog at tulach.cc", "Mr. Tulach \u2022 known for his work in cybersecurity, particularly in reverse engineering & malware analysis", "\"uploader.exe\" created by Samuel Tulach has been identified as malicious by several security engines", "Due to Samuel Tulach\u2019s good reputation , assume his assets are being abused by threat actors targeting", "I haven\u2019t yet concluded why Tulach.cc is deeply interwoven in a malicious media campaign", "Samuel Tulach\u2019s assets have been tightly connected to M. Brian Sabey, Esq", "The next pulse will show Apple IoC\u2019s related to Tulach.cc" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "LibraryLoader", "display_name": "LibraryLoader", "target": null }, { "id": "ALF:HeraklezEval:Trojan:Win32/Azorult.FW!rfn", "display_name": "ALF:HeraklezEval:Trojan:Win32/Azorult.FW!rfn", "target": null }, { "id": "Win.Packed.Botx-10021462-0", "display_name": "Win.Packed.Botx-10021462-0", "target": null }, { "id": "Win.Malware.Cymt-10023133-0", "display_name": "Win.Malware.Cymt-10023133-0", "target": null }, { "id": "TrojanDownloader:Win32/Nemucod", "display_name": "TrojanDownloader:Win32/Nemucod", "target": "/malware/TrojanDownloader:Win32/Nemucod" }, { "id": "Win.Trojan.VBGeneric-6735875-0", "display_name": "Win.Trojan.VBGeneric-6735875-0", "target": null }, { "id": "Worm:Win32/Mofksys.RND!MTB", "display_name": "Worm:Win32/Mofksys.RND!MTB", "target": "/malware/Worm:Win32/Mofksys.RND!MTB" }, { "id": "Win.Malware.Generickdz-9937235-0", "display_name": "Win.Malware.Generickdz-9937235-0", "target": null }, { "id": "Win.Malware.Razy-6979265-0", "display_name": "Win.Malware.Razy-6979265-0", "target": null }, { "id": "TrojanSpy:Win32/Nivdort", "display_name": "TrojanSpy:Win32/Nivdort", "target": "/malware/TrojanSpy:Win32/Nivdort" }, { "id": "Trojan:Win32/Mydoom", "display_name": "Trojan:Win32/Mydoom", "target": "/malware/Trojan:Win32/Mydoom" }, { "id": "TrojanSpy:Win32/Nivdort.DE", "display_name": "TrojanSpy:Win32/Nivdort.DE", "target": "/malware/TrojanSpy:Win32/Nivdort.DE" }, { "id": "SLF:Win32/Elenquay.A", "display_name": "SLF:Win32/Elenquay.A", "target": "/malware/SLF:Win32/Elenquay.A" }, { "id": "Win.Dropper.QuasarRAT-10023124-0", "display_name": "Win.Dropper.QuasarRAT-10023124-0", "target": null }, { "id": "Win.Trojan.Zegost-9769410-0", "display_name": "Win.Trojan.Zegost-9769410-0", "target": null }, { "id": "ALF:HSTR:VirTool:Win32/Obfuscator!PECancer", "display_name": "ALF:HSTR:VirTool:Win32/Obfuscator!PECancer", "target": null }, { "id": "Win.Malware.Moonlight-9919383-0", "display_name": "Win.Malware.Moonlight-9919383-0", "target": null }, { "id": "Worm:Win32/Lightmoon.H", "display_name": "Worm:Win32/Lightmoon.H", "target": "/malware/Worm:Win32/Lightmoon.H" }, { "id": "Backdoor:Win32/Tofsee.", "display_name": "Backdoor:Win32/Tofsee.", "target": "/malware/Backdoor:Win32/Tofsee." }, { "id": "#LowfiJavaZKM", "display_name": "#LowfiJavaZKM", "target": null }, { "id": "Win.Malware.Swisyn-7610494-0", "display_name": "Win.Malware.Swisyn-7610494-0", "target": null }, { "id": "PWS:Win32/Ymacco.AA50", "display_name": "PWS:Win32/Ymacco.AA50", "target": "/malware/PWS:Win32/Ymacco.AA50" }, { "id": "Win.Packed.Stealerc-10017074-0", "display_name": "Win.Packed.Stealerc-10017074-0", "target": null }, { "id": "#Lowfi:Win32/AutoIt", "display_name": "#Lowfi:Win32/AutoIt", "target": "/malware/#Lowfi:Win32/AutoIt" }, { "id": "Html.Trojan.Ascii212_44_64_202-1", "display_name": "Html.Trojan.Ascii212_44_64_202-1", "target": null }, { "id": "ALFPER:HSTR:WizremURL.A1", "display_name": "ALFPER:HSTR:WizremURL.A1", "target": null }, { "id": "Win.Malware.Jaik-9968280-0", "display_name": "Win.Malware.Jaik-9968280-0", "target": null }, { "id": "Win.Trojan.Tofsee-7102058-0", "display_name": "Win.Trojan.Tofsee-7102058-0", "target": null }, { "id": "Backdoor:Win32/Tofsee.T", "display_name": "Backdoor:Win32/Tofsee.T", "target": "/malware/Backdoor:Win32/Tofsee.T" }, { "id": "Win.Malware.Jaik-9968280-0", "display_name": "Win.Malware.Jaik-9968280-0", "target": null }, { "id": "Win.Packer.pkr_ce1a-9980177-0", "display_name": "Win.Packer.pkr_ce1a-9980177-0", "target": null }, { "id": "Win.Trojan.Tofsee-7102058-0", "display_name": "Win.Trojan.Tofsee-7102058-0", "target": null }, { "id": "Win.Malware.Midie-6847893-0", "display_name": "Win.Malware.Midie-6847893-0", "target": null }, { "id": "TrojanDropper:Win32/Muldrop.V!MTB", "display_name": "TrojanDropper:Win32/Muldrop.V!MTB", "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB" }, { "id": "Win.Malware.Aauto-9839281-0", "display_name": "Win.Malware.Aauto-9839281-0", "target": null }, { "id": "Win.Trojan.Agent-1371484", "display_name": "Win.Trojan.Agent-1371484", "target": null }, { "id": "SLFPER:SoftwareBundler:Win32/ICLoader.A", "display_name": "SLFPER:SoftwareBundler:Win32/ICLoader.A", "target": null }, { "id": "ALF:Trojan:Win32/Cassini_412f60c8!ibt", "display_name": "ALF:Trojan:Win32/Cassini_412f60c8!ibt", "target": null }, { "id": "Worm:Win32/Mofksys.RND!MTB", "display_name": "Worm:Win32/Mofksys.RND!MTB", "target": "/malware/Worm:Win32/Mofksys.RND!MTB" }, { "id": "Win.Packed.Generic-9967832-0", "display_name": "Win.Packed.Generic-9967832-0", "target": null }, { "id": "Win.Trojan.Barys-10005825-0", "display_name": "Win.Trojan.Barys-10005825-0", "target": null }, { "id": "Unix.Trojan.Mirai-9441505-0", "display_name": "Unix.Trojan.Mirai-9441505-0", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2710, "domain": 1227, "hostname": 1206, "FileHash-SHA256": 3867, "IPv4": 318, "FileHash-MD5": 593, "FileHash-SHA1": 459, "IPv6": 1, "SSLCertFingerprint": 19, "email": 20, "CVE": 1 }, "indicator_count": 10421, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "693148dc0eb85adc8edfe1a2", "name": "BeeLineRouter.Net \u2022 Isolated / Apple Baxkdoor", "description": "", "modified": "2026-01-03T07:00:45.529000", "created": "2025-12-04T08:39:56.180000", "tags": [ "mitre att", "network traffic", "ck id", "show technique", "ck matrix", "threat score", "december", "default browser", "guest system", "united", "dynadot inc", "name server", "contacted hosts", "process details", "windir", "openurl c", "prefetch2", "learn", "name tactics", "suspicious", "informative", "adversaries", "command", "spawns", "access att", "t1566 phishing", "ascii text", "pattern match", "show process", "t1071", "general", "local", "path", "click", "beelinerouter", "access", "router", "apple", "regopenkeyexw", "regsz", "process32nextw", "english", "post http", "search", "observed dns", "query", "sinkhole cookie", "malware", "possible", "win32", "updater", "write", "next", "found", "ip address", "domain", "name servers", "unknown ns", "ip whois", "registrar", "cloudflare", "title", "passive dns", "urls", "files", "location united", "asn as14618", "bq dec", "virtool", "backdoor", "checkin", "ipv4 add", "trojan", "dynamicloader", "msie", "windows nt", "slcc2", "media center", "unknown", "show", "internal", "encrypt", "veailmboprd", "dns query", "wow64", "gecko http", "entries", "medium", "ransom", "khtml", "gecko", "delete", "installer", "win32cve may", "america flag", "overview ip", "asn as20940", "expiration", "url https", "no expiration", "url http", "pulse show", "type indicator", "role title", "related pulses", "record value", "domain xn" ], "references": [ "HTTPS://BeeLineRouter.Net", "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com", "https://appleid.xn--appe-70a.com/", "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069", "https://wallpapers-nature.com/tsara-brashears/urlscan-io", "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.sweetheartvideo.com/tsara-brashears", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://vgt.pl/r.n%20-", "8-25-220-162-static.reverse.queryfoundry.net", "queryfoundry.net", "http://81-26-68-38-static.reverse.queryfoundry.net/", "http://117-114-251-162-static.reverse.queryfoundry.net/", "http://81-26-68-38-static.reverse.queryfoundry.net/", "http://68-178-128-104-static.reverse.queryfoundry.net/", "0-209-98-172-static.reverse.queryfoundry.net", "154-143-182-107-static.reverse.queryfoundry.net", "http://51-235-245-104-static.reverse.queryfoundry.net/", "167-16-68-38-static.reverse.queryfoundry.net", "http://49-116-251-162-static.reverse.queryfoundry./net/", "177-231-69-38-static.reverse.queryfoundry.net", "http://36-243-60-103-static.reverse.queryfoundry.net/", "http://237-189-251-104-static.reverse.queryfoundry.net/", "http://227-98-248-162-static.reverse.queryfoundry.net/", "237-189-251-104-static.reverse.queryfoundry.net", "http://207-214-98-172-static.reverse.queryfoundry.net/", "181-135-182-107-static.reverse.queryfoundry.net", "http://201-191-251-104-static.reverse.queryfoundry.net/", "67-228-69-38-static.reverse.queryfoundry.net", "http://0-209-98-172-static.reverse.queryfoundry.net/", "http://10-241-60-103-static.reverse.queryfoundry.net/", "http://142-232-245-104-static.reverse.queryfoundry.net/", "http://154-143-182-107-static.reverse.queryfoundry.net/", "http://167-16-68-38-static.reverse.queryfoundry.net/", "http://177-231-69-38-static.reverse.queryfoundry.net/", "http://181-135-182-107-static.reverse.queryfoundry.net/", "http://195-214-98-172-static.reverse.queryfoundry.net/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Simda", "display_name": "Simda", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null }, { "id": "GandCrab Ransomware", "display_name": "GandCrab Ransomware", "target": null }, { "id": "Win.Virus.Expiro", "display_name": "Win.Virus.Expiro", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null }, { "id": "#VirTool:Win32/Obfuscator.ADB", "display_name": "#VirTool:Win32/Obfuscator.ADB", "target": "/malware/#VirTool:Win32/Obfuscator.ADB" } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1049, "URL": 5839, "hostname": 1944, "FileHash-SHA256": 3634, "FileHash-MD5": 310, "FileHash-SHA1": 295, "CVE": 2, "email": 15, "SSLCertFingerprint": 2 }, "indicator_count": 13090, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "106 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69314920e287845f6b36a265", "name": "BeeLineRouter.Net \u2022 Apple Access", "description": "", "modified": "2026-01-03T07:00:45.529000", "created": "2025-12-04T08:41:04.190000", "tags": [ "mitre att", "network traffic", "ck id", "show technique", "ck matrix", "threat score", "december", "default browser", "guest system", "united", "dynadot inc", "name server", "contacted hosts", "process details", "windir", "openurl c", "prefetch2", "learn", "name tactics", "suspicious", "informative", "adversaries", "command", "spawns", "access att", "t1566 phishing", "ascii text", "pattern match", "show process", "t1071", "general", "local", "path", "click", "beelinerouter", "access", "router", "apple", "regopenkeyexw", "regsz", "process32nextw", "english", "post http", "search", "observed dns", "query", "sinkhole cookie", "malware", "possible", "win32", "updater", "write", "next", "found", "ip address", "domain", "name servers", "unknown ns", "ip whois", "registrar", "cloudflare", "title", "passive dns", "urls", "files", "location united", "asn as14618", "bq dec", "virtool", "backdoor", "checkin", "ipv4 add", "trojan", "dynamicloader", "msie", "windows nt", "slcc2", "media center", "unknown", "show", "internal", "encrypt", "veailmboprd", "dns query", "wow64", "gecko http", "entries", "medium", "ransom", "khtml", "gecko", "delete", "installer", "win32cve may", "america flag", "overview ip", "asn as20940", "expiration", "url https", "no expiration", "url http", "pulse show", "type indicator", "role title", "related pulses", "record value", "domain xn" ], "references": [ "HTTPS://BeeLineRouter.Net", "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com", "https://appleid.xn--appe-70a.com/", "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069", "https://wallpapers-nature.com/tsara-brashears/urlscan-io", "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.sweetheartvideo.com/tsara-brashears", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://vgt.pl/r.n%20-", "8-25-220-162-static.reverse.queryfoundry.net", "queryfoundry.net", "http://81-26-68-38-static.reverse.queryfoundry.net/", "http://117-114-251-162-static.reverse.queryfoundry.net/", "http://81-26-68-38-static.reverse.queryfoundry.net/", "http://68-178-128-104-static.reverse.queryfoundry.net/", "0-209-98-172-static.reverse.queryfoundry.net", "154-143-182-107-static.reverse.queryfoundry.net", "http://51-235-245-104-static.reverse.queryfoundry.net/", "167-16-68-38-static.reverse.queryfoundry.net", "http://49-116-251-162-static.reverse.queryfoundry./net/", "177-231-69-38-static.reverse.queryfoundry.net", "http://36-243-60-103-static.reverse.queryfoundry.net/", "http://237-189-251-104-static.reverse.queryfoundry.net/", "http://227-98-248-162-static.reverse.queryfoundry.net/", "237-189-251-104-static.reverse.queryfoundry.net", "http://207-214-98-172-static.reverse.queryfoundry.net/", "181-135-182-107-static.reverse.queryfoundry.net", "http://201-191-251-104-static.reverse.queryfoundry.net/", "67-228-69-38-static.reverse.queryfoundry.net", "http://0-209-98-172-static.reverse.queryfoundry.net/", "http://10-241-60-103-static.reverse.queryfoundry.net/", "http://142-232-245-104-static.reverse.queryfoundry.net/", "http://154-143-182-107-static.reverse.queryfoundry.net/", "http://167-16-68-38-static.reverse.queryfoundry.net/", "http://177-231-69-38-static.reverse.queryfoundry.net/", "http://181-135-182-107-static.reverse.queryfoundry.net/", "http://195-214-98-172-static.reverse.queryfoundry.net/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Simda", "display_name": "Simda", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null }, { "id": "GandCrab Ransomware", "display_name": "GandCrab Ransomware", "target": null }, { "id": "Win.Virus.Expiro", "display_name": "Win.Virus.Expiro", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null }, { "id": "#VirTool:Win32/Obfuscator.ADB", "display_name": "#VirTool:Win32/Obfuscator.ADB", "target": "/malware/#VirTool:Win32/Obfuscator.ADB" } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 295, "FileHash-SHA256": 3634, "URL": 5839, "CVE": 2, "domain": 1048, "email": 15, "hostname": 1944, "SSLCertFingerprint": 2 }, "indicator_count": 13089, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "106 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69314926519256e3ef0a9358", "name": "BeeLineRouter.Net \u2022 Apple Access", "description": "", "modified": "2026-01-03T07:00:45.529000", "created": "2025-12-04T08:41:06.657000", "tags": [ "mitre att", "network traffic", "ck id", "show technique", "ck matrix", "threat score", "december", "default browser", "guest system", "united", "dynadot inc", "name server", "contacted hosts", "process details", "windir", "openurl c", "prefetch2", "learn", "name tactics", "suspicious", "informative", "adversaries", "command", "spawns", "access att", "t1566 phishing", "ascii text", "pattern match", "show process", "t1071", "general", "local", "path", "click", "beelinerouter", "access", "router", "apple", "regopenkeyexw", "regsz", "process32nextw", "english", "post http", "search", "observed dns", "query", "sinkhole cookie", "malware", "possible", "win32", "updater", "write", "next", "found", "ip address", "domain", "name servers", "unknown ns", "ip whois", "registrar", "cloudflare", "title", "passive dns", "urls", "files", "location united", "asn as14618", "bq dec", "virtool", "backdoor", "checkin", "ipv4 add", "trojan", "dynamicloader", "msie", "windows nt", "slcc2", "media center", "unknown", "show", "internal", "encrypt", "veailmboprd", "dns query", "wow64", "gecko http", "entries", "medium", "ransom", "khtml", "gecko", "delete", "installer", "win32cve may", "america flag", "overview ip", "asn as20940", "expiration", "url https", "no expiration", "url http", "pulse show", "type indicator", "role title", "related pulses", "record value", "domain xn" ], "references": [ "HTTPS://BeeLineRouter.Net", "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com", "https://appleid.xn--appe-70a.com/", "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069", "https://wallpapers-nature.com/tsara-brashears/urlscan-io", "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.sweetheartvideo.com/tsara-brashears", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "http://vgt.pl/r.n%20-", "8-25-220-162-static.reverse.queryfoundry.net", "queryfoundry.net", "http://81-26-68-38-static.reverse.queryfoundry.net/", "http://117-114-251-162-static.reverse.queryfoundry.net/", "http://81-26-68-38-static.reverse.queryfoundry.net/", "http://68-178-128-104-static.reverse.queryfoundry.net/", "0-209-98-172-static.reverse.queryfoundry.net", "154-143-182-107-static.reverse.queryfoundry.net", "http://51-235-245-104-static.reverse.queryfoundry.net/", "167-16-68-38-static.reverse.queryfoundry.net", "http://49-116-251-162-static.reverse.queryfoundry./net/", "177-231-69-38-static.reverse.queryfoundry.net", "http://36-243-60-103-static.reverse.queryfoundry.net/", "http://237-189-251-104-static.reverse.queryfoundry.net/", "http://227-98-248-162-static.reverse.queryfoundry.net/", "237-189-251-104-static.reverse.queryfoundry.net", "http://207-214-98-172-static.reverse.queryfoundry.net/", "181-135-182-107-static.reverse.queryfoundry.net", "http://201-191-251-104-static.reverse.queryfoundry.net/", "67-228-69-38-static.reverse.queryfoundry.net", "http://0-209-98-172-static.reverse.queryfoundry.net/", "http://10-241-60-103-static.reverse.queryfoundry.net/", "http://142-232-245-104-static.reverse.queryfoundry.net/", "http://154-143-182-107-static.reverse.queryfoundry.net/", "http://167-16-68-38-static.reverse.queryfoundry.net/", "http://177-231-69-38-static.reverse.queryfoundry.net/", "http://181-135-182-107-static.reverse.queryfoundry.net/", "http://195-214-98-172-static.reverse.queryfoundry.net/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Simda", "display_name": "Simda", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null }, { "id": "GandCrab Ransomware", "display_name": "GandCrab Ransomware", "target": null }, { "id": "Win.Virus.Expiro", "display_name": "Win.Virus.Expiro", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null }, { "id": "#VirTool:Win32/Obfuscator.ADB", "display_name": "#VirTool:Win32/Obfuscator.ADB", "target": "/malware/#VirTool:Win32/Obfuscator.ADB" } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 295, "FileHash-SHA256": 3634, "URL": 5839, "CVE": 2, "domain": 1048, "email": 15, "hostname": 1944, "SSLCertFingerprint": 2 }, "indicator_count": 13089, "is_author": false, "is_subscribing": null, "subscriber_count": 146, "modified_text": "106 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68a0cb6a89a10d13623a0018", "name": "Medicaid Mirai Botnet | United Healthcare Mirai Botnet", "description": "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll. Medicaid Botnet work managed by Lumen Technologies as part of a massive silencing campaign. |\n\nPhone calls routed since forces and investigated disclosures of several attack resulting in great bodily harm and life threatening, ending injuries.\nThis campaign date has one start date 11/13/2013.\n#missed assaults internal investigated 10/08/2013 -11/31/ 2013.\nI\u2019m sure other targets are impacted . This stems from targets personal , documented experiences. \nFormerly k/a Century Link was confronted by associate of targets when a plain clothed male entered targets yard in 11/ 2013, told their box controlled entire neighborhood. Continuously accessed properties. \n\n\n\n#rip #lumen #botnet #fencing #malware #silencing #civil_liberties # monitored_target #remote #corruption #privacy_abuse #centurylink", "modified": "2025-09-15T16:04:47.043000", "created": "2025-08-16T18:18:18.657000", "tags": [ "url https", "search", "type indicator", "role title", "added active", "related pulses", "entries", "httponly", "samesitelax", "read c", "medium", "rgba", "unicode", "port", "memcommit", "delete", "next", "dock", "write", "execution", "present aug", "united", "ip address", "name servers", "unknown ns", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "spawns", "mitre att", "ck techniques", "evasion att", "pattern match", "show technique", "ck matrix", "refresh", "body", "span", "august", "hybrid", "general", "local", "path", "click", "strings", "error", "tools", "look", "verify", "restart", "href", "size", "t1480 execution", "file defense", "ascii text", "trojan", "passive dns", "trojandropper", "next associated", "fastly error", "please", "sea p", "mozilla", "accept", "ipv4 add", "urls", "files", "location united", "ipv4", "url analysis", "america flag", "america asn", "backdoor", "win32", "malware", "date", "domain", "segoe ui", "a domains", "security tls", "san jose", "asn8075", "reverse dns", "software", "resource hash", "general full", "status", "emails", "expiration date", "asp", "microsoft oem", "found", "running webserver", "netherlands", "creation date", "aaaa", "certificate", "protocol h2", "name value", "hash", "present jun", "present apr", "moved", "control att", "t1573 encrypted", "channel command", "decrypted ssl", "runtime process", "appdata", "windows nt", "svg scalable", "patch", "internal", "core", "high", "tcp syn", "icmp traffic", "dns query", "av detections", "ashburn", "ai device id", "telnet", "windows script", "microsoft", "host", "yara detections", "pdb path", "pe resource", "script host", "test", "hostname add", "files ip", "domains", "hashes", "ireland", "mtb jun", "mtb may", "device local", "remotewd", "nemtih", "url add", "http", "hostname", "files domain", "files related", "pulses otx", "present jul", "domain add", "colorado", "quasi", "contracts", "botnet", "remote access", "virginia", "c++", "hacking", "monitored target", "silencing campaign", "audio recording", "cameras", "full service", "tactics" ], "references": [ "Handled by Lumen Technologies | What kind of darkness is this?", "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll https://myhpnmedicaid.com/Provider", "dev.myhpnmedicaid.com", "ELF:Mirai-ATI | United Healthcare Dark? | https://otx.alienvault.com/indicator/ip/205.132.162.113", "https://hybrid-analysis.com/sample/e439d3dd3d943ecc702d12998a32e15c00008a8f276e6c89cb54f6de43f36de8/689fccb81c4f237eb6009b0f", "https://hybrid-analysis.com/sample/f095ee58f390749315e72cfa46d979cb25a15884b66c7951719c844ebc82b3a3/689fcc753aca4827cd036851", "https://hybrid-analysis.com/sample/dd09e575e6dfa77f081bf0014b2494e02f90cb23723fbb35d6b2a92e7c629920/689fcc40b786f8eaa20534b5", "Primary Request aspnet dotnet.microsoft.com/en-us/apps/ Redirect Chain http://asp.net/ https://asp.net/ https://www.asp.net/ https://dotnet.microsoft.com/en-us/apps/aspnet", "Redirect Chain http://asp.net/ https://asp.net/ https://www.asp.net/", "https://dotnet.microsoft.com/en-us/apps/aspnet", "ASP.net - Hack Together: Mar 1-15 Join the hack. Build an app with NET & Microsoft Graph for a\u2026 .", "ASP.net - chance to win prizes! \u53e3\u3001\u4ecb\u5973\u8fa3 All Microsoft Learn more ASP.NET Free. Cross-platform\u2026.", "ASP.net Open source. A framework for building web apps and services with .NET and C#", "Registrant Org: Japan Computer Emergency Response Team Coordination Center", "Interesting: unitedhealthcare cdn.member.unitedhealthcare.com \u2022 data.aca.unitedhealthcare.com \u2022 data.member.unitedhealthcare.com", "Interesting Domain Tactics: https://click.benefits.unitedhealthcare.com/", "Interesting: dev-optum-dataintelligence.com \u2022 optumcoding.xxx \u2022 optuminsightcoding.xxx \u2022 optumrx.xxx", "Interesting: memberforms.optumrx.com \u2022 myoptum.info \u2022 optumrx.com \u2022 cte-scl.new.optumrx.com \u2022 dev-scl.optumrx.com", "http://www.nexcentra.com/fox-news-faces-another-sexual-harassment-lawsuit" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Trojan:Win32/Zombie.A", "display_name": "Trojan:Win32/Zombie.A", "target": "/malware/Trojan:Win32/Zombie.A" }, { "id": "Win.Packed.Generic-9967832-0", "display_name": "Win.Packed.Generic-9967832-0", "target": null }, { "id": "Custom Malware", "display_name": "Custom Malware", "target": null }, { "id": "Trojan:Win32/Daws", "display_name": "Trojan:Win32/Daws", "target": "/malware/Trojan:Win32/Daws" }, { "id": "ELF:Mirai-ATI", "display_name": "ELF:Mirai-ATI", "target": null }, { "id": "Trojan:Win32/IRCbot", "display_name": "Trojan:Win32/IRCbot", "target": "/malware/Trojan:Win32/IRCbot" }, { "id": "alf:JASYP:Trojan:Win32/IRCbot!atmn", "display_name": "alf:JASYP:Trojan:Win32/IRCbot!atmn", "target": null }, { "id": "Trojandropper:Win32/Muldrop.V!MTB", "display_name": "Trojandropper:Win32/Muldrop.V!MTB", "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB" }, { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1001.003", "name": "Protocol Impersonation", "display_name": "T1001.003 - Protocol Impersonation" }, { "id": "T1092", "name": "Communication Through Removable Media", "display_name": "T1092 - Communication Through Removable Media" }, { "id": "T1433", "name": "Access Call Log", "display_name": "T1433 - Access Call Log" } ], "industries": [ "Technology", "Telecommunications", "Contracts", "Government", "Finance", "Insurance", "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 37, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4880, "domain": 575, "hostname": 1419, "FileHash-SHA256": 1745, "FileHash-MD5": 284, "FileHash-SHA1": 263, "email": 5, "CVE": 1 }, "indicator_count": 9172, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "216 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6674e062afd192ab545b1a04", "name": "Lazarus Group", "description": "Everyone? Why Brashears? You are all so brilliant! It's not to surprising. I acted on behalf of target to follow your report. I am not anywhere close to ever being as clever as thee. Are you hiring snoops? This took form in October 2013.\nThen a follower. Next hell week-years. Just because you can. Well toasts yourselves. It must be amazing to be able to live without the fear of consequences, with knowledge that you're probably right. You know the odds or even better, the government pays you to do it!\nI am truly fascinated as well as humbled by your abilities. You made her so very sad. If that's what you need. Really rethink you choices, it's so otherworldly; again making you all so \nbright. She's met some of you, spoken to some of you, shopped alongside, was surveilled, viewed. More popular than the Kardashian on your rogue channels. Now THAT'S Reality TV. Bieber & Tori Kelley got her song chops, Sony was hacked. Okay. I'm so impressed, Hire me.\n\nsmph. I don't get it. No one does. \nAll tags auto generated.", "modified": "2024-09-05T06:06:53.933000", "created": "2024-06-21T02:07:30.790000", "tags": [ "scripts", "redline stealer", "lazarus", "core", "no problems", "html internet", "html document", "ascii text", "language", "merkd1904", "code", "c++" ], "references": [], "public": 1, "adversary": "Lazarus Group", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "204.79.197.200", "display_name": "204.79.197.200", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6840, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-MD5": 50, "FileHash-SHA1": 43, "FileHash-SHA256": 850, "URL": 949, "domain": 141, "hostname": 410 }, "indicator_count": 2445, "is_author": false, "is_subscribing": null, "subscriber_count": 230, "modified_text": "591 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://shizukuoshi.work", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://shizukuoshi.work", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776647855.5762653 }