{ "type": "URL", "indicator": "https://static.ads-twitter.com/uwt.js", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://static.ads-twitter.com/uwt.js", "type": "url", "type_title": "URL", "validation": [ { "source": "akamai", "message": "Akamai rank: #855", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain ads-twitter.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 3155065784, "indicator": "https://static.ads-twitter.com/uwt.js", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 50, "pulses": [ { "id": "699c3b796fcaed878ca94c5c", "name": "https://m.vzw.com/wIvzrd8", "description": "the wizard", "modified": "2026-04-18T05:30:18.690000", "created": "2026-02-23T11:35:21.673000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1818, "hostname": 575, "URL": 200, "FileHash-SHA1": 450, "CIDR": 11, "domain": 887, "email": 7, "FileHash-MD5": 402, "CVE": 21 }, "indicator_count": 4371, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "1 day ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b283a733a36fe75a38bb9c", "name": "The Gatby Script Loader", "description": "Im still hooked on the Belasco Chain being a thing.", "modified": "2026-04-18T05:29:25.398000", "created": "2026-03-12T09:13:11.392000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 227, "FileHash-MD5": 24, "FileHash-SHA1": 14, "domain": 64, "URL": 42, "hostname": 57, "CVE": 3, "IPv4": 1, "JA3": 1 }, "indicator_count": 433, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "1 day ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b6044b1389957c1d2afb58", "name": "Pulses in Question", "description": "Following.", "modified": "2026-04-14T01:10:24.056000", "created": "2026-03-15T00:58:51.761000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 56, "FileHash-SHA1": 56, "FileHash-SHA256": 93, "URL": 122, "hostname": 150, "email": 1, "domain": 37 }, "indicator_count": 515, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "5 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b650d954218108114d88e3", "name": "Files Corpus Redirected to these PDFKIT.net", "description": "PDFKIT.NET DMV version \"\" see old posts for details. Recommendation, PDFkit.net DMV versions should be aggregated with data to rule out anything like ability to connect to Mac ids, or general safety. Docusign states that to fall within a secure Docusign protocol documents are not modified after creation. Please check old pdfs for post modification violating forgery, cryptography, electronic claims act integrity violations.", "modified": "2026-04-14T00:14:29.475000", "created": "2026-03-15T06:25:29.875000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 6, "hostname": 12, "URL": 15, "FileHash-SHA256": 3 }, "indicator_count": 36, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "5 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699ffe2a0a48bdf23d11efb4", "name": "Cardconnect Ecosystem", "description": "The cardconnect.com infrastructure reveals a fragmented and high-risk network topology characterized by an atypical shift from Fastly edge delivery to Radware-Ukraine (AS30779) routing. While core transaction processing remains anchored within Fiserv (AS11121/AS39992) and status monitoring is partitioned to AWS, the persistent resolution of root and www traffic to Ukrainian IP space (176.100.165.28) creates a significant geolocation anomaly for a US financial entity. This volatility, coupled with orphaned NXDOMAIN records and inconsistent CNAME nesting (aliasing vendor-specific subdomains like idexx and frazer to centralized b2c/fts endpoints), suggests a non-unified deployment strategy that complicates the domain\u2019s security perimeter and increases its exposure to DNS-based interception.", "modified": "2026-04-13T23:46:24.779000", "created": "2026-02-26T08:02:50.501000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 301, "FileHash-SHA256": 198, "hostname": 1359, "URL": 229, "email": 8, "FileHash-SHA1": 49, "CIDR": 4, "FileHash-MD5": 11, "CVE": 2 }, "indicator_count": 2161, "is_author": false, "is_subscribing": null, "subscriber_count": 50, "modified_text": "5 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69db4f2dc509a1e8210f1b68", "name": "CAPE Sandbox", "description": "CivicPlus, LLC (ICONE-2) is a US-based company with a name that includes the word \"CIVICPLUS\", \"civicplus\", and \"icon Enterprises, Inc\".", "modified": "2026-04-12T08:36:17.724000", "created": "2026-04-12T07:52:13.594000", "tags": [ "network admin", "civicplus", "net192", "net1920000", "houston", "suite e", "city", "server", "select contact", "domain holder", "date", "form", "submission", "ssdeep", "file type", "text text", "magic unicode", "utf8", "crlf line", "trid text", "magika txt", "file size", "chatgpt", "doctype html", "meta", "ai system", "research", "preview", "gmt server", "self", "dynamic", "html info", "title chatgpt", "meta tags", "thumbprint" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/528831360d5c49743bf0dcf9cb0af1f76c694de9dfff79b32098d68c3c592f8a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775980441&Signature=QefJtz2s096UJTV1NljpeJrvdFWJBbHJre5UDOJQeemvu9EGI8UaxLTPvZxejJToeSgqCCu4zCWniB2V9Xer1ozcM5Vy2xhgRO%2BaFeWFRkjfd5yRyZIGLi65ORYA2oyDhTBUZuQco3NNHZWaS0mWYOpAI662c%2BecYNp5SJTXMB4oKzu9bstiszUfM1HNlWjSpySaxCD4j34gZFgiv5xZGW34IcBSvzfQUWECgUu6jW5Pu4Rr%2FH5TJS%2" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 2, "URL": 602, "domain": 166, "email": 37, "hostname": 837, "FileHash-MD5": 125, "FileHash-SHA1": 136, "FileHash-SHA256": 1230, "IPv4": 399 }, "indicator_count": 3534, "is_author": false, "is_subscribing": null, "subscriber_count": 49, "modified_text": "7 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b27c9ac35999221fac31ba", "name": "VirusTotal https://www.cloudflare.com/5xx-error-landing/", "description": "Wow.", "modified": "2026-04-11T08:33:01.447000", "created": "2026-03-12T08:43:06.589000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 9, "FileHash-MD5": 11, "FileHash-SHA1": 3, "URL": 64, "domain": 8, "hostname": 40 }, "indicator_count": 135, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "8 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d79c38e0a059039b475ebe", "name": "CAPE Sandbox", "description": "Email today from them on my line. Very wild things happening here. trying to close my line", "modified": "2026-04-09T12:55:23.059000", "created": "2026-04-09T12:31:52.495000", "tags": [ "html document", "unicode text", "utf8 text", "crlf", "lf line", "site", "meta", "verizon", "wireless", "internet", "phone services", "official", "shop verizon", "lte network", "get fios", "title", "code", "error", "utc na", "utc google", "tag manager", "gtmw2vn2cq", "utc dc9849921", "utc dc685973", "utc g12r1dx1lx7", "utc aw647962234", "utc aw2761768", "utc aw685973", "verizon business", "verizon for business", "verizon business account", "verizon business phone", "verizon wireless for business", "verizon business service", "verizon business plan", "business internet services", "learn", "gartner", "contact", "find", "discover", "support", "close log", "shop", "upgrade", "small", "voice", "chat", "mitre attack", "network info", "program", "html page", "t1055 process", "overview", "processes extra", "overview zenbox", "verdict", "guest system", "phishing", "next", "ver2", "msclkidn", "utc amazon", "analytics na", "utc bing", "vids1", "vids0", "gdlname" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/edb4c21d60daa44b3429e7ba9bfa342759ebef23c136c934f74aef145453ce19_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775737365&Signature=S%2B7RcHYjab1hbKlKwFfvUbDirFPJS1A2TJQ3bVIObMcON4PD9pRDvhMtYMCnEBrYsICi0UJCFW5eUDolL5Jlbngsc587kF36vvuhlkPprbkSOY1jOyDTpe3Qsb6jRFz3xwOfZc9S5QervoLnRKb%2FyGSyZE6ZK6TxzBrOPczPtZ7sLf9NfD6E%2B2gMRXaRjEqVwVITLG7YqCiiNuohFOuNlK3uNHFpIk53viKvBSAIqLtSklH9bHW4q1DX", "https://www.verizon.com/business/", "https://vtbehaviour.commondatastorage.googleapis.com/edb4c21d60daa44b3429e7ba9bfa342759ebef23c136c934f74aef145453ce19_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775737710&Signature=fbsokraSd7lsYmUfaTEl8Phs2K3hp7AtVmQU9axeEBcYmYbrrYrrfpP5lPEQaE%2Fh3%2BEP9Rn8mD8D1haqQVXCN0VVlxJ4sddjWmyC5USsgBsvUb0%2F72h1WHDS2KXHlteZWE%2Bauckabain9D5kX501AnqFY38s77OIqO6SMOkQ%2BvXiDSSRK%2FZhbfradBnei3ZLHsXGxkoshTyvB0%2BC%2F8SiUzdVsqSjik0Bn2r%2BIlLpDQK90GlZTD0N" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 772, "hostname": 706, "domain": 875, "FileHash-SHA256": 2348, "FileHash-MD5": 2237, "FileHash-SHA1": 2260, "IPv4": 442, "CVE": 1, "email": 9 }, "indicator_count": 9650, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "10 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d79c38622d6235b8c04603", "name": "CAPE Sandbox", "description": "Email today from them on my line. Very wild things happening here. trying to close my line", "modified": "2026-04-09T12:35:40.120000", "created": "2026-04-09T12:31:52.780000", "tags": [ "html document", "unicode text", "utf8 text", "crlf", "lf line", "site", "meta", "verizon", "wireless", "internet", "phone services", "official", "shop verizon", "lte network", "get fios", "title", "code", "error", "utc na", "utc google", "tag manager", "gtmw2vn2cq", "utc dc9849921", "utc dc685973", "utc g12r1dx1lx7", "utc aw647962234", "utc aw2761768", "utc aw685973", "verizon business", "verizon for business", "verizon business account", "verizon business phone", "verizon wireless for business", "verizon business service", "verizon business plan", "business internet services", "learn", "gartner", "contact", "find", "discover", "support", "close log", "shop", "upgrade", "small", "voice", "chat", "mitre attack", "network info", "program", "html page", "t1055 process", "overview", "processes extra", "overview zenbox", "verdict", "guest system", "phishing", "next", "ver2", "msclkidn", "utc amazon", "analytics na", "utc bing", "vids1", "vids0", "gdlname" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/edb4c21d60daa44b3429e7ba9bfa342759ebef23c136c934f74aef145453ce19_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775737365&Signature=S%2B7RcHYjab1hbKlKwFfvUbDirFPJS1A2TJQ3bVIObMcON4PD9pRDvhMtYMCnEBrYsICi0UJCFW5eUDolL5Jlbngsc587kF36vvuhlkPprbkSOY1jOyDTpe3Qsb6jRFz3xwOfZc9S5QervoLnRKb%2FyGSyZE6ZK6TxzBrOPczPtZ7sLf9NfD6E%2B2gMRXaRjEqVwVITLG7YqCiiNuohFOuNlK3uNHFpIk53viKvBSAIqLtSklH9bHW4q1DX", "https://www.verizon.com/business/", "https://vtbehaviour.commondatastorage.googleapis.com/edb4c21d60daa44b3429e7ba9bfa342759ebef23c136c934f74aef145453ce19_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775737710&Signature=fbsokraSd7lsYmUfaTEl8Phs2K3hp7AtVmQU9axeEBcYmYbrrYrrfpP5lPEQaE%2Fh3%2BEP9Rn8mD8D1haqQVXCN0VVlxJ4sddjWmyC5USsgBsvUb0%2F72h1WHDS2KXHlteZWE%2Bauckabain9D5kX501AnqFY38s77OIqO6SMOkQ%2BvXiDSSRK%2FZhbfradBnei3ZLHsXGxkoshTyvB0%2BC%2F8SiUzdVsqSjik0Bn2r%2BIlLpDQK90GlZTD0N" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 196, "hostname": 128, "domain": 4, "FileHash-SHA256": 90, "FileHash-MD5": 6, "FileHash-SHA1": 1, "IPv4": 90, "CVE": 1 }, "indicator_count": 516, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ccd2f7984fad6feebb4ca4", "name": "VirusTotal report\n for index.html", "description": "The full text of the full report-to-gws, which was published on 1 April 2026, has been published online by the Csp website, following a request from the BBC>pretext .", "modified": "2026-04-01T08:44:36.825000", "created": "2026-04-01T08:10:31.621000", "tags": [ "self", "downlink rtt", "html document", "ascii text", "crlf line", "windows", "linux", "build web", "html", "javascript", "https", "acceptencoding", "cookie", "dynamic", "authorization", "contentmd5", "wp engine", "xmsedgeref ref", "bl2edge1520 ref", "expires sun", "gmt date", "gmt xcache", "tcphit", "gmt etag", "b8glwd", "afeap", "bmxagc", "e5bfse", "bgs6mb", "bjwmce", "ciztgb", "kqhykb", "cxxawb", "fevhcf", "code", "server", "registrar abuse", "admin country", "expiration date", "registry domain", "registrar iana", "creation date", "admin city", "redmond tech", "samesitelax", "path", "httponly", "secure", "priorityhigh", "gmt contenttype", "contentlength", "connection", "cfray", "accept", "anycast", "wifi display", "android", "hdtv", "anycast og", "anything", "big screen", "mobileoptimized", "try shopify", "platform", "businesses", "shopify fb", "shopify og", "snapchat", "chat", "snaps", "a snap", "utc google", "adobe dynamic", "tag management", "amazon", "utc amazon", "utc facebook", "connect na", "analytics na", "tag manager", "gdlname", "miss", "drupal", "miss xtimer", "ve9 xcache", "miss date", "gmt link", "build", "home og", "cloudfront", "iad6", "kb body", "sha256", "aspen", "aspen one", "return", "transformed og", "aioseo", "site kit", "google", "file type", "name file", "html internet", "unicode text", "utf8 text" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 238, "URL": 367, "domain": 80, "hostname": 155, "FileHash-MD5": 115, "FileHash-SHA1": 105, "email": 5, "IPv4": 40, "SSLCertFingerprint": 4 }, "indicator_count": 1109, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "18 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ccd2f93b5cf1fa8fcb0810", "name": "VirusTotal report\n for index.html", "description": "The full text of the full report-to-gws, which was published on 1 April 2026, has been published online by the Csp website, following a request from the BBC>pretext .", "modified": "2026-04-01T08:41:56.177000", "created": "2026-04-01T08:10:33.232000", "tags": [ "self", "downlink rtt", "html document", "ascii text", "crlf line", "windows", "linux", "build web", "html", "javascript", "https", "acceptencoding", "cookie", "dynamic", "authorization", "contentmd5", "wp engine", "xmsedgeref ref", "bl2edge1520 ref", "expires sun", "gmt date", "gmt xcache", "tcphit", "gmt etag", "b8glwd", "afeap", "bmxagc", "e5bfse", "bgs6mb", "bjwmce", "ciztgb", "kqhykb", "cxxawb", "fevhcf", "code", "server", "registrar abuse", "admin country", "expiration date", "registry domain", "registrar iana", "creation date", "admin city", "redmond tech", "samesitelax", "path", "httponly", "secure", "priorityhigh", "gmt contenttype", "contentlength", "connection", "cfray", "accept", "anycast", "wifi display", "android", "hdtv", "anycast og", "anything", "big screen", "mobileoptimized", "try shopify", "platform", "businesses", "shopify fb", "shopify og", "snapchat", "chat", "snaps", "a snap", "utc google", "adobe dynamic", "tag management", "amazon", "utc amazon", "utc facebook", "connect na", "analytics na", "tag manager", "gdlname", "miss", "drupal", "miss xtimer", "ve9 xcache", "miss date", "gmt link", "build", "home og", "cloudfront", "iad6", "kb body", "sha256", "aspen", "aspen one", "return", "transformed og", "aioseo", "site kit", "google", "file type", "name file", "html internet", "unicode text", "utf8 text" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 181, "URL": 262, "domain": 28, "hostname": 114, "FileHash-MD5": 105, "FileHash-SHA1": 93, "email": 3, "IPv4": 34 }, "indicator_count": 820, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "18 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69a365f7ee0e5dc761fb45b7", "name": "Malicious Campaign", "description": "", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-28T22:02:31.385000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 24, "FileHash-SHA1": 27, "FileHash-SHA256": 202, "domain": 18, "hostname": 46, "URL": 26, "CVE": 2 }, "indicator_count": 345, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "18 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69c7c21fcde6af03f5075a95", "name": "meg.ns.cloudflare.com #abuseofpower", "description": "The full text of the full report on the \"Pulses\" phenomenon has been published online by CloudFlare.com, the company that runs the web service for the US government's internet service.<<<< NOT OK.", "modified": "2026-03-30T02:53:46.948000", "created": "2026-03-28T11:57:19.406000", "tags": [ "as13335", "united", "unknown", "status", "aaaa", "passive dns", "ip address", "creation date", "date", "expiration date", "record type", "ttl value", "algorithm", "key identifier", "x509v3 subject", "v3 serial", "number", "cus ogoogle", "trust", "cnwe1 validity", "subject public", "key info", "data redacted", "domain status", "server", "code", "registrar abuse", "registrant fax", "contact phone", "registrar url", "admin postal", "cloudflare", "general", "dns server", "dns asap", "ip range", "github gist", "mail server", "priority", "revalidate", "information", "thumbprint", "unicode text", "utf8 text", "dynamic etag" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv6": 5, "domain": 114, "IPv4": 18, "URL": 39, "email": 2, "hostname": 71, "FileHash-MD5": 6, "FileHash-SHA1": 8, "FileHash-SHA256": 44, "CIDR": 1, "CVE": 2 }, "indicator_count": 310, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "20 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69c4f8b131158f80e5e3d672", "name": "IDonTMIND", "description": "Here is the full text of the text line - IDonTMIND - that you don't have to be in crisis to text Crisis Text Line - and here is a full set of images< Redirects to: https://www.ualberta[.]ca/en/index.html // SSL certificate found: ualberta[.]ca and 239 more. Edmonton, Canada, University of Alberta. dnsmaster@ualberta.ca\neasyDNS Technologies Inc. Amazon ALB, Amazon Cloudfront, Apache HTTP Server, Bootstrap, Coveo, Crazy Egg, Facebook Pixel, Font Awesome, Google Analytics, Google Font API, jQuery, Linkedin Insight Tag, Microsoft Clarity, Open Graph, TikTok Pixel, Twitter Ads", "modified": "2025-04-19T04:02:16.037000", "created": "2025-03-20T04:38:57.551000", "tags": [ "as16509", "amazon02", "redirect", "as14618", "amazonaes", "search", "public", "home search", "live api", "blog docs", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "pcap processing", "ansi", "pcap", "gecko", "win64", "khtml", "windows nt", "brand", "prefetch8 ansi", "microsoft edge", "date", "cookie", "mozilla", "suspicious", "comspec", "window", "model", "hybrid", "accept", "hacked", "starfield", "encrypt", "close", "click", "twitter", "hosts", "service", "general", "path", "union", "dest", "strings", "contact" ], "references": [ "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43/67db93032dc368d2d80c3df1", "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca", "https://www.filescan.io/uploads/67db2f67b93e688233ef36e9/reports/7e4e4377-5eb9-48a7-848d-bfdca4fb244c/ioc", "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43", "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43/67db93032dc368d2d80c3df1", "https://viz.greynoise.io/analysis/5692e934-322f-48b9-bd9b-556e653ff5b6", "https://pulsedive.com/ioc/ualberta.ca" ], "public": 1, "adversary": "dosdean@ualberta[.]ca // ciso@ualberta[.]ca", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" } ], "industries": [ "Education", "Technology", "Government", "Agriculture", "Healthcare", "Chemical", "Finance", "Media" ], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 897, "domain": 37, "email": 34, "hostname": 396, "FileHash-MD5": 71, "FileHash-SHA1": 69, "FileHash-SHA256": 69, "SSLCertFingerprint": 23 }, "indicator_count": 1596, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "365 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6647908c09468f42bc1249f1", "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution", "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com", "modified": "2025-03-01T04:59:57.222000", "created": "2024-05-17T17:14:52.317000", "tags": [ "false", "true", "visible", "application", "microsoft teams", "microsoft azure", "office", "service", "dynamics", "hidden", "android", "explorer", "write", "connector", "test", "sharepoint", "live", "meister", "tools", "desktop", "spark", "front", "enterprise", "designer", "atlas", "premium", "assistant", "allow", "azureadmyorg", "game", "verify", "microsoft power", "channelsurfcli", "mtd1", "file transfer", "magnus", "microsoft crm", "youth" ], "references": [ "All - EnterpriseAppsList.csv", "AppRegistrationList.csv", "https://tria.ge/240517-vc7c1shc62/behavioral1", "https://tria.ge/240517-vdwb5shc71/behavioral1", "https://tria.ge/240517-vqxezaaa33/behavioral1", "https://tria.ge/240517-t9pc2ahb2t", "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary", "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb", "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7", "Thor Scan: S-I9VvMTB6cZU", "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview", "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview", "https://imp0rtp3.wordpress.com/2021/08/12/tetris/", "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview", "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview", "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview", "https://tria.ge/240521-q4s79agb25/static1", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093", "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview", "https://www.filescan.io/uploads/666d69ff6b8dba248b414767", "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3", "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b", "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2", "https://www.hudsonrock.com/search?domain=ualberta.ca", "https://www.criminalip.io/domain/report?scan_id=13798622", "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24", "https://urlscan.io/search/#ualberta.ca", "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs", "https://sitereport.netcraft.com/?url=http://ualberta.ca", "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/", "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll", "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark", "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22", "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22", "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22", "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Healthcare", "Telecommunications", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 7, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1703, "FileHash-SHA256": 90472, "URL": 99185, "domain": 82954, "hostname": 39041, "FileHash-SHA1": 1624, "email": 4658, "CVE": 12 }, "indicator_count": 319649, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "414 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "678dd7c763b29de06765fb52", "name": "hxxps://www[.]unitedconservative[.]ca/ - 01.19.25", "description": "Alberta UCP Compromise (i.e. potential evidence of active foreign interference).\n\nhttps://www.virustotal.com/graph/embed/g3fdc926b2208411e8b138e8bd7069b721b2586a3a1b3445aa4f70a932701ccbe?theme=dark", "modified": "2025-02-19T05:02:21.540000", "created": "2025-01-20T04:57:43.300000", "tags": [ "pentester", "javascript", "completed", "risk", "load", "web application", "firewall", "google search", "ssl certificate", "http", "create account", "critical", "malware", "virus", "trojan", "ransomware", "static", "analysis", "indicator of compromise", "ioc", "extraction", "emulation", "online", "submit", "sample", "download", "platform", "eci3", "eci4", "p1737345680749", "gaz1", "uaax86", "uab64", "sid1737345681", "sct1", "seg0", "nsi1", "url", "sandbox", "scanner", "reputation", "phishing", "hash", "miss", "eval", "first seen", "fastly", "gmt file", "linux x8664", "accept", "fingerprint", "loading", "path", "patch", "write", "vxstream", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please" ], "references": [ "https://app.pentester.com/scans/U2NhblR5cGU6NDcwNDM5Mw==", "https://www.filescan.io/uploads/678dca8c2d219e36112b2dd4/reports/1d6e1a12-c26b-4506-aeb4-a8f539b75bee/overview", "https://urlquery.net/report/0b60a80e-d3a5-4ca3-8644-190f32f28c65", "http://www.hybrid-analysis.com/sample/c047a23d603e9babce4db32175ecad13f5209027f24772908879d40bb392cefe", "https://www.virustotal.com/gui/url/6314e10278e55b5f02aa1f8e588ad7e20bf90534cd813c7eff24d261e8dc4250" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 734, "domain": 486, "email": 8, "hostname": 346, "FileHash-SHA256": 1814, "FileHash-MD5": 363, "FileHash-SHA1": 361, "SSLCertFingerprint": 24 }, "indicator_count": 4136, "is_author": false, "is_subscribing": null, "subscriber_count": 129, "modified_text": "424 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6665c84b687c5e16b95e8f8e", "name": "94.152.152.223 v65023.niebieski.net Cyber_Folks S.A. (vgt.pl)", "description": "SHA1 32223ade25c4a1d39cb8ac13042e8e6dfe3ca78f , SHA1 \n 99987c1ee1ddb7fd113abd65c836fbb71c3da4da\n Role: UPX , Ransomware , Trojan , Mirai , Buschido Mirai antywirusowe\nWin.Trojan.VBGeneric-6735875-0 , Robak:Win32/Mofksys.RND!MTB", "modified": "2024-12-31T01:53:43.222000", "created": "2024-06-09T15:20:43.178000", "tags": [ "expiration", "no expiration", "url http", "url https", "hostname", "domain", "ipv4", "filehashsha256", "fh no", "filehashmd5", "https odcisk", "palca jarma", "https dane", "v3 numer", "odcisk palca", "pl o", "unizeto", "sa ou", "urzd", "certum cn" ], "references": [ "https://viz.greynoise.io/analysis/f3d70a4f-14b1-4d26-8617-98d591", "https://viz.greynoise.io/analysis/a40cf3ce-d048-47c1-94b7-730b71", "https://viz.greynoise.io/analysis/4627bc3a-0238-4f2f-ad5c-c50527" ], "public": 1, "adversary": "TrojanDownloader:Win32/Nemucod", "targeted_countries": [ "Poland", "United States of America", "Germany", "Netherlands" ], "malware_families": [ { "id": "Serwer A Przed\u0142u\u017cenie sesji #{text} Wojcieszyce PL", "display_name": "Serwer A Przed\u0142u\u017cenie sesji #{text} Wojcieszyce PL", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1027.005", "name": "Indicator Removal from Tools", "display_name": "T1027.005 - Indicator Removal from Tools" }, { "id": "T1027.004", "name": "Compile After Delivery", "display_name": "T1027.004 - Compile After Delivery" }, { "id": "T1027.003", "name": "Steganography", "display_name": "T1027.003 - Steganography" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "T1027.001", "name": "Binary Padding", "display_name": "T1027.001 - Binary Padding" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1059.003", "name": "Windows Command Shell", "display_name": "T1059.003 - Windows Command Shell" }, { "id": "T1059.002", "name": "AppleScript", "display_name": "T1059.002 - AppleScript" }, { "id": "T1553.006", "name": "Code Signing Policy Modification", "display_name": "T1553.006 - Code Signing Policy Modification" }, { "id": "T1553.004", "name": "Install Root Certificate", "display_name": "T1553.004 - Install Root Certificate" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566.001", "name": "Spearphishing Attachment", "display_name": "T1566.001 - Spearphishing Attachment" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1055.011", "name": "Extra Window Memory Injection", "display_name": "T1055.011 - Extra Window Memory Injection" }, { "id": "T1055.008", "name": "Ptrace System Calls", "display_name": "T1055.008 - Ptrace System Calls" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1036.001", "name": "Invalid Code Signature", "display_name": "T1036.001 - Invalid Code Signature" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3205, "FileHash-SHA1": 2671, "FileHash-SHA256": 11469, "SSLCertFingerprint": 6, "URL": 5435, "domain": 1356, "email": 55, "hostname": 2205, "CVE": 13, "YARA": 4, "CIDR": 1, "IPv4": 25, "FileHash-IMPHASH": 1, "BitcoinAddress": 2, "IPv6": 13 }, "indicator_count": 26461, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "474 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66e47020bdbbc384d102d169", "name": "AWS Botnet *2nd L\u2070\u2070K \u00bb Quantum Fiber | Brute Forcer", "description": "I researched link again. Stealthy hackers surrounding a targets whereabouts in Denver Metro/Denver Proper (Co) and surrounding areas. Unsafe targeting activity escalates.\n\n*Tip { PDF:UrlMal-inf\\ [Trj] - https://www.quantumfiber.com/moving.html?utm_source=Digital&utm_medium=DV360_YouTube&utm_campaign=QuantumFiber_Residential_Prospecting&utm_content=Movers-RES-QF-Movers-ACH-OLV30-50-YouTube-NA&gclid=CjwKCAjwooq3BhB3Eiw } Malware Families:\nWin.Dropper.LokiBot-9975730-0\n#LowFiEnableDTContinueAfterUnpacking\n#LowFiMalf_gen\nALF:PUA:Block:IObit\nALF:Program:Win32/Webcompanion\nALF:Ransom:Win32/Babax\nALF:Trojan:Win32/FormBook\nAWS\nPDF:UrlMal-inf\\ [Trj]\nTrojan:Win32/Qbot\nTrojanDownloader:Win32/Upatre\nUnix\nUnix.Malware.Generic-9875933-0\nVirTool:Win32/Injector\nVirTool:Win32/Obfuscator\nWin.Dropper.LokiBot-9975730-0\nWin.Keylogger.Banbra-9936388-0\nWorm:Win32/Mofksys", "modified": "2024-10-13T13:01:27.179000", "created": "2024-09-13T17:02:24.806000", "tags": [ "namecheap", "server", "registrar abuse", "code", "dnssec", "email", "contact phone", "registrar iana", "registrar url", "registrar whois", "date", "vhash", "authentihash", "imphash", "ssdeep", "file type", "win32 exe", "magic pe32", "ms windows", "trid upx", "win16 ne", "generic", "packer", "info sections", "name virtual", "address virtual", "size raw", "size entropy", "md5 chi2", "upx0", "1 upx1", "upx2", "sysinternals", "zenbox", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "dynamic", "utc na", "utc facebook", "html info", "meta tags", "commerce cloud", "trackers google", "tag manager", "gtmkj5bfwx", "utc gtmp4hkt96", "utc gtm5z5w687v", "sample", "t1497", "sandbox evasion", "may sleep", "downloads", "http performs", "mitre att", "evasion ta0005", "upx software", "t1036 creates", "get http", "post http", "number", "ja3s", "algorithm", "subject", "data", "server ca", "odigicert inc", "cus lsan", "calls", "text", "passive dns", "urls", "scan endpoints", "all scoreblue", "url https", "http", "ip address", "related nids", "files location", "as8068", "united", "unknown", "ref b", "wed may", "entries", "mtb dec", "body", "please", "twitter", "malware", "trojan", "trojan features", "related pulses", "file samples", "files matching", "show", "search", "date hash", "next", "showing", "worm", "win32", "alf features", "aaaa", "cname", "united kingdom", "creation date", "certificate", "tlsv1", "oglobalsign", "stzhejiang", "lhangzhou", "oalibaba", "china", "encrypt", "copy", "write", "august", "local", "xport", "regsetvalueexa", "regdword", "regbinary", "medium", "high", "regsetvalueexw", "regsz", "langchinese", "delphi", "persistence", "execution", "read c", "create c", "msie", "windows nt", "wow64", "slcc2", "media center", "write c", "delete c", "mozilla", "as62597 nsone", "domain", "as20940", "as8075", "virtool", "whitelisted ip", "location united", "asn as8068", "registrar", "markmonitor", "tags", "related tags", "threat roundup", "october", "historical ssl", "referrer", "round", "december", "november", "guloader", "files", "detections file", "name file", "file size", "name", "html", "cab null", "ubuntu", "linux x8664", "contentlength", "gobrut", "malware c", "c request", "config", "meta", "photolan", "moved", "a domains", "as47748 daticum", "meta http", "content", "gmt server", "ipv4", "pragma", "apache", "sales", "expiration date", "name servers", "asnone bulgaria", "ns nxdomain", "nxdomain", "soa nxdomain", "cape", "gobrut malware", "suricata", "et malware", "bruter cnc", "checkin", "activity", "malware config", "yara detections", "contacted", "a li", "li ul", "div div", "set cookie", "as29873", "link", "hong kong", "as45102 alibaba", "div li", "gmt max", "age2592000 path", "log id", "gmtn", "tls web", "ca issuers", "timestamp", "b715", "b59bn timestamp", "false", "as2914 ntt", "record value", "data redacted", "as4230 claro", "invalid url", "research group", "as13768 aptum", "canada unknown", "canada", "hostpapa", "hosting", "click", "rdds service", "record", "registrant", "admin", "tech contact", "script domains", "as3257 gtt", "asnone canada", "access denied", "servers", "emails", "as397241", "as31898 oracle", "as397240", "overview ip", "flag united", "hostname", "files domain", "as15169 google", "as396982 google", "as16625 akamai", "as35994 akamai", "france", "discovery", "t1010", "t1012", "t1027", "information", "t1055", "injection", "t1057", "t1059", "ssh attacker", "mitm", "aitm", "tracker", "botnet", "binary", "ghostscript", "brendan coates", "daley", "trent wiltshire", "aws botnet", "filehashsha256", "filehashsha1", "filehashmd5", "https", "salitiy", "unix malware", "created", "url http", "unix", "aws", "role title", "added active", "report spam", "quantumfiber", "denver co", "critical", "default", "traditional", "compiler", "intel", "ms windows", "ssdeep", "rich pe", "imphash", "utc gtm5z5w687v", "utc gtmp4hkt96", "pecompact", "packer", "ids", "commerce cloud", "meta tags", "gmt etag", "accept encoding", "accept", "status", "west domains", "path", "author avatar", "active file", "denver", "vt graph", "currently", "im unaware", "pnpd5d", "susp", "filehash", "av detections", "pecompact", "february", "asnone germany", "as21499 host", "singapore", "germany", "object", "alerts", "icmp traffic", "createdate", "microsoft color", "msft", "format", "as44273 host", "content type", "kodak easyshare", "easyshare", "eastman kodak", "kodak", "kukacka", "virus", "rsdsr7siwwd d", "install", "service", "explorer", "windows", "name type", "md5 process", "sqlite", "sqlite version", "active", "pre crime", "cyber attack", "hackers", "quantum fiber", "quantumfiber.com", "target tsara brashears", "tech id", "hallrender", "brian sabey", "hijack", "spotify artists", "idlinea8 sep", "xo544", "xa10629", "sitegg", "fcolorffffff", "net1", "inhibit system", "oracle", "level 3" ], "references": [ "QuantumFiber.com a 2nd look", "Related Tags: https://www.virustotal.com/graph/embed/g17b255d00de64c0faa707968 [OG:dorkingbeauty | Cloned: StreaminingEx]", "13.107.21.200 Bat.Bing - Trojan:Win32/Qbot | ALF:Ransom:Win32/Babax | Worm:Win32/Mofksys | ALF:Program:Win32/Webcompanion", "IDS Detections: Win32.Lexip Checkin Unsupported/Fake FireFox Version 2.", "IDS Detections: Windows 98 User-Agent Detected - Possible Malware or Non-Updated System Unsupported/Fake Internet Explorer Version MSIE 5.", "Win.Dropper.LokiBot-9975730-0", "Win.Dropper.LokiBot-9975730-0 FileHash-SHA256 8f65d7817731cf1b7fada1be16d85464383813dd1f0388a933cec2abbeda4ba9", "IDS Detections: TLS Handshake Failure Yara Detections: Nullsoft_NSIS", "Alerts: network_icmp modifies_proxy_wpad multiple_useragents injection_resumethread", "Win.Keylogger.Banbra FileHash-SHA256 94517bb37a8ebe48a06a64b20237e287101bc93bbc840bf6e1ab7dfb28a2da5a", "Yara Detections: Delphi", "IDS Detections: Win32/Adware.Ymeta.A CnC Beacon Win32/Adware.Ymeta.A CnC Win32/Adware.Ymeta Variant Activity", "IDS Detections: Observed Suspicious UA (Mozilla/5.0) Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)", "Query to a *.top domain - Likely Hostile Query for .cc TLD", "Alerts: dead_host network_icmp nolookup_communication disables_proxy modifies_certificates modifies_proxy_wpad", "Alerts: ransomware_dropped_files ransomware_mass_file_delete antivm_vmware_in_instruction", "Unix.Malware.Generic: IDS Detections Generic.Go.Bruteforcer CnC Beacon Generic.Go.Bruteforcer Receiving Config", "Unix.Malware.Generic: Observed DNS Query for Israel Domain (.il) | Alerts: cape_detected_threat", "Unix.Malware.Generic: Yara Detections: is__elf , UPXProtectorv10x2 , UPX , ELFHighEntropy , ElfUPX , elf_empty_sections", "Unix.Malware.Generic:", "Unix.Malware.Generic:", "networkservice.exe: Matches rule SERVER-OTHER Spring Data Commons remote code execution attempt", "wallet.mewards.bing.com | https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net | wallpapers-nature.com", "Malware Families: Win.Dropper.LokiBot-9975730-0 #LowFiEnableDTContinueAfterUnpacking #LowFiMalf_gen Worm:Win32/Mofksys", "Malware Families: ALF:PUA:Block:IObit ALF:Program:Win32/Webcompanion ALF:Ransom:Win32/Babax Win.Keylogger.Banbra-9936388-0", "Malware Families: ALF:Trojan:Win32/FormBook AWS PDF:UrlMal-inf\\ [Trj] Trojan:Win32/Qbot Unix.Malware.Generic-9875933-0", "Malware Families: VirTool:Win32/Injector TrojanDownloader:Win32/Upatre Unix VirTool:Win32/Obfuscator Win.Dropper.LokiBot-9975730-0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win.Keylogger.Banbra-9936388-0", "display_name": "Win.Keylogger.Banbra-9936388-0", "target": null }, { "id": "#LowFiMalf_gen", "display_name": "#LowFiMalf_gen", "target": null }, { "id": "Trojan:Win32/Qbot", "display_name": "Trojan:Win32/Qbot", "target": "/malware/Trojan:Win32/Qbot" }, { "id": "ALF:Ransom:Win32/Babax", "display_name": "ALF:Ransom:Win32/Babax", "target": null }, { "id": "Worm:Win32/Mofksys", "display_name": "Worm:Win32/Mofksys", "target": "/malware/Worm:Win32/Mofksys" }, { "id": "ALF:Program:Win32/Webcompanion", "display_name": "ALF:Program:Win32/Webcompanion", "target": null }, { "id": "ALF:PUA:Block:IObit", "display_name": "ALF:PUA:Block:IObit", "target": null }, { "id": "Win.Dropper.LokiBot-9975730-0", "display_name": "Win.Dropper.LokiBot-9975730-0", "target": null }, { "id": "Win.Dropper.LokiBot-9975730-0", "display_name": "Win.Dropper.LokiBot-9975730-0", "target": null }, { "id": "VirTool:Win32/Obfuscator", "display_name": "VirTool:Win32/Obfuscator", "target": "/malware/VirTool:Win32/Obfuscator" }, { "id": "VirTool:Win32/Injector", "display_name": "VirTool:Win32/Injector", "target": "/malware/VirTool:Win32/Injector" }, { "id": "#LowFiEnableDTContinueAfterUnpacking", "display_name": "#LowFiEnableDTContinueAfterUnpacking", "target": null }, { "id": "Unix.Malware.Generic-9875933-0", "display_name": "Unix.Malware.Generic-9875933-0", "target": null }, { "id": "ALF:Trojan:Win32/FormBook", "display_name": "ALF:Trojan:Win32/FormBook", "target": null }, { "id": "Unix", "display_name": "Unix", "target": null }, { "id": "AWS", "display_name": "AWS", "target": null }, { "id": "TrojanDownloader:Win32/Upatre", "display_name": "TrojanDownloader:Win32/Upatre", "target": "/malware/TrojanDownloader:Win32/Upatre" }, { "id": "PDF:UrlMal-inf\\ [Trj]", "display_name": "PDF:UrlMal-inf\\ [Trj]", "target": null } ], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1529", "name": "System Shutdown/Reboot", "display_name": "T1529 - System Shutdown/Reboot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1428", "name": "Exploit Enterprise Resources", "display_name": "T1428 - Exploit Enterprise Resources" }, { "id": "T1098", "name": "Account Manipulation", "display_name": "T1098 - Account Manipulation" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1510", "name": "Clipboard Modification", "display_name": "T1510 - Clipboard Modification" }, { "id": "T1414", "name": "Capture Clipboard Data", "display_name": "T1414 - Capture Clipboard Data" }, { "id": "T1512", "name": "Capture Camera", "display_name": "T1512 - Capture Camera" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1644, "FileHash-SHA1": 1614, "FileHash-SHA256": 2742, "URL": 2708, "domain": 2150, "hostname": 2508, "email": 21, "SSLCertFingerprint": 33, "CVE": 2 }, "indicator_count": 13422, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "553 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66e36c33f59fedbb93c0179f", "name": "quantumfiber - Salitiy | CnC | Unix Malware - Hijacking | telejoint.net", "description": "Active file deletion. Exploring a tip re: suspected Denver superior hacker team believed related to malicious attacks on cyber crime victims and file deletion/deleted IoC's. Excellent tip. Related Tag: TrojanDownloader::Win32/Updatre VT graph cited in references link to pulse created by dorkingbeauty then cloned by streaminingex who cloned all pulses from a select group of multiple users on otx . alienvault] Currently , Im unaware of significance. Haven't researched enough to confirm if it is an AWS botnet. If successful targeted devices will be rebooted w/ software installation. \n\n *Tip { PDF:UrlMal-inf\\ [Trj] -https://www.quantumfiber.com/moving.html?utm_source=Digital&utm_medium=DV360_YouTube&utm_campaign=QuantumFiber_Residential_Prospecting&utm_content=Movers-RES-QF-Movers-ACH-OLV30-50-YouTube-NA&gclid=CjwKCAjwooq3BhB3Eiw }", "modified": "2024-10-12T22:02:49.628000", "created": "2024-09-12T22:33:23.698000", "tags": [ "as3356 level", "united", "passive dns", "urls", "tlds", "search", "scan endpoints", "all scoreblue", "alerts", "icmp traffic", "daley", "brendan coates", "trent wiltshire", "modifydate", "producer gpl", "ghostscript", "write", "malware", "format", "filehash", "av detections", "analysis date", "unknown", "pulse submit", "url analysis", "pnpd5d", "win32", "susp", "sha256", "pecompact", "packer", "pecompact2xx", "related tags", "ids", "kodak easyshare", "easyshare", "kodak", "kukacka", "virus", "rsdsr7siwwd d", "install", "service", "explorer", "historical ssl", "referrer", "gmt content", "utc na", "utc facebook", "html info", "meta tags", "commerce cloud", "trackers google", "tag manager", "gtmkj5bfwx", "utc gtmp4hkt96", "utc gtm5z5w687v", "vhash", "authentihash", "imphash", "rich pe", "ssdeep", "file type", "win32 exe", "magic pe32", "ms windows", "intel", "compiler", "traditional", "default", "brazilian", "simplified", "rtstring french", "korean", "dos exe", "dll english", "fish chinese", "jpeg jpg", "file size", "detections file", "name", "win32 dll", "files", "text", "b pe", "kb graph", "summary", "hashes c2ae", "capa", "microsoft", "zenbox", "flow t1574", "dll sideloading", "deletes", "t1055 allocates", "spawns", "binary", "t1497 contains", "may sleep", "performs dns", "inhibit system", "dns resolutions", "ip traffic", "trid upx", "yoda", "crypter", "delphi", "serial number", "algorithm", "thumbprint", "code signing", "from", "name comodo", "valid from", "signature", "ms13098", "issuer addtrust", "sections", "sha256 file", "type type", "chi2", "overlay chi2", "t1055 spawns", "sample", "t1497 allocates", "http performs", "downloads", "mitre att", "ta0003 hijack", "execution flow", "window", "msie", "windows nt", "number", "odigicert inc", "cndigicert sha2", "server ca", "cus cndigicert", "tls rsa", "ca1 odigicert", "accept", "high level", "hackers", "highly targeted", "cyber attack", "spotify artist", "gamers", "aws botnet", "precrime", "tracker", "yara", "united states", "mitm", "aitm", "domains contacted", "manjusaka", "no data", "tag count", "analyzer threat", "url summary", "ip summary", "samples", "detection list", "cyber threat", "engineering", "team phishing", "team", "team covid19", "ssh attacker", "proxy", "hostname", "malicious site", "installcore", "malicious", "fusioncore", "agent", "zeus", "zbot", "emotet", "download", "phishing", "nymaim", "cisco umbrella", "site", "alexa top", "million", "safe site", "malicious url", "maltiverse", "artemis", "bank", "dropper", "target tsara brashears", "target virustotal", "target otx alienvault", "javascript", "please", "domain", "creation date", "date", "status", "pulse pulses", "as44273 host", "record value", "nxdomain", "content type", "body", "files show", "date hash", "avast avg", "gmt server", "gmt etag", "accept encoding", "ipv4", "pragma", "name servers", "west domains", "ubuntu", "linux x8664", "contentlength", "show", "gobrut", "malware c", "c request", "encrypt", "config", "asnone germany", "singapore", "as21499 host", "germany", "object", "com cnt", "denver", "less see", "related pulses", "file samples", "files matching", "entries", "brian sabey", "quantumfiber.com", "quantum fiber", "man in the middle" ], "references": [ "https://www.quantumfiber.com/moving.html?utm_source=Digital&utm_medium=DV360_YouTube&utm_campaign=QuantumFiber_Residential_Prospecting&utm_content=Movers-RES-QF-Movers-ACH-OLV30-50-YouTube-NA&gclid=CjwKCAjwooq3BhB3Eiw", "PDF:UrlMal-inf\\ [Trj] FileHash-SHA256 30d8d75f9457b13b8e4802a6f5b2a6379616f5f2ddd0b5db18b503628a429be7", "Virus:Win32/Sality.AM FileHash-SHA256 538cd5aba2f96d17324b9063807a061424b921dcd6769afb210687d32276a2da", "TrojanDownloader:Win32/Upatre FileHash-SHA256 dbffd83df979087e6a896ddc069cb84e1cdae1cf3dccbebcc7b544778e3d76ae", "Related Tags: https://www.virustotal.com/graph/embed/g17b255d00de64c0faa707968", "Yara Detections: Ursnif_201904 , aPLib , PECompact_2xx , pecompact2 , PECompact2xxBitSumTechnologies , PECompactV2XBitsumTechnologies , PECompactv2xx", "wallpapers-nature.com | https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net", "Unix.Malware.Generic-9875933-0 | FileHash-SHA256 be1c1ee886185dff2b29ab84649484e3f01a9dfe303213ff9ce3f652aa98b2b9", "Unix.Malware.Generic-9875933-0 | High Priority Alert: cape_detected_threat", "Unix -Yara: is__elf , UPXProtectorv10x2 , UPX , ELFHighEntropy , ElfUPX , elf_empty_sections", "Unix -IDS Detections: Generic.Go.Bruteforcer CnC Beacon Generic.Go.Bruteforcer Receiving Config Observed", "telejoint.net" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1529", "name": "System Shutdown/Reboot", "display_name": "T1529 - System Shutdown/Reboot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [ "Civilian Society", "Telecommunications", "Technology" ], "TLP": "green", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1582, "FileHash-SHA1": 1096, "FileHash-SHA256": 2123, "URL": 1283, "domain": 857, "hostname": 1152, "email": 1, "CVE": 1, "SSLCertFingerprint": 11 }, "indicator_count": 8106, "is_author": false, "is_subscribing": null, "subscriber_count": 231, "modified_text": "554 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6683aae863ba601bac1a28b5", "name": "Zombie.A \u2022 Bayrob in fake malware information website.", "description": "Incredibly malicious IoC's found in a legitimate appearing website with informative information. Prominently appears at top of targets search results. \n https://www.blackberry.com/etc.clientlibs/bbcom/clientlibs/clientlib-etc-legacy/resources/cylance-web/global/bb-default-thumbnail-social.png\nMultiple government domains behind website. Honeypot?", "modified": "2024-08-01T06:03:26.298000", "created": "2024-07-02T07:23:20.582000", "tags": [ "ukraine", "referrer", "deploys fake", "uue files", "fsociety", "target colombia", "judiciary", "financial", "public", "tools", "sector", "mexico", "aka xloader", "html", "html info", "title", "meta tags", "google tag", "utc gnr5gzhd545", "utc na", "utc aw944900006", "utc linkedin", "formbook", "accept", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "apache", "so funny", "click", "urls", "passive dns", "http", "unique", "scan endpoints", "all octoseek", "url http", "ip address", "related nids", "code", "united", "as54113", "unknown", "aaaa", "as15169 google", "as46691", "status", "cname", "search", "whitelisted", "body", "date", "msil", "meta", "third-party-cookies", "iframes", "external-resources", "text/html", "trackers", "end game", "name servers", "select contact", "domain holder", "nexus category", "creation date", "showing", "date hash", "avast avg", "trojan", "mtb may", "dynamicloader", "high", "medium", "yara detections", "sniffs", "attempts", "alternate data", "stream", "a foreign", "cultureneutral", "get na", "show", "delete c", "entries", "cape", "delete", "default", "copy", "nivdort", "write", "trojanspy", "bayrob", "malware", "eagle eyed", "nonads", "path max", "age86400 set", "cookie", "script urls", "type", "script script", "win32 exe", "pe32", "intel", "ms windows", "ms visual", "win32 dynamic", "link library", "win16 ne", "pe32 compiler", "exe32", "compiler", "vs98", "contained", "simplified", "info compiler", "products", "sp6 build", "header intel", "name md5", "language", "not found", "rules not", "mitre", "info ids", "found sigma", "found", "files not", "found network", "getlasterror", "icons library", "os2 executable", "files", "file type", "kb file", "name", "type name", "ip detections", "country", "gandi sas", "dynadot", "enom", "namecheap", "dynadot inc", "namecheap inc", "dynadot llc", "domains", "tucows domains", "melbourne it", "historical ssl", "realteck audio", "problems", "lemon duck", "iocs", "sneaky server", "replacement", "unauthorized", "windows", "windir", "samplepath", "user", "process", "created", "shell commands", "windefend", "created bus", "tree", "registry keys", "reports upgrade", "keys set", "upgradestart", "dword", "data registry", "keys deleted", "reports", "get http", "request", "http requests", "ip traffic", "dns resolutions", "resolutions", "mitre att", "defense evasion", "ta0007 command", "control ta0011", "impact ta0034", "impact ta0040", "graph", "bundled files", "name file", "contacted ip", "users", "number", "ascii text", "crlf line", "database", "english", "tue jun", "installer", "template", "tulach", "rexxfield", "milesit", "cp", "self deleting", "stuff", "copying", "packages found", "targeting major", "injects ads", "into search", "results", "overlay", "text", "win32 dll", "javascript", "db2maestro", "open ports", "ipv4", "pulse submit", "url analysis", "expiration date", "hostname", "next", "ten process", "utc facebook", "utc google", "title ten", "blog meta", "tags", "elastic blog", "bing ads", "as8068", "certificate", "otx telemetry", "ref b", "record value", "emails", "please", "win32", "x msedge", "pulse pulses", "no data", "tag count", "analyzer threat", "url summary", "ip summary", "summary", "sample", "samples", "detection list", "blacklist", "cisco umbrella", "site", "alexa top", "safe site", "mail spammer", "million", "malware site", "phishing site", "malicious site", "bank", "fuery", "unsafe", "malicious", "alexa", "zbot", "asn as16625", "akamai", "less", "is2osecurity", "domain name", "active", "as21342", "domain", "location israel", "asn as1680", "invalid url", "body html", "head title", "title head", "body h1", "reference", "log id", "gmtn", "digicert tls", "rsa sha256", "tls web", "full name", "digicert inc", "organization", "district", "columbia", "false", "as20940", "as16625 akamai", "as8987 amazon", "moved", "as1680 cellcom", "alerts", "related pulses", "guard", "dynamic", "reads", "https link", "as8075", "record type", "ttl value", "redacted for", "privacy tech", "privacy admin", "postal code", "stateprovince", "server", "email", "office open", "ms word", "document", "xml document", "xml spreadsheet", "email trash", "rich text", "pdf tripwire", "fall", "whois lookups", "contact email", "blind eagle", "brian sabey" ], "references": [ "https://www.blackberry.com/etc.clientlibs/bbcom/clientlibs/clientlib-etc-legacy/resources/cylance-web/global/bb-default-thumbnail-social.png", "https://otx.alienvault.com/indicator/url/www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "ALF:JASYP:TrojanDownloader:Win32/Quireap!atmn: FileHash-MD5 da9b9e892ced7ec90841d813f6e42339", "ALF:JASYP:TrojanDownloader:Win32/Quireap!atmn: FileHash-SHA1 48dc18f70b2dfdf554e8247eb9e4a8910e19bd3b", "ALF:JASYP:TrojanDownloader:Win32/Quireap!atmn: FileHash-SHA256 215fbe9cf76ccbdde60eaa66538edeecadb844078b4379e66cacb83c7ac05690", "ALF:JASYP:TrojanDownloader:Win32/Quireap!atmn: FileHash-SHA256 18f62aec151e9f17c55987f80ed1244d9812895018d2bc931df083fb846a52dc", "Trojan:Win32/Zombie.A: FileHash-SHA256: 72bd98a9157afcd3ae38b60a7cf3ae4f23d6bb069a7aa7be7080b6967a6cf0cc", "Trojan:Win32/Zombie.A: FileHash-MD5: 36b71d23ca7553fb9db0730e56e6bf77", "Trojan:Win32/Zombie.A: FileHash-SHA1: 1fa3519b200cf5078c1c6c7df1cf44cd747c2320", "Alerts: creates_largekey script_created_process antisandbox_mouse_hook antivm_generic_disk dead_connect", "Alerts: infostealer_cookies infostealer_keylog persistence_ads suspicious_command_tools anomalous_deletefile", "IDS Detections: Terse HTTP 1.0 Request Possible Nivdort W32/Bayrob Attempted Checkin 403 Forbidden", "Alerts: cape_detected_threat cape_extracted_content", "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256\t3744b06ebb5465c1b3601abc9899e0448c3bb53e81ad6a3101780ab94931ba69", "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA1 ad560bee21bf7aefc1f1a1be2762d852c7301c07", "TrojanSpy:Win32/Nivdort.CW: FileHash-MD5\t9d6de961a498f831acb63c95e7b2ff0c", "Bayrob: FileHash-SHA256 3744b06ebb5465c1b3601abc9899e0448c3bb53e81ad6a3101780ab94931ba69", "Bayrob: FileHash-SHA1 ad560bee21bf7aefc1f1a1be2762d852c7301c07", "Bayrob: FileHash-MD5 871f1532a8f0f9cf9ec3e82b5da3a120", "Domains Contacted: bettercaught.net electricstrong.net recordtrouble.net electrictrouble.net recordpresident.net", "Domains Contacted: electricpresident.net recordcaught.net electriccaught.net streetstrong.net tradestrong.net", "https://otx.alienvault.com/indicator/file/72bd98a9157afcd3ae38b60a7cf3ae4f23d6bb069a7aa7be7080b6967a6cf0cc", "trojan.cosmu/xpiro - 960879004e1059a9e7eaca7b95f45ab9baf8f5b905e2714f1c65f92244396758", "Matches rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)", "Malware Behavior Catalog: Defense Evasion OB0006 \u2022 Delayed Execution B0003.003 \u2022 Move File C0063 \u2022 Process Environment Block B0001.019", "Malware Behavior Catalog: Dynamic Analysis Evasion B0003 \u2022 Create File C0016 \u2022 Create Process C0017 \u2022 Create Thread C0038", "Malware Behavior Catalog: Operating System OC0008 \u2022 Environment Variable C0034 \u2022 Self Deletion F0007 \u2022 : Tree Anti-Behavioral Analysis", "Malware Behavior Catalog: System Information Discovery E1082 \u2022 File and Directory Discovery E1083 \u2022 Execution OB0009 \u2022 File System OC0001", "Malware Behavior Catalog: COMSPEC Environment Variable F0007.001 \u2022 Install Additional Program B0023 \u2022 Delete File C0047 \u2022", "Malware Behavior Catalog: Tree Anti-Behavioral Analysis: C0017 Create Thread \u2022 C0038 Operating System \u2022 Debugger Detection B0001", "Malware Behavior Catalog: Get File Attributes C0049 \u2022 Set File Attributes C0050 \u2022 Read File C0051 \u2022 Writes File C0052", "Malware Behavior Catalog: Tree Anti-Behavioral: Environment Variable C0034 \u2022 Anti-Behavioral Analysis OB0001 \u2022 Process OC0003", "Bayrob: 3744b06ebb5465c1b3601abc9899e0448c3bb53e81ad6a3101780ab94931ba69 ef55e2c918f9678e97037d5505b0c8a3.virus", "Matches rule ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz", "Matches rule ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses", "Matches rule ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst", "Matches rule PROTOCOL-ICMP PING Windows Matches rule PROTOCOL-ICMP Unusual PING detected Matches rule PROTOCOL-ICMP", "http://Object.prototype.hasOwnProperty.call", "Tulach! It's been a minute - 114.114.114.114", "What's going on here judiciary? Karen - cisa.gov? e.final", "f.search schema.org t.final", "ACTIVE Emails: IS2OSecurity@hq.dhs.gov \u2022 CISA.GOV Status \u2022 schoolsafety.gov \u2022 power2prevent.gov \u2022 is2osecurity@hq.dhs.gov", "[https://cisa gov] https://otx.alienvault.com/indicator/ip/92.123.203.73 \u2022 https://otx.alienvault.com/indicator/hostname/hq.dhs.gov", "[cisa gov] https://otx.alienvault.com/indicator/domain/cisa.gov \u2022 [hq.dhs.gov] https://otx.alienvault.com/indicator/hostname/hq.dhs.gov", "[dhs gov] https://otx.alienvault.com/indicator/domain/dhs.gov \u2022 https://otx.alienvault.com/indicator/url/https:%2F%2Fwww.cisa.gov%2Fcybersecurity-advisories%2Fics-advisories.xml", "Alerts: (cisa gov) ransomware_file_modifications script_created_process antisandbox_mouse_hook antivm_generic_disk infostealer_cookies suspicious_command_tools antidebug_guardpages dynamic_function_loading reads_self stealth_window", "https://otx.alienvault.com/indicator/domain/asp.net \u2022 https://otx.alienvault.com/indicator/hostname/ts1.mm.bing.net", "Security Contact Email: 212d0c197dca818es@hq.dhs.gov \u2022ACTIVE Domain Name: DHS.GOV" ], "public": 1, "adversary": "Blind Eagle", "targeted_countries": [ "United States of America", "Colombia", "Netherlands", "Israel" ], "malware_families": [ { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Trojan:Win32/Zombie.A", "display_name": "Trojan:Win32/Zombie.A", "target": "/malware/Trojan:Win32/Zombie.A" }, { "id": "ALF:JASYP:TrojanDownloader:Win32/Quireap!atmn", "display_name": "ALF:JASYP:TrojanDownloader:Win32/Quireap!atmn", "target": null }, { "id": "TrojanSpy:Win32/Nivdort.CW", "display_name": "TrojanSpy:Win32/Nivdort.CW", "target": "/malware/TrojanSpy:Win32/Nivdort.CW" }, { "id": "Bayrob", "display_name": "Bayrob", "target": null }, { "id": "trojan.bayrob/lazy", "display_name": "trojan.bayrob/lazy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "TA0029", "name": "Privilege Escalation", "display_name": "TA0029 - Privilege Escalation" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0030", "name": "Defense Evasion", "display_name": "TA0030 - Defense Evasion" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "T1007", "name": "System Service Discovery", "display_name": "T1007 - System Service Discovery" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1055.003", "name": "Thread Execution Hijacking", "display_name": "T1055.003 - Thread Execution Hijacking" }, { "id": "T1415", "name": "URL Scheme Hijacking", "display_name": "T1415 - URL Scheme Hijacking" }, { "id": "T1416", "name": "URI Hijacking", "display_name": "T1416 - URI Hijacking" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1167, "FileHash-SHA1": 738, "FileHash-SHA256": 3074, "URL": 1019, "domain": 1639, "hostname": 973, "email": 11, "SSLCertFingerprint": 2 }, "indicator_count": 8623, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "626 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66536c8eee8d42d670e27723", "name": "Eternal Blue _ WannaCry MS17-010 | Apple iOS iMessage injection infiltration", "description": "", "modified": "2024-06-25T16:05:26.604000", "created": "2024-05-26T17:08:30.022000", "tags": [ "sha256", "sha1", "pattern match", "ascii text", "document file", "v2 document", "crlf line", "size", "unicode", "beginstring", "null", "hybrid", "refresh", "body", "span", "local", "click", "strings", "error", "tools", "look", "verify", "restart", "contact", "external-resources", "dom-modification", "third-party-cookies", "iframes", "trackers", "text/html", "twitter", "final url", "ip address", "status code", "body length", "kb body", "headers", "deny", "express", "referrer", "impacting azure", "proofpoint", "sneaky server", "replacement", "unauthorized", "switch dns", "query", "vy binh", "hiddentear", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "date", "meta", "form", "submission", "expiresthu", "path", "secure", "self", "xcitium verdict", "cloud", "sophos", "history first", "analysis", "cp", "cyber", "threat", "redrum", "hit", "men", "triangulation", "historical ssl", "apt suspects", "critical cmd", "hide", "asyncrat", "jeremy", "government", "malicious", "yuming", "name servers", "united", "passive dns", "urls", "creation date", "search", "expiration date", "showing", "unknown", "next", "windows nt", "malware beacon", "memcommit", "generic http", "exe upload", "outbound", "etpro trojan", "show", "trojan", "copy", "write", "win32", "malware", "read c", "entries", "medium", "markus", "contentlength", "write c", "delete c", "create c", "yara detections", "scan endpoints", "all scoreblue", "filehash", "pulse pulses", "av detections", "ids detections", "alerts", "analysis date", "file score", "next pe", "as32934", "hitmen", "local government", "scene unit", "crime", "denver police", "address", "status", "aaaa", "apple", "less whois", "registrar", "wannacry", "http", "unique", "url https", "related nids", "code", "screenshot", "anity", "nsa", "shadow", "saudi telecom", "riyadh address", "saudi arabia", "abuse", "ripe", "company isp", "number", "label saudi", "telecom company", "jsc regional", "riyadh", "ripe ncc", "registry techc", "campus", "saudi", "ripe network", "domain", "internet se", "emails", "system", "server tsa", "b server", "certificate", "digicert inc", "moved", "record value" ], "references": [ "http://x.com/denverpolice/status/", "Redirects to >https://twitter.com/x/migrate?tok=eyJlIjoiL2RlbnZlcnBvbGljZS9zdGF0dXMvIiwidCI6MTcxNjcwMzc3M33oZya0EO4PtEbRwq4XZboX", "Redirects to https://twitter.com?mx=1", "IP address: 104.244.42.1 Hosting: Unknown Running on: Tsa B CMS: Express", "Crouching Yeti: Appendixes - according to source ArcSight Threat Intelligence", "https://otx.alienvault.com/indicator/file/00001aff2ea1acd6087f9fba8d8316d90d29e391d9969bc70cc607461467797e", "Alerts: nids_malware_alert network_icmp dumped_buffer network_cnc_http network_http network_http_post allocates_rwx", "Alerts: packer_entropy packer_upx antivm_memory_available pe_features", "Yara Detections: Yara Detections Nrv2x , UPX_OEP_place , UPX_Modified_Or_Inside , UPX20030XMarkusOberhumerLaszloMolnarJohnReiser , UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , Toxoplasmosis , UPX", "Packer UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]", "Yara Detections: ConventionEngine_Term_Desktop , LZMA , mpress_2_xx_x86 , dbgdetect_procs", "pornhub.dev, http://matrix.pornhub.dev, https://twitter.com/PORNO_SEXYBABES, https://www.anon-v.com/porno/fenella/", "Hostname device-local-fb18804d-348e-49ea-8c17-cc8a29f18082.remotewd.com | 192.168.56.104: IPv4", "https://otx.alienvault.com/indicator/file/f7636eef1d9df0664cd0f205ad8864b659bf9898ce6231376778c4411986912e", "https://otx.alienvault.com/indicator/file/000054fa2b0d1004464350ee9acc40707fec51223dba36c702a3db4139af9717", "Domain: hicloudcam.com | https://otx.alienvault.com/indicator/hostname/alarmeu.sslproxy.gatewayvvlilly3lilly.alpha.hicloudcam.com", "originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com | 108.160.165.139 Location: USA |ASN AS19679 dropbox inc. Nameservers ns-136.awsdns-17.com. ns-1518.awsdns-61.org. ,\u00a0 ns-1573.awsdns-04.co.uk. ,\u00a0 ns-809.awsdns-37.net. Less WHOIS Registrar: https://www.101domain.com/,\u00a0\u00a0 Creation Date: Oct 21, 2010 Related Pulses None Related Tags None Indicator Facts Running webserver External Resources Whois,\u00a0 UrlVoid,\u00a0 VirusTotal Analysis Related Pulses Comments (0) Whois Show 100 entr", "https://otx.alienvault.com/indicator/hostname/originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com", "PATHETIC redirect: rainn.org | victims of violence & abuse disclose extremely sensitive details. Reported false information given to disorient victims.", "WannaCry | NSA -Anity Cert: https://otx.alienvault.com/indicator/url/https://www.antiy.com/response/Antiy_Wannacry_NSA.html", "WannaCry MS17-010 'Shadow' https://otx.alienvault.com/otxapi/indicators/url/screenshot/https://www.antiy.com/response/wannacry.html", "Command and Control IP: 5.41.21.250 | Location Saudi Arabia flag Jeddah, Saudi Arabia ASN AS39891 saudi telecom company jsc", "m.pornsexer.xxx.3.1.adiosfil.roksit.net", "uploads-cserver-alumni-profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win32/Vflooder.B Checkin", "display_name": "Win32/Vflooder.B Checkin", "target": null }, { "id": "Win.Malware.Vtflooder-6723768-0", "display_name": "Win.Malware.Vtflooder-6723768-0", "target": null }, { "id": "Win32:Trojan-gen", "display_name": "Win32:Trojan-gen", "target": null }, { "id": "Win32/Vflooder.B vtapi DOS", "display_name": "Win32/Vflooder.B vtapi DOS", "target": null }, { "id": "Win32:Malware-gen", "display_name": "Win32:Malware-gen", "target": null }, { "id": "Win.Trojan.Downloader-63174", "display_name": "Win.Trojan.Downloader-63174", "target": null }, { "id": "Clicker.BGOU", "display_name": "Clicker.BGOU", "target": null }, { "id": "Win.Trojan.Agent-752791", "display_name": "Win.Trojan.Agent-752791", "target": null }, { "id": "Win.Dropper.QQpass-9895638-0", "display_name": "Win.Dropper.QQpass-9895638-0", "target": null }, { "id": "Trojan:Win32/QQpass", "display_name": "Trojan:Win32/QQpass", "target": "/malware/Trojan:Win32/QQpass" }, { "id": "WannaCry", "display_name": "WannaCry", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1038", "name": "DLL Search Order Hijacking", "display_name": "T1038 - DLL Search Order Hijacking" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1470", "name": "Obtain Device Cloud Backups", "display_name": "T1470 - Obtain Device Cloud Backups" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1094", "name": "Custom Command and Control Protocol", "display_name": "T1094 - Custom Command and Control Protocol" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" } ], "industries": [], "TLP": "green", "cloned_from": "66536881127f5ee988306394", "export_count": 55, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 350, "FileHash-SHA1": 348, "FileHash-SHA256": 2659, "URL": 7850, "domain": 2245, "hostname": 3611, "SSLCertFingerprint": 4, "email": 10, "CIDR": 4 }, "indicator_count": 17081, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "663 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66536881127f5ee988306394", "name": "iOS Attack - Crouching Yeti: http://x.com/denverpolice/status/|", "description": "Targeted triangulation. Apple iOS iPad. Attack chains of Operation Triangulation involves advanced tactics employed by those acting as secret middleman, deploying spoofed trusted websites, emails, alarming news stories, messages, Bluetooth hacking, if threat actor has full CnC of targets phone via injection (sometimes it's random) can power on B/T. In Spoofed sites, malicious redirects, iMessage 0day case. Zero-click iMessage exploit seen. Information is sent to attacker and stored. Data harvesting, financial & identity theft, service modification and DoS intended. Used by law enforcement, governments, attorney PI's, cyber security defense, red teams and/or malicious hackers.\n*Crouching Yeti threat description notes: Contextual Indicators: Domain is classified as Social Networking Contextual Indicators: The URL is known benign by Check Point's Threat Cloud Contextual Indicators: Https://x.com is popular among websites with good reputation Contextual Indicators: Domain Cisco Umbrella rank is 312.", "modified": "2024-06-25T16:05:26.604000", "created": "2024-05-26T16:51:13.962000", "tags": [ "sha256", "sha1", "pattern match", "ascii text", "document file", "v2 document", "crlf line", "size", "unicode", "beginstring", "null", "hybrid", "refresh", "body", "span", "local", "click", "strings", "error", "tools", "look", "verify", "restart", "contact", "external-resources", "dom-modification", "third-party-cookies", "iframes", "trackers", "text/html", "twitter", "final url", "ip address", "status code", "body length", "kb body", "headers", "deny", "express", "referrer", "impacting azure", "proofpoint", "sneaky server", "replacement", "unauthorized", "switch dns", "query", "vy binh", "hiddentear", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "date", "meta", "form", "submission", "expiresthu", "path", "secure", "self", "xcitium verdict", "cloud", "sophos", "history first", "analysis", "cp", "cyber", "threat", "redrum", "hit", "men", "triangulation", "historical ssl", "apt suspects", "critical cmd", "hide", "asyncrat", "jeremy", "government", "malicious", "yuming", "name servers", "united", "passive dns", "urls", "creation date", "search", "expiration date", "showing", "unknown", "next", "windows nt", "malware beacon", "memcommit", "generic http", "exe upload", "outbound", "etpro trojan", "show", "trojan", "copy", "write", "win32", "malware", "read c", "entries", "medium", "markus", "contentlength", "write c", "delete c", "create c", "yara detections", "scan endpoints", "all scoreblue", "filehash", "pulse pulses", "av detections", "ids detections", "alerts", "analysis date", "file score", "next pe", "as32934", "hitmen", "local government", "scene unit", "crime", "denver police", "address", "status", "aaaa", "apple", "less whois", "registrar", "wannacry", "http", "unique", "url https", "related nids", "code", "screenshot", "anity", "nsa", "shadow", "saudi telecom", "riyadh address", "saudi arabia", "abuse", "ripe", "company isp", "number", "label saudi", "telecom company", "jsc regional", "riyadh", "ripe ncc", "registry techc", "campus", "saudi", "ripe network", "domain", "internet se", "emails", "system", "server tsa", "b server", "certificate", "digicert inc", "moved", "record value" ], "references": [ "http://x.com/denverpolice/status/", "Redirects to >https://twitter.com/x/migrate?tok=eyJlIjoiL2RlbnZlcnBvbGljZS9zdGF0dXMvIiwidCI6MTcxNjcwMzc3M33oZya0EO4PtEbRwq4XZboX", "Redirects to https://twitter.com?mx=1", "IP address: 104.244.42.1 Hosting: Unknown Running on: Tsa B CMS: Express", "Crouching Yeti: Appendixes - according to source ArcSight Threat Intelligence", "https://otx.alienvault.com/indicator/file/00001aff2ea1acd6087f9fba8d8316d90d29e391d9969bc70cc607461467797e", "Alerts: nids_malware_alert network_icmp dumped_buffer network_cnc_http network_http network_http_post allocates_rwx", "Alerts: packer_entropy packer_upx antivm_memory_available pe_features", "Yara Detections: Yara Detections Nrv2x , UPX_OEP_place , UPX_Modified_Or_Inside , UPX20030XMarkusOberhumerLaszloMolnarJohnReiser , UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , Toxoplasmosis , UPX", "Packer UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]", "Yara Detections: ConventionEngine_Term_Desktop , LZMA , mpress_2_xx_x86 , dbgdetect_procs", "pornhub.dev, http://matrix.pornhub.dev, https://twitter.com/PORNO_SEXYBABES, https://www.anon-v.com/porno/fenella/", "Hostname device-local-fb18804d-348e-49ea-8c17-cc8a29f18082.remotewd.com | 192.168.56.104: IPv4", "https://otx.alienvault.com/indicator/file/f7636eef1d9df0664cd0f205ad8864b659bf9898ce6231376778c4411986912e", "https://otx.alienvault.com/indicator/file/000054fa2b0d1004464350ee9acc40707fec51223dba36c702a3db4139af9717", "Domain: hicloudcam.com | https://otx.alienvault.com/indicator/hostname/alarmeu.sslproxy.gatewayvvlilly3lilly.alpha.hicloudcam.com", "originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com | 108.160.165.139 Location: USA |ASN AS19679 dropbox inc. Nameservers ns-136.awsdns-17.com. ns-1518.awsdns-61.org. ,\u00a0 ns-1573.awsdns-04.co.uk. ,\u00a0 ns-809.awsdns-37.net. Less WHOIS Registrar: https://www.101domain.com/,\u00a0\u00a0 Creation Date: Oct 21, 2010 Related Pulses None Related Tags None Indicator Facts Running webserver External Resources Whois,\u00a0 UrlVoid,\u00a0 VirusTotal Analysis Related Pulses Comments (0) Whois Show 100 entr", "https://otx.alienvault.com/indicator/hostname/originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com", "PATHETIC redirect: rainn.org | victims of violence & abuse disclose extremely sensitive details. Reported false information given to disorient victims.", "WannaCry | NSA -Anity Cert: https://otx.alienvault.com/indicator/url/https://www.antiy.com/response/Antiy_Wannacry_NSA.html", "WannaCry MS17-010 'Shadow' https://otx.alienvault.com/otxapi/indicators/url/screenshot/https://www.antiy.com/response/wannacry.html", "Command and Control IP: 5.41.21.250 | Location Saudi Arabia flag Jeddah, Saudi Arabia ASN AS39891 saudi telecom company jsc", "m.pornsexer.xxx.3.1.adiosfil.roksit.net", "uploads-cserver-alumni-profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win32/Vflooder.B Checkin", "display_name": "Win32/Vflooder.B Checkin", "target": null }, { "id": "Win.Malware.Vtflooder-6723768-0", "display_name": "Win.Malware.Vtflooder-6723768-0", "target": null }, { "id": "Win32:Trojan-gen", "display_name": "Win32:Trojan-gen", "target": null }, { "id": "Win32/Vflooder.B vtapi DOS", "display_name": "Win32/Vflooder.B vtapi DOS", "target": null }, { "id": "Win32:Malware-gen", "display_name": "Win32:Malware-gen", "target": null }, { "id": "Win.Trojan.Downloader-63174", "display_name": "Win.Trojan.Downloader-63174", "target": null }, { "id": "Clicker.BGOU", "display_name": "Clicker.BGOU", "target": null }, { "id": "Win.Trojan.Agent-752791", "display_name": "Win.Trojan.Agent-752791", "target": null }, { "id": "Win.Dropper.QQpass-9895638-0", "display_name": "Win.Dropper.QQpass-9895638-0", "target": null }, { "id": "Trojan:Win32/QQpass", "display_name": "Trojan:Win32/QQpass", "target": "/malware/Trojan:Win32/QQpass" }, { "id": "WannaCry", "display_name": "WannaCry", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1038", "name": "DLL Search Order Hijacking", "display_name": "T1038 - DLL Search Order Hijacking" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1470", "name": "Obtain Device Cloud Backups", "display_name": "T1470 - Obtain Device Cloud Backups" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1094", "name": "Custom Command and Control Protocol", "display_name": "T1094 - Custom Command and Control Protocol" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 48, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 350, "FileHash-SHA1": 348, "FileHash-SHA256": 2659, "URL": 7850, "domain": 2245, "hostname": 3611, "SSLCertFingerprint": 4, "email": 10, "CIDR": 4 }, "indicator_count": 17081, "is_author": false, "is_subscribing": null, "subscriber_count": 230, "modified_text": "663 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65fc4d4c24f2000879921be5", "name": "The Org : FormBook CnC | Pykspa", "description": "Front Facing Description: 'TheOrg' (https://theorg.com) The Org\nThe Org is an online professional community platform. It helps organizations get more exposure externally and operate more efficiently internally. | efficiently internally | Nefarious scheme? Unclear. Possible visa, immigration scheme. | Pykspa is a piece of malware that can be used to remotely control infected systems. It also enables attackers to. download other malware or extract personal data. || Dark. | Score 100% Falcon Sandbox | Evasive. Moved permanently 03/21/2024 | FormBook is an infostealer of browser cached credentials , screenshots, keystrokes. | Tags auto populated", "modified": "2024-04-20T14:04:02.366000", "created": "2024-03-21T15:07:56.415000", "tags": [ "q https", "https", "enablement", "org log", "sign", "contact", "right person", "explore", "start", "grafana labs", "ogilvy", "figma", "find", "apollo", "http", "span", "learn", "html", "expiry", "form", "label", "youtube video", "linkedin", "input", "pixel", "legend", "cookie", "march", "de indicators", "domains", "hashes", "gmbh version", "status page", "service privacy", "legal", "impressum", "reverse dns", "general full", "url https", "protocol h2", "security tls", "united", "resource", "asn16509", "amazon02", "name value", "main", "ssl certificate", "whois record", "whois whois", "resolutions", "threat roundup", "communicating", "referrer", "subdomains", "historical ssl", "collections", "june", "february", "blister", "cobalt strike", "phishing", "formbook", "contacted", "ip check", "adult content", "divergent", "hacktool", "copy", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers age", "cachecontrol", "connection", "tsara brashears", "malicious", "life", "core", "dns replication", "date", "win32 exe", "files", "detections type", "name", "wininit", "office open", "xml document", "qiwi hack", "android", "mgeinteg", "html info", "title", "org meta", "tags viewport", "org twitter", "org og", "the org", "utc google", "tag manager", "g5nxq655fgp", "domain", "search", "status", "scan endpoints", "all scoreblue", "hostname", "pulse pulses", "passive dns", "urls", "bhagam bhag", "home screen", "entries", "createdate", "title bhagam", "select xmp", "filehash", "malware", "format", "unknown", "meta", "as44273 host", "creation date", "moved", "encrypt", "district", "body", "window", "hall law", "a domains", "script urls", "datalayer", "registrar", "next", "accept encoding", "showing", "yara rule", "http host", "worm", "high", "possible", "win32", "bits", "cname", "as396982 google", "redacted for", "expiration date", "div div", "as26710 icann", "script domains", "citadel", "indonesia", "get updates", "write c", "create c", "read c", "show", "default", "common upatre", "upatre", "downloader", "zeus", "write", "execution", "regsetvalueexa", "regdword", "module load", "dock", "persistence", "as54113", "github pages", "formbook cnc", "checkin", "lowfi", "class", "trojan", "accept", "visa scheme", "mtb feb", "mtb jan", "romeo scheme", "exploitation", "pattern match", "command decode", "mitre att", "suricata ipv4", "ck id", "show technique", "ck matrix", "suricata udpv4", "facebook", "hybrid", "general", "model", "comspec", "click", "strings", "footer", "michelle", "nora", "hallrender", "name servers", "record value", "emails", "servers", "found", "gmt content", "error", "code", "men", "man", "woman", "hit", "sreredrum", "honey client", "hiv", "threat", "paste", "iocs", "urls https", "malicious site", "phishing site", "blockchain", "unsafe", "malware site", "malicious url", "phishtank", "cyber threat", "artemis", "asyncrat", "team", "cisco umbrella", "site", "safe site", "heur", "million", "xrat", "downldr", "union", "bank", "gvt google video transcoding", "malvertizing", "targeting", "target", "yandex dropper extend", "remote procedure call", "identity_helper.exe", "cookie bot" ], "references": [ "https://theorg.com", "Ransom: CVE-2023-4966", "Ransom: ransomed.vc", "FormBook: a4ec4c6ea1c92e2e6.awsglobalaccelerator.com", "Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel | 103.246.145.111", "Malware: 0a6e883228a04a6e8738511a6210914dea1773d88cf57950c83e092f02c7f3bf - Other:Malware-gen\\ [Trj]", "Yara Detections invalid_trailer_structure , multiple_versions", "Malware Hosting IP addresses: 141.193.213.20 | 185.199.108.153| 185.199.110.153 | 185.199.111.153", "https://otx.alienvault.com/indicator/url/https://theorg.com/_next/data/Gh7c6NpBHZESb74aisPB8/org/springboard-collaborative.json?companySlug=springboard-collaborative", "Scanning host: 31.214.178.54 , 37.152.88.54", "Yara Detections: vad_contains_network_strings information | HackToolWin32Patch CodeOverlap | PWSWin32Phorex CodeOverlap", "Yara: TrojanDropperWin32Ropest | CodeOverlap TrojanWin32Gatsorm | CodeOverlap TrojanWinNTConficker | CodeOverlap Alerts: WormWin32Pykspa", "Aspnet collect: https://otx.alienvault.com/otxapi/indicators/file/screenshot/000444cc67b97f45f11e1fdf89ad8f5127c87aa858fe151fa9c4975276f53b42", "development.digitalphotogallery.com _YandexDropperExtend", "Emotet: FileHash-MD5 bafae95c36402dfc1ea5fa04523e4e81", "Emotet: FileHash-SHA256 db9d59b0f192c91f8ecf939c415b3252b13b0fb052d4a66ceefb80dfb43d6e8a |", "Emotet: FileHash-SHA1\t19c14ab0aaab2c1dd922f0baca3cf64056f80acc", "thevisafirm.com | Immigration Lawyers Capital Immigration Lawyers Green Card Lawyer [ London, DC] malicious", "www.hallinjurylaw.com |\tMinneapolis Personal Injury Lawyer Personal Injury Law Experts", "Malvertizing, Phishing, Botnet PWD: https://pin.it/ | https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | www.pornhub.com", "Phishing, Botnet PWD:https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing | https://www.sweetheartvideo.com/tsara-brashears/ | www.sweetheartvideo.com", "https://hybrid-analysis.com/sample/ac09d7f6b26675a529a366b47bc09b3fd776576fb099c020f57204ff7b4ea31c", "CVE-2007-3896 | CVE-2023-22518 | CVE-2023-4966", "jpocxaar1---r3---sn-jpocxaa-a03e.gvt1.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "United Kingdom of Great Britain and Northern Ireland" ], "malware_families": [ { "id": "FormBook", "display_name": "FormBook", "target": null }, { "id": "Win32:Renos-KY\\ [Trj]", "display_name": "Win32:Renos-KY\\ [Trj]", "target": null }, { "id": "Win.Worm.Pykspa-1", "display_name": "Win.Worm.Pykspa-1", "target": null }, { "id": "Worm:Win32/Pykspa.C", "display_name": "Worm:Win32/Pykspa.C", "target": "/malware/Worm:Win32/Pykspa.C" }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Ransom", "display_name": "Ransom", "target": null }, { "id": "ApolloLocker", "display_name": "ApolloLocker", "target": null }, { "id": "TrojanDropper:Win32", "display_name": "TrojanDropper:Win32", "target": null }, { "id": "Other:Malware-gen\\ [Trj]", "display_name": "Other:Malware-gen\\ [Trj]", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1059.006", "name": "Python", "display_name": "T1059.006 - Python" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [ "Media", "Immigration", "Technology", "Government" ], "TLP": "green", "cloned_from": null, "export_count": 55, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4567, "domain": 2576, "hostname": 1212, "FileHash-SHA256": 3836, "FileHash-MD5": 744, "FileHash-SHA1": 724, "CVE": 5, "email": 9, "SSLCertFingerprint": 1 }, "indicator_count": 13674, "is_author": false, "is_subscribing": null, "subscriber_count": 232, "modified_text": "729 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65b80a20bbcd0eb305a740ec", "name": "Exodus l Cellbrite | Brian Sabey | HallRender | Tulach", "description": "", "modified": "2024-02-16T05:03:15.321000", "created": "2024-01-29T20:27:12.899000", "tags": [ "ssl certificate", "network", "malware", "whois record", "contacted", "pegasus", "resolutions", "communicating", "sa victim", "assaulter", "quasar", "brian sabey", "go.sabey", "ioc search", "new ioc", "teams api", "contact", "threat analyzer", "threat", "paste", "iocs", "urls https", "samples", "united", "aaaa", "status", "susp", "search", "passive dns", "urls", "domain", "creation date", "date", "next", "show", "domain related", "feeds ioc", "maltiverse", "analyze", "scan endpoints", "all octoseek", "url https", "pulse pulses", "http", "ip address", "related nids", "files location", "all search", "otx octoseek", "hostname", "pulse submit", "url analysis", "files", "china unknown", "as4134 chinanet", "unknown", "name servers", "showing", "namesilo", "domain name", "dynadot llc", "as8075", "script urls", "netherlands", "a domains", "capture", "asnone united", "record value", "expiration date", "entries", "cname", "tulach", "algorithm", "v3 serial", "number", "key algorithm", "key identifier", "subject key", "identifier", "x509v3 key", "usage", "x509v3 extended", "info", "first", "server", "available from", "iana id", "registrar abuse", "registrar url", "registrar whois", "abuse contact", "email", "registry domain", "code", "win32 exe", "ufed iphone", "cellebrite ufed", "setup", "tjprojmain", "ufed4pc", "win32 dll", "detections type", "name", "responder", "exodus", "android", "office open", "xml document", "cellebrite", "type name", "pdf cellebrite", "ufed release", "cellbrite", "privilege https", "targets sa", "survivor", "getprocaddress", "indicator", "prefetch8", "mitre att", "ck id", "show technique", "ck matrix", "file", "pattern match", "observed email", "path", "factory", "hybrid", "general", "model", "comspec", "click", "title", "page", "body doctype", "quoth", "raven", "gmt content", "type", "vary", "accept", "october", "december", "copy", "execution", "awful", "referrer", "april", "kimsuky", "malicious", "crypto", "startpage", "hacktool", "installer", "tofsee", "historical ssl", "threat roundup", "phishing", "utc submissions", "submitters", "csc corporate", "domains", "twitter", "dropbox", "incapsula", "summary iocs", "graph community", "registrarsafe", "gandi sas", "google llc", "amazon02", "google", "akamaias", "facebook", "service", "patch", "namecheapnet", "cloudflarenet", "amazonaes", "gmo internet", "apple", "tsara brashears", "keylogger" ], "references": [ "https://tulach.cc/", "cellebrite.com | https://cellebrite.com/en/federal-government/", "https://www.pornhub.com/video/search?search=tsara+brashears", "https://twitter.com/PORNO_SEXYBABES", "hanmail.net", "114.114.114.114", "work.a-poster.info", "www-stage40.pornhub.com", "go.sabey.com", "sabey.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Exodus", "display_name": "Exodus", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "PWS:Win32/Raven", "display_name": "PWS:Win32/Raven", "target": "/malware/PWS:Win32/Raven" }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null }, { "id": "VirTool:Win32/Tofsee", "display_name": "VirTool:Win32/Tofsee", "target": "/malware/VirTool:Win32/Tofsee" } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" } ], "industries": [], "TLP": "white", "cloned_from": "65a76c2901b34c79a681596d", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4101, "FileHash-MD5": 322, "FileHash-SHA1": 296, "FileHash-SHA256": 3155, "domain": 2894, "hostname": 2847, "CVE": 2, "email": 9, "SSLCertFingerprint": 2 }, "indicator_count": 13628, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "793 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65a77c6a22a236495c4548d6", "name": "PEGASUS | Exodus l Cellbrite | Brian Sabey | HallRender | Tulach", "description": "I'm unclear if the legitimatecy of use of Cellbrite considering Brashears was the attacked. Brashears has spoken with every authority on her own terms. Law enforcement 'you're not that important. You're not a suspect .' FBI -' Brashears victim of Identity theft case that lasted months. Alleged false reports removed.' PI's - 'someone is abusing privilege' Was a SA advocate Non Profit. Awareness Saves & social media deleted by hackers", "modified": "2024-02-16T05:03:15.321000", "created": "2024-01-17T07:06:18.453000", "tags": [ "ssl certificate", "network", "malware", "whois record", "contacted", "pegasus", "resolutions", "communicating", "sa victim", "assaulter", "quasar", "brian sabey", "go.sabey", "ioc search", "new ioc", "teams api", "contact", "threat analyzer", "threat", "paste", "iocs", "urls https", "samples", "united", "aaaa", "status", "susp", "search", "passive dns", "urls", "domain", "creation date", "date", "next", "show", "domain related", "feeds ioc", "maltiverse", "analyze", "scan endpoints", "all octoseek", "url https", "pulse pulses", "http", "ip address", "related nids", "files location", "all search", "otx octoseek", "hostname", "pulse submit", "url analysis", "files", "china unknown", "as4134 chinanet", "unknown", "name servers", "showing", "namesilo", "domain name", "dynadot llc", "as8075", "script urls", "netherlands", "a domains", "capture", "asnone united", "record value", "expiration date", "entries", "cname", "tulach", "algorithm", "v3 serial", "number", "key algorithm", "key identifier", "subject key", "identifier", "x509v3 key", "usage", "x509v3 extended", "info", "first", "server", "available from", "iana id", "registrar abuse", "registrar url", "registrar whois", "abuse contact", "email", "registry domain", "code", "win32 exe", "ufed iphone", "cellebrite ufed", "setup", "tjprojmain", "ufed4pc", "win32 dll", "detections type", "name", "responder", "exodus", "android", "office open", "xml document", "cellebrite", "type name", "pdf cellebrite", "ufed release", "cellbrite", "privilege https", "targets sa", "survivor", "getprocaddress", "indicator", "prefetch8", "mitre att", "ck id", "show technique", "ck matrix", "file", "pattern match", "observed email", "path", "factory", "hybrid", "general", "model", "comspec", "click", "title", "page", "body doctype", "quoth", "raven", "gmt content", "type", "vary", "accept", "october", "december", "copy", "execution", "awful", "referrer", "april", "kimsuky", "malicious", "crypto", "startpage", "hacktool", "installer", "tofsee", "historical ssl", "threat roundup", "phishing", "utc submissions", "submitters", "csc corporate", "domains", "twitter", "dropbox", "incapsula", "summary iocs", "graph community", "registrarsafe", "gandi sas", "google llc", "amazon02", "google", "akamaias", "facebook", "service", "patch", "namecheapnet", "cloudflarenet", "amazonaes", "gmo internet", "remote", "malvertizing", "spying", "cyber stalking" ], "references": [ "https://tulach.cc/", "go.sabey.com", "sabey.com", "cellebrite.com", "https://cellebrite.com/en/federal-government/ [Pegasus ck privilege collection]", "https://www.pornhub.com/video/search?search=tsara+brashears", "remote.aciscomputers.com", "https://track.toccha.com/978eb025-0a62-46fa-827c-d71aa0524818?zoneid=5939372&ua=high&subzone_id=3038557&set=social&country=SY®ion=49&isp=syriatelmobiletelecom&useragent=Mozilla/5.0", "114.114.114.114 [Tulach]", "nr-data.net [Apple Private Data Collection]", "defenselawyernj.com", "attorney-marketing-specialists.com ?", "https://itunes.apple.com/app/apple-store/id284815942/us/app/image-recognition-and-searcher/id1450230225", "http://www.apple.com/appleca/AppleIncRootCertificate.cer", "http://flexlucky.com/isurvey/en/?devicemodel=iPhone&carrier=\u00aeion=Tbilisi&brand=Apple&browser=GoogleApp&prize=cur&u=track.bawiwia.com&isp=JSCGlobalErty&ts=29900ce7-726c-4c9f-b0c3-21ff2f859648&country=GE&click_id=wuo4jm6db011lufu2f8h138c&partner=5658402&skip=yes&frame={frame}&cost=0.010100&lang=en", "https://t.me/hermitspyware/24", "hyundai-smg.com | http://hyundai-smg.com/index.php?route=information/contact | http://hyundai-smg.com/index.php?route=information/contact", "https://imazing.com/guides/detect-pegasus-and-other-spyware-on-iphone", "http://watchhers.net/index.php [remote attackers | malware spreader]", "api-stage.pornhub.com", "newbrazzers.com [y8.com]", "www.videolan.org [info solutions]", "www2.blackbagtech.com [hidden users included]", "http://subtitles.rest7.com/subs/The.Expanse.S03E11.720p.HDTV.x264-KILLERS[eztv].mkv", "http://pegasus.diskel.co.uk/ [phishing]", "wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language", "fds.cellebrite.com", "http://www1.mychartahn.org/?tm=1&subid4=1671014887.0191400000&kw=Patient+Portal&KW1=Patient+Access+Network&KW2=Patient+Self+Check+In+System&KW3=Electronic+Health+Record+EHR+System&KW4=Patient+Appointment+Scheduling+System&KW5=Medical+Billing+System+Software&KW6=Patient+Financial+Assistance&searchbox=0&domainname=0&backfill=0", "healthcare.greatcall.com [fake call centers | PHI & PII info stealers]", "http://download.virtualbox.org/virtualbox/debian", "match.pegasus.isi.edu", "asp.net", "http://dropbox.com/ [ intrusions/ dropbox stealer]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Exodus", "display_name": "Exodus", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Sabey", "display_name": "Sabey", "target": null }, { "id": "VirTool:Win32/Tofsee", "display_name": "VirTool:Win32/Tofsee", "target": "/malware/VirTool:Win32/Tofsee" }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null }, { "id": "PWS:Win32/Raven", "display_name": "PWS:Win32/Raven", "target": "/malware/PWS:Win32/Raven" }, { "id": "Trojan:Win32/Comspec", "display_name": "Trojan:Win32/Comspec", "target": "/malware/Trojan:Win32/Comspec" }, { "id": "HallRender", "display_name": "HallRender", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1588.004", "name": "Digital Certificates", "display_name": "T1588.004 - Digital Certificates" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1546.015", "name": "Component Object Model Hijacking", "display_name": "T1546.015 - Component Object Model Hijacking" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" } ], "industries": [ "Individual", "Patient", "Healthcare", "Survivor" ], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4101, "FileHash-MD5": 322, "FileHash-SHA1": 296, "FileHash-SHA256": 3157, "domain": 2903, "hostname": 2847, "CVE": 2, "email": 9, "SSLCertFingerprint": 2 }, "indicator_count": 13639, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "793 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65a76c2901b34c79a681596d", "name": "Exodus l Cellbrite | Brian Sabey | HallRender | Tulach", "description": "Brian Sabey of Hall Render Law firm is incredibly entrenched in spying on a single target. Having made contact,impersonal invitations to meet, filing a lawsuit dismissed by a judge , paying to silence SA victim and spending many years spying, destroying digital profile m libel, malvertizing is concerning. \nConsidering Brashears death threats, following , being approached and attempts on her personal safety is unwarranted. Brashears was the confirmed victim of life threatening SA. How does the Federal Government allow this? Found embedded in Brashears link that came from her iPhone.", "modified": "2024-02-16T05:03:15.321000", "created": "2024-01-17T05:56:57.948000", "tags": [ "ssl certificate", "network", "malware", "whois record", "contacted", "pegasus", "resolutions", "communicating", "sa victim", "assaulter", "quasar", "brian sabey", "go.sabey", "ioc search", "new ioc", "teams api", "contact", "threat analyzer", "threat", "paste", "iocs", "urls https", "samples", "united", "aaaa", "status", "susp", "search", "passive dns", "urls", "domain", "creation date", "date", "next", "show", "domain related", "feeds ioc", "maltiverse", "analyze", "scan endpoints", "all octoseek", "url https", "pulse pulses", "http", "ip address", "related nids", "files location", "all search", "otx octoseek", "hostname", "pulse submit", "url analysis", "files", "china unknown", "as4134 chinanet", "unknown", "name servers", "showing", "namesilo", "domain name", "dynadot llc", "as8075", "script urls", "netherlands", "a domains", "capture", "asnone united", "record value", "expiration date", "entries", "cname", "tulach", "algorithm", "v3 serial", "number", "key algorithm", "key identifier", "subject key", "identifier", "x509v3 key", "usage", "x509v3 extended", "info", "first", "server", "available from", "iana id", "registrar abuse", "registrar url", "registrar whois", "abuse contact", "email", "registry domain", "code", "win32 exe", "ufed iphone", "cellebrite ufed", "setup", "tjprojmain", "ufed4pc", "win32 dll", "detections type", "name", "responder", "exodus", "android", "office open", "xml document", "cellebrite", "type name", "pdf cellebrite", "ufed release", "cellbrite", "privilege https", "targets sa", "survivor", "getprocaddress", "indicator", "prefetch8", "mitre att", "ck id", "show technique", "ck matrix", "file", "pattern match", "observed email", "path", "factory", "hybrid", "general", "model", "comspec", "click", "title", "page", "body doctype", "quoth", "raven", "gmt content", "type", "vary", "accept", "october", "december", "copy", "execution", "awful", "referrer", "april", "kimsuky", "malicious", "crypto", "startpage", "hacktool", "installer", "tofsee", "historical ssl", "threat roundup", "phishing", "utc submissions", "submitters", "csc corporate", "domains", "twitter", "dropbox", "incapsula", "summary iocs", "graph community", "registrarsafe", "gandi sas", "google llc", "amazon02", "google", "akamaias", "facebook", "service", "patch", "namecheapnet", "cloudflarenet", "amazonaes", "gmo internet", "apple", "tsara brashears", "keylogger" ], "references": [ "https://tulach.cc/", "cellebrite.com | https://cellebrite.com/en/federal-government/", "https://www.pornhub.com/video/search?search=tsara+brashears", "https://twitter.com/PORNO_SEXYBABES", "hanmail.net", "114.114.114.114", "work.a-poster.info", "www-stage40.pornhub.com", "go.sabey.com", "sabey.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Exodus", "display_name": "Exodus", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "PWS:Win32/Raven", "display_name": "PWS:Win32/Raven", "target": "/malware/PWS:Win32/Raven" }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null }, { "id": "VirTool:Win32/Tofsee", "display_name": "VirTool:Win32/Tofsee", "target": "/malware/VirTool:Win32/Tofsee" } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4101, "FileHash-MD5": 322, "FileHash-SHA1": 296, "FileHash-SHA256": 3155, "domain": 2894, "hostname": 2847, "CVE": 2, "email": 9, "SSLCertFingerprint": 2 }, "indicator_count": 13628, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "793 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "658ca4d09e86f0f3f107eeec", "name": "USBank: Phishing and Frauds | CNC | Quasar RAT ", "description": "", "modified": "2024-01-26T07:01:23.551000", "created": "2023-12-27T22:27:28.593000", "tags": [ "no expiration", "filehashsha256", "ipv4", "hostname", "expiration", "filehashmd5", "domain", "filehashsha1", "url http", "iocs", "next", "url https", "scan endpoints", "all octoseek", "create new", "pulse use", "pdf report", "pcap", "analyzer", "hackers", "hacktool", "hijacker", "tsara brashears", "hallrender", "lazarus", "win64", "usbank", "webp", "critical", "contacted", "octoseek", "command_and_control", "comspec", "copy", "core", "critical", "dangerous", "apple", "briannsabey breadcrumbs", "ck id", "cobalt strike", "bot", "bot network", "resolutions", "renos", "referrer", "model", "mitre att", "monitoring", "quasar rat", "ransomware", "networm", "open path", "pattern match", "payload", "powershell", "command_and_control", "exploit", "tracking", "cybercrime", "T1622 - Debugger Evasion", "cracked", "installer", "apple", "banking", "parking payload", "factory", "gpt analyzer", "teams", "localappdata", "breadcrumbs" ], "references": [ "onlinebanking.usbank.com.blackboxconstruction.com.ph", "https://www.hallrender.com/attorney/brian-sabey/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Worm.Mimail", "display_name": "Worm.Mimail", "target": null }, { "id": "Win32:Pitou-C [Rtk]", "display_name": "Win32:Pitou-C [Rtk]", "target": null }, { "id": "W32/Bagle.RC.worm", "display_name": "W32/Bagle.RC.worm", "target": null }, { "id": "Trojan:VBS/Renos", "display_name": "Trojan:VBS/Renos", "target": "/malware/Trojan:VBS/Renos" }, { "id": "Trojan:BAT/Gamaredon", "display_name": "Trojan:BAT/Gamaredon", "target": "/malware/Trojan:BAT/Gamaredon" }, { "id": "Trojan-Ransom.Win32.Blocker.xhaw", "display_name": "Trojan-Ransom.Win32.Blocker.xhaw", "target": null }, { "id": "Trojan-Downloader.Win32.Upatre", "display_name": "Trojan-Downloader.Win32.Upatre", "target": null }, { "id": "Trj/CI.A", "display_name": "Trj/CI.A", "target": null }, { "id": "Android:Agent-OVB [Trj]", "display_name": "Android:Agent-OVB [Trj]", "target": null }, { "id": "Artemis", "display_name": "Artemis", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Comspec", "display_name": "Comspec", "target": null }, { "id": "Dark Power", "display_name": "Dark Power", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "HallRender", "display_name": "HallRender", "target": null }, { "id": "Kzmiutmy", "display_name": "Kzmiutmy", "target": null }, { "id": "Lazarus", "display_name": "Lazarus", "target": null }, { "id": "LolKek", "display_name": "LolKek", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "Swisyn", "display_name": "Swisyn", "target": null } ], "attack_ids": [ { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1600", "name": "Weaken Encryption", "display_name": "T1600 - Weaken Encryption" } ], "industries": [], "TLP": "white", "cloned_from": "658bd8f63a1e4c5a38ce44e4", "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 192, "FileHash-MD5": 72, "FileHash-SHA1": 66, "FileHash-SHA256": 380, "domain": 115, "hostname": 220, "CVE": 4 }, "indicator_count": 1049, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "814 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "658bd8f63a1e4c5a38ce44e4", "name": "USBank: Phishing and Frauds | Command and Control |", "description": "", "modified": "2024-01-26T07:01:23.551000", "created": "2023-12-27T07:57:42.725000", "tags": [ "no expiration", "filehashsha256", "ipv4", "hostname", "expiration", "filehashmd5", "domain", "filehashsha1", "url http", "iocs", "next", "url https", "scan endpoints", "all octoseek", "create new", "pulse use", "pdf report", "pcap", "analyzer", "hackers", "hacktool", "hijacker", "tsara brashears", "hallrender", "lazarus", "win64", "usbank", "webp", "critical", "contacted", "octoseek", "command_and_control", "comspec", "copy", "core", "critical", "dangerous", "apple", "briannsabey breadcrumbs", "ck id", "cobalt strike", "bot", "bot network", "resolutions", "renos", "referrer", "model", "mitre att", "monitoring", "quasar rat", "ransomware", "networm", "open path", "pattern match", "payload", "powershell", "command_and_control", "exploit", "tracking", "cybercrime", "T1622 - Debugger Evasion", "cracked", "installer", "apple", "banking", "parking payload", "factory", "gpt analyzer", "teams", "localappdata", "breadcrumbs" ], "references": [ "onlinebanking.usbank.com.blackboxconstruction.com.ph", "https://www.hallrender.com/attorney/brian-sabey/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Worm.Mimail", "display_name": "Worm.Mimail", "target": null }, { "id": "Win32:Pitou-C [Rtk]", "display_name": "Win32:Pitou-C [Rtk]", "target": null }, { "id": "W32/Bagle.RC.worm", "display_name": "W32/Bagle.RC.worm", "target": null }, { "id": "Trojan:VBS/Renos", "display_name": "Trojan:VBS/Renos", "target": "/malware/Trojan:VBS/Renos" }, { "id": "Trojan:BAT/Gamaredon", "display_name": "Trojan:BAT/Gamaredon", "target": "/malware/Trojan:BAT/Gamaredon" }, { "id": "Trojan-Ransom.Win32.Blocker.xhaw", "display_name": "Trojan-Ransom.Win32.Blocker.xhaw", "target": null }, { "id": "Trojan-Downloader.Win32.Upatre", "display_name": "Trojan-Downloader.Win32.Upatre", "target": null }, { "id": "Trj/CI.A", "display_name": "Trj/CI.A", "target": null }, { "id": "Android:Agent-OVB [Trj]", "display_name": "Android:Agent-OVB [Trj]", "target": null }, { "id": "Artemis", "display_name": "Artemis", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Comspec", "display_name": "Comspec", "target": null }, { "id": "Dark Power", "display_name": "Dark Power", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "HallRender", "display_name": "HallRender", "target": null }, { "id": "Kzmiutmy", "display_name": "Kzmiutmy", "target": null }, { "id": "Lazarus", "display_name": "Lazarus", "target": null }, { "id": "LolKek", "display_name": "LolKek", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "Swisyn", "display_name": "Swisyn", "target": null } ], "attack_ids": [ { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1600", "name": "Weaken Encryption", "display_name": "T1600 - Weaken Encryption" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 192, "FileHash-MD5": 72, "FileHash-SHA1": 66, "FileHash-SHA256": 380, "domain": 115, "hostname": 220, "CVE": 4 }, "indicator_count": 1049, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "814 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6564fa9a3d90d1cd14928b16", "name": "Lumma \u2022 University of Alberta \"No Problems\" | T1036 - Masquerading", "description": "I was contacted on this forum re: University of Alberta issue. Based on research www.ualberta.ca redirects. There hasn't been a research effort for redirect. I researched a spoofed website. After viewing senders request, my devices operating system changed, isn't recognized by any accounts, keyloggers.\nFound: Anonymizers, Redirector, Masquerading, Network RAT, Serious Social Engineering, Botnetwork Army, Stealers, Lumma and weirdly targeted 'Tsara Brashears' as a malicious link on a spoofed University in Canada, UCHealth Colorado links.", "modified": "2023-12-27T19:03:02.665000", "created": "2023-11-27T20:22:50.050000", "tags": [ "threat report", "back", "ip summary", "url summary", "summary", "download csv", "download", "json url", "urls", "detection list", "cisco umbrella", "site", "heur", "safe site", "alexa top", "million", "malware", "malicious site", "phishing site", "malicious url", "phishing", "riskware", "presenoker", "artemis", "agent", "unsafe", "opencandy", "ursnif", "wacatac", "team", "facebook", "runescape", "service", "downldr", "psexec", "occamy", "brontok", "zpevdo", "startpage", "nanocore", "keygen", "installcore", "fareit", "secrisk", "exploit", "mimikatz", "sorano", "emotet", "genkryptik", "fuery", "dbatloader", "qakbot", "alexa", "malicious", "union", "lumma stealer", "fusioncore", "cleaner", "azorult", "bank", "blacknet rat", "stealer", "iframe", "trojanspy", "analysis", "united", "firehol", "proxy", "mail spammer", "downloader", "malware site", "meterpreter", "qbot", "bankerx", "dropper", "nimda", "formbook", "swrort", "unruy", "adwind", "trojanx", "crack", "win64", "generic", "dnspionage", "expirestue", "path", "http response", "final url", "ip address", "status code", "body length", "kb body", "sha256", "headers", "alberta", "university", "edmonton", "html info", "alberta meta", "tags", "trackers google", "tag manager", "gtmkr32", "blacklist", "low risk", "apache", "domain", "malware found", "unknown", "minimal low", "security risk", "medium high", "critical", "protect", "college", "mtis", "faculties", "research", "health", "a about", "news", "events", "sport", "life", "find", "story", "tools", "getprocaddress", "indicator", "prefetch8", "mitre att", "ck id", "show technique", "ck matrix", "pattern match", "file", "date", "factory", "hybrid", "general", "cookie", "click", "strings", "djin", "no data", "tag count", "sample", "samples", "netsky", "cobalt strike", "xrat", "fakealert", "raccoon", "redline stealer", "metastealer", "icedid", "quasar rat", "acint", "anonymizer", "blockchain", "social engineering", "read c", "search", "show", "medium", "entries", "whitelisted", "memcommit", "delete", "yara detections", "next", "dock", "write", "execution", "copy", "south carolina", "federal credit", "team proxy", "static engine", "covid19", "redirector", "suspic", "tue mar", "zbot", "size68b type", "count blacklist", "tag tag", "rejected sample", "icon", "analyzed", "hwp support", "falcon sandbox", "multi scan", "update", "view details", "upgrade", "blacklist https", "keyloggers" ], "references": [ "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (iPhone unlocker)", "uchealth.com", "http://michaela.young@uchealth.com", "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf", "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx", "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Qakbot", "display_name": "Qakbot", "target": null }, { "id": "MimiKatz", "display_name": "MimiKatz", "target": null }, { "id": "RedLine Stealer", "display_name": "RedLine Stealer", "target": null }, { "id": "Network RAT", "display_name": "Network RAT", "target": null }, { "id": "Quasar RAT", "display_name": "Quasar RAT", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null }, { "id": "Raccoon", "display_name": "Raccoon", "target": null }, { "id": "OpenCandy", "display_name": "OpenCandy", "target": null }, { "id": "Meterpreter", "display_name": "Meterpreter", "target": null }, { "id": "Unruy", "display_name": "Unruy", "target": null }, { "id": "TrojanX", "display_name": "TrojanX", "target": null }, { "id": "BlackNET RAT", "display_name": "BlackNET RAT", "target": null }, { "id": "Brontok", "display_name": "Brontok", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1588", "name": "Obtain Capabilities", "display_name": "T1588 - Obtain Capabilities" }, { "id": "T1588.004", "name": "Digital Certificates", "display_name": "T1588.004 - Digital Certificates" }, { "id": "T1546.015", "name": "Component Object Model Hijacking", "display_name": "T1546.015 - Component Object Model Hijacking" }, { "id": "T1126", "name": "Network Share Connection Removal", "display_name": "T1126 - Network Share Connection Removal" }, { "id": "T1136", "name": "Create Account", "display_name": "T1136 - Create Account" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.003", "name": "Mail Protocols", "display_name": "T1071.003 - Mail Protocols" }, { "id": "T1518.001", "name": "Security Software Discovery", "display_name": "T1518.001 - Security Software Discovery" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1134.004", "name": "Parent PID Spoofing", "display_name": "T1134.004 - Parent PID Spoofing" } ], "industries": [ "Education", "Healthcare" ], "TLP": "white", "cloned_from": null, "export_count": 83, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 320, "FileHash-SHA1": 172, "FileHash-SHA256": 4302, "URL": 8243, "CIDR": 1, "domain": 1742, "hostname": 2270, "CVE": 18, "SSLCertFingerprint": 3, "email": 4 }, "indicator_count": 17075, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "844 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65612df1531ea0c35d79b1f4", "name": "BlackNET RAT | CIArmyTracking: http://dev.findatoyota.com/", "description": "Source: http://dev.findatoyota.com/\ntracking, vehicle tracking, mobile phone tracking, active threat , warbot, target tracking, tracking targeted associates, network, cyber stalking, boomrmq string, malvertizing\n\n\nResource: https://www.hybrid-analysis.com/sample/ea8a341cbd3666af7bfce260d86b465844314d86faba75c80eab3ce4d3bc3b45", "modified": "2023-12-24T22:02:36.942000", "created": "2023-11-24T23:12:49.909000", "tags": [ "adgroupid", "x350", "lwii", "ejan", "kfrontier", "qkvt0tvj ejan", "eja ota", "njii", "mqkvt0tvj ejan", "eqkoatlvqia", "unknown", "expiration", "no expiration", "url https", "url http", "iocs", "vj101", "slc1", "scan endpoints", "all octoseek", "create new", "uw1600", "uh1200", "next", "pulse use", "searchbox0", "kwwikipedia", "bit64", "oswindows", "cardstandard", "pack", "kw1download", "qchlemail no", "bit32bit", "ver9", "from", "mpass", "num0", "dig0", "kbetu1", "maxads0", "kld1040", "opnslfp1", "downloader", "pdf report", "clickid", "price", "campaignid", "domain", "text", "hostname", "aufffdufffd", "hostname xn", "pcap", "filehashsha256", "stix", "filehashmd5", "filehashsha1" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 805, "URL": 9065, "hostname": 3080, "FileHash-MD5": 1373, "domain": 1190, "FileHash-SHA256": 3468, "email": 6, "CIDR": 4, "CVE": 12 }, "indicator_count": 19003, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "847 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656e19dfeee6ead11dc6354e", "name": "BlackNET RAT | CIArmyTracking: http://dev.findatoyota.com/", "description": "", "modified": "2023-12-24T22:02:36.942000", "created": "2023-12-04T18:26:39.448000", "tags": [ "adgroupid", "x350", "lwii", "ejan", "kfrontier", "qkvt0tvj ejan", "eja ota", "njii", "mqkvt0tvj ejan", "eqkoatlvqia", "unknown", "expiration", "no expiration", "url https", "url http", "iocs", "vj101", "slc1", "scan endpoints", "all octoseek", "create new", "uw1600", "uh1200", "next", "pulse use", "searchbox0", "kwwikipedia", "bit64", "oswindows", "cardstandard", "pack", "kw1download", "qchlemail no", "bit32bit", "ver9", "from", "mpass", "num0", "dig0", "kbetu1", "maxads0", "kld1040", "opnslfp1", "downloader", "pdf report", "clickid", "price", "campaignid", "domain", "text", "hostname", "aufffdufffd", "hostname xn", "pcap", "filehashsha256", "stix", "filehashmd5", "filehashsha1" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "65612df2a7b287c614a94f94", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 805, "URL": 9065, "hostname": 3080, "FileHash-MD5": 1373, "domain": 1190, "FileHash-SHA256": 3468, "email": 6, "CIDR": 4, "CVE": 12 }, "indicator_count": 19003, "is_author": false, "is_subscribing": null, "subscriber_count": 230, "modified_text": "847 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65612df2a7b287c614a94f94", "name": "BlackNET RAT | CIArmyTracking: http://dev.findatoyota.com/", "description": "Source: http://dev.findatoyota.com/\ntracking, vehicle tracking, mobile phone tracking, active threat , warbot, target tracking, tracking targeted associates, network, cyber stalking, boomrmq string, malvertizing\n\n\nResource: https://www.hybrid-analysis.com/sample/ea8a341cbd3666af7bfce260d86b465844314d86faba75c80eab3ce4d3bc3b45", "modified": "2023-12-24T22:02:36.942000", "created": "2023-11-24T23:12:50.158000", "tags": [ "adgroupid", "x350", "lwii", "ejan", "kfrontier", "qkvt0tvj ejan", "eja ota", "njii", "mqkvt0tvj ejan", "eqkoatlvqia", "unknown", "expiration", "no expiration", "url https", "url http", "iocs", "vj101", "slc1", "scan endpoints", "all octoseek", "create new", "uw1600", "uh1200", "next", "pulse use", "searchbox0", "kwwikipedia", "bit64", "oswindows", "cardstandard", "pack", "kw1download", "qchlemail no", "bit32bit", "ver9", "from", "mpass", "num0", "dig0", "kbetu1", "maxads0", "kld1040", "opnslfp1", "downloader", "pdf report", "clickid", "price", "campaignid", "domain", "text", "hostname", "aufffdufffd", "hostname xn", "pcap", "filehashsha256", "stix", "filehashmd5", "filehashsha1" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 805, "URL": 9065, "hostname": 3080, "FileHash-MD5": 1373, "domain": 1190, "FileHash-SHA256": 3468, "email": 6, "CIDR": 4, "CVE": 12 }, "indicator_count": 19003, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "847 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570919b6b36a151ea6d7cbe", "name": "Hillary.ua", "description": "", "modified": "2023-12-06T15:22:03.664000", "created": "2023-12-06T15:22:03.664000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 470, "FileHash-SHA256": 1292, "domain": 207, "URL": 1298, "CIDR": 19, "FileHash-MD5": 195, "FileHash-SHA1": 1 }, "indicator_count": 3482, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657090f1cc164d76aeb361ce", "name": "www.iceland.co.uk - Oh dear looks like dom takeover", "description": "", "modified": "2023-12-06T15:19:13.349000", "created": "2023-12-06T15:19:13.349000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 285, "FileHash-SHA256": 934, "domain": 89, "URL": 716, "FileHash-MD5": 41, "email": 1 }, "indicator_count": 2066, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708ea5a3214f63e1d6d94f", "name": "lumen.me Honeybadger", "description": "", "modified": "2023-12-06T15:09:25.749000", "created": "2023-12-06T15:09:25.749000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 475, "hostname": 315, "domain": 233, "URL": 1133 }, "indicator_count": 2156, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c1c5e2cc4dfe8d0ed97", "name": "CPANEL-TUCOWS \u2014malware hosting", "description": "", "modified": "2023-12-06T14:58:36.254000", "created": "2023-12-06T14:58:36.254000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 815, "hostname": 3487, "domain": 1182, "URL": 10194, "FileHash-MD5": 3, "FileHash-SHA1": 1 }, "indicator_count": 15682, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707fe93d9d2c85eb7d457f", "name": "Obama.org 03.02.22", "description": "", "modified": "2023-12-06T14:06:33.765000", "created": "2023-12-06T14:06:33.765000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 551, "FileHash-SHA256": 2008, "domain": 187, "URL": 888, "CIDR": 21, "FileHash-MD5": 63, "FileHash-SHA1": 1 }, "indicator_count": 3719, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63011c808c89bad2a1b8914c", "name": "Hillary.ua", "description": "", "modified": "2022-09-19T00:10:46.535000", "created": "2022-08-20T17:40:16.199000", "tags": [ "http", "request chain", "august", "lookup go", "rescan add", "verdict report", "gb summary", "redirects links", "behaviour", "similar dom", "meta", "content api", "Ransomware" ], "references": [ "hillary.ua.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Ransom:Win32/Wannaren.A", "display_name": "Ransom:Win32/Wannaren.A", "target": "/malware/Ransom:Win32/Wannaren.A" } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1299, "hostname": 470, "domain": 207, "FileHash-SHA256": 1292, "CIDR": 19, "FileHash-MD5": 195, "FileHash-SHA1": 1 }, "indicator_count": 3483, "is_author": false, "is_subscribing": null, "subscriber_count": 407, "modified_text": "1308 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62e4a7a88f336737829495e0", "name": "www.iceland.co.uk - Oh dear looks like dom takeover", "description": "", "modified": "2022-08-29T00:01:52.177000", "created": "2022-07-30T03:38:16.809000", "tags": [], "references": [ "https://urlscan.io/result/858b39b1-7162-4b94-914a-b3040cd28c9f/#transactions", "https://urlscan.io/result/858b39b1-7162-4b94-914a-b3040cd28c9f/#redirects" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 285, "URL": 717, "domain": 89, "FileHash-SHA256": 934, "FileHash-MD5": 41, "email": 1 }, "indicator_count": 2067, "is_author": false, "is_subscribing": null, "subscriber_count": 393, "modified_text": "1329 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "628af7e3df399fbe9095245f", "name": "lumen.me Honeybadger", "description": "window.ju_sha256, a new type of code, is written by the same characters:var l,b,c,g,p,a,h,d, c.", "modified": "2022-06-21T00:01:09.886000", "created": "2022-05-23T02:56:35.154000", "tags": [ "reduceright", "lj", "number", "query", "string", "trackevent", "date", "u003e div", "simulator", "error", "regexp", "pageview", "path", "void", "code", "l420", "g5vs2ll0p80", "copyright", "json", "uint8array", "ssnull", "script", "closure library", "xdfunction", "adfunction", "typeof t", "typeof symbol", "typeof", "window", "value", "function", "customevent", "image", "null", "sbfu", "typeof n", "object", "array", "control", "other", "android", "x3e div", "gtmnwh4dh2", "host", "page title", "page path", "typeerror", "promise", "typeof e", "typeof window", "aggregateerror", "math", "target", "rangeerror", "buffer", "index", "attempt", "argument", "google", "link", "ad tech", "providers", "ffffff", "ip address", "combine", "accept", "save", "explorer", "cookie", "back", "iframe", "blank", "position", "juorderid", "justuno", "body", "juorigtop", "event", "follow", "post", "config", "click", "local", "fast", "comp", "form", "unknown", "push", "trcimpl", "trcwarn" ], "references": [ "https://cdn.taboola.com/scripts/cds-pips.js", "https://www.iubenda.com/cookie-solution/confs/js/53119375.js", "https://cdn.jst.ai/mwgt_4.1.js?v=5.28", "https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.38.0/core-en.js", "https://s.pinimg.com/ct/lib/main.32155010.js", "https://analytics.tiktok.com/i18n/pixel/config.js?sdkid=C3I4VUA8DUF9JOO44QC0&hostname=lumen.me", "https://js.pvd.to/c/v1/pixel-1sdz.js?t=1653350400000", "https://cdn.jst.ai/vck.js", "https://www.googletagmanager.com/gtm.js?id=GTM-NWH4DH2", "https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C3I4VUA8DUF9JOO44QC0&lib=ttq", "https://cdn.taboola.com/libtrc/unip/1262365/tfa.js", "https://s.pinimg.com/ct/core.js", "https://www.googleoptimize.com/optimize.js?id=OPT-TQC6JW4", "https://www.googletagmanager.com/gtag/js?id=G-5VS2LL0P80&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtm.js?id=GTM-PF3JNK2>m_auth=a6AgvzJ0SAOcyjADNwrdlQ>m_preview=env-1>m_cookies_win=x" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lj", "display_name": "Lj", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1134, "hostname": 315, "domain": 233, "FileHash-SHA256": 475 }, "indicator_count": 2157, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "1398 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6266e05eead46d425dff53c2", "name": "inap.com - Drift Widget", "description": "function R(a,b,c,d,e,f) is a new type of JavaScript, which allows the browser to control its browser without a set of buttons or controls..", "modified": "2022-05-25T00:04:03.622000", "created": "2022-04-25T17:54:38.551000", "tags": [ "drift widget", "javascript", "typeerror", "name", "typeof t", "getconfig", "default", "typeof e", "area", "event", "shadowroot", "boolean", "error", "shown", "click", "null", "window", "trident", "body", "formdata", "property", "377867625", "script", "textjavascript", "piscriptnum", "function", "regexp", "class", "attr", "pseudo", "child", "typeof module", "reduceright", "vd", "number", "string", "trackevent", "copyright", "standard", "pageview", "hpgform", "hpgdownload", "path", "download", "derek", "void", "date", "code", "ieproto", "object", "typeof", "typeof n", "widgetrootqa", "driftconductor", "license", "small batch", "apache license", "version", "unless", "as is", "basis", "without", "warranties or", "apache", "sessionid", "session", "post", "contenttype", "snull" ], "references": [ "xfe-URL-Inap.com-stix2-2.1-export.json", "https://ws.zoominfo.com/pixel/1FBtpCEkYmFObuGSt7zC", "https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js", "https://js.driftt.com/include/1650908400000/puh6a6h2pc6k.js", "https://www.googletagmanager.com/gtm.js?id=GTM-KPQ5FFK", "https://www.inap.com/inap/wp-includes/js/jquery/jquery.min.js?ver=3.6.0", "https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=28453&account_id=235392&title=Hybrid%20IT%20%26%20Enterprise%20Cloud%20Solutions%20-%20INAP&url=https%3A%2F%2Fwww.inap.com%2F&referrer=", "https://go.inap.com/analytics?conly=true&visitor_id=377865231&visitor_id_sign=fcd1b8a6054d2c2490cb77f4d0581558910b2792df8a7d07c6a0b0282eba2cd0db306c84706e8688a4165a4437c383a8e130703a&pi_opt_in=&campaign_id=28453&account_id=235392&title=Hybrid%20IT%20%26%20Enterprise%20Cloud%20Solutions%20-%20INAP&url=https%3A%2F%2Fwww.inap.com%2F&referrer=", "https://js.driftt.com/conductor/assets/4.fa5fc959.chunk.js", "https://www.inap.com/inap/wp-content/plugins/wp-user-avatar/assets/js/frontend.min.js?ver=3.2.4", "https://www.inap.com/inap/wp-content/themes/inap/assets/js/bootstrap.bundle.min.js?ver=2.0.0", "https://8794842.fls.doubleclick.net/activityi;src=8794842;type=front;cat=newun0;ord=1047846285161;gtm=2wg4k0;auiddc=1226623845.1650908333;~oref=https%3A%2F%2Fwww.inap.com%2F", "https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1650908332393", "https://js.driftt.com/core?embedId=puh6a6h2pc6k®ion=US&forceShow=false&skipCampaigns=false&sessionId=34bf8b51-4431-413e-ac31-6833e0d5600c&sessionStarted=1650908334.439&campaignRefreshToken=6e5a949b-b933-4b76-8614-902cd18d34a6&hideController=false&pageLoadStartTime=1650908332393&mode=CHAT&driftEnableLog=false" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vd", "display_name": "Vd", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1239, "URL": 3619, "domain": 565, "FileHash-SHA256": 300 }, "indicator_count": 5723, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1425 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "625f6d2300f3002b1d0f8a68", "name": "CPANEL-TUCOWS \u2014malware hosting", "description": "FBEvents-PostalCodeType, a new type of phone number type, has been added to the list of \"signals\" that can be controlled by a specialised operator.", "modified": "2022-05-19T00:00:49.028000", "created": "2022-04-20T02:17:07.272000", "tags": [ "tucows", "vimeo", "enter otp", "foruserlogin", "username", "email address", "phone number", "click", "null", "otpviamail", "otpviasms", "error", "regexp", "edge", "elem", "function", "handle", "return", "expando", "match", "selector", "android", "false", "date", "target", "class", "mark", "copy", "capture", "seed", "pass", "enough", "code", "never", "core", "local", "verify", "fall", "accept", "done", "find", "internal", "inject", "possible", "prop", "trigger", "qe", "number", "string", "copyright", "uint8array", "xhfunction", "yhfunction", "gtmwrdf3cb", "host", "path", "gaugescookie", "gaugesuniqueday", "gaugesgauges", "slice", "image", "gaugestracker", "gaugesunique", "script", "closure library", "typeerror", "symbol", "array int8array", "caregexp", "legacy", "extra", "bootstrap", "medium", "large", "segoe ui", "roboto", "oxygensans", "ubuntu", "cantarell", "helvetica neue", "dataalignleft", "figcaption", "video", "ff6c2c", "styles", "badges", "small", "woff2", "fontface", "sans", "u1c801c88", "u20b4", "u2de02dff", "ua640a69f", "ufe2efe2f", "u04b004b1", "u2116", "arial", "helvetica", "montserrat", "productnav", "secondarynav", "typecheckbox", "menlo", "monaco", "consolas", "twitter", "font awesome", "license", "brands", "duotone", "msie", "russia", "paypal", "enduser license", "agreement", "europe", "typeof t", "typeof e", "typeof", "version", "attr", "pseudo", "object", "array", "invalid attempt", "typeof symbol", "survey", "trident", "form", "fullscreen", "property", "311218982", "textjavascript", "piscriptnum", "hj", "hotjar", "email", "telefon", "meta", "cookie", "keypress", "live", "generic", "window", "widget", "ciudad", "adore", "experiment", "mutation", "udc66udc67", "ud83d", "ufe0f", "ud83e", "udc68udc69", "udfcbudfcc", "u2640u2642", "source", "ud83dudc6cud83c", "cookiebot", "iabv2", "jsonversion", "cookie script", "methodstrict", "ticket", "id attribute", "cookiebot setup", "cookieconsent", "project", "reduceright", "trackevent", "pageview", "gtmwb4lhq4", "void", "pfunction", "contenttype", "zfunction", "bfunction", "mvoid", "ofunction", "thank", "f39c11", "quick question", "difficult", "easy", "poll", "typeof window", "invalid uuid", "functional", "member", "hnew regexp", "qfunction", "adview", "addbillinginfo", "addtocart", "addtolist", "contact", "download", "install", "signup", "addtowishlist", "lead", "custom", "typeof require", "sha256", "viewcontent", "search", "iterator", "boolean", "service", "phonenumber", "facebook", "javascript", "1cend" ], "references": [ "xfe-URL-Cpanel.com-stix2-2.1-export.json", "https://pi.pardot.com/pd.js", "https://connect.facebook.net/signals/config/285857426541675?v=2.9.57&r=stable", "https://www.redditstatic.com/ads/pixel.js", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://static.ads-twitter.com/uwt.js", "https://www.googleadservices.com/pagead/conversion_async.js", "https://static.hotjar.com/c/hotjar-1683409.js?sv=7", "https://www.google-analytics.com/analytics.js", "https://consent.cookiebot.com/da52fc49-8e48-42b7-9ad3-c219404f6f92/cc.js?renew=false&referer=cpanel.net&dnt=false", "https://consentcdn.cookiebot.com/consentconfig/da52fc49-8e48-42b7-9ad3-c219404f6f92/cpanel.net/configuration.js", "https://www.googletagmanager.com/gtm.js?id=GTM-WB4LHQ4", "https://www.bugherd.com/sidebarv2.js?apikey=kmu00qbvuigehexs5chefq", "https://consent.cookiebot.com/uc.js", "https://cpanel.net/wp-includes/js/wp-emoji-release.min.js?ver=5.6", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/728582492/?random=1650418372747&cv=9&fst=1650418372747&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4i1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fcpanel.net%2F&tiba=Hosting%20Platform%20of%20Choice&hn=www.googleadservices.com&us_privacy=1---&async=1&rfmt=3&fmt=4", "https://www.googleadservices.com/pagead/conversion/854235671/?random=1650418372749&cv=9&fst=1650418372749&num=1&value=0&label=PRNxCIWemu8BEJe0qpcD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4i1&sendb=1&ig=1&data=ads_data_redaction%3Dfalse&frm=0&url=https%3A%2F%2Fcpanel.net%2F&tiba=Hosting%20Platform%20of%20Choice&gcs=G111&did=dMWZhNz&edid=dMWZhNz&auid=2050955691.1650418373&capi=2&hn=www.googleadservices.com&btty", "https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=33566&account_id=872471&title=Hosting%20Platform%20of%20Choice&url=https%3A%2F%2Fcpanel.net%2F&referrer=", "https://www.1.cpanel.net/analytics?conly=true&visitor_id=311218274&visitor_id_sign=3e1116a56bfd91923fe15cac565b502779c6ec3fe7449557f3940ba04e77079951b9efb044c2275f4211d26742585a9d14544eae&pi_opt_in=&campaign_id=33566&account_id=872471&title=Hosting%20Platform%20of%20Choice&url=https://cpanel.net/&referrer=", "https://script.hotjar.com/survey-v2.3716506838f2208ab9e2.js", "https://cpanel.net/wp-content/themes/cPbase/assets/js/dist/script.js?ver=5.6", "https://cpanel.net/wp-content/themes/cPbase/assets/js/dist/cpbase.js?ver=5.6", "https://cpanel.net/wp-includes/js/wp-embed.min.js?ver=5.6", "https://pro.fontawesome.com/releases/v5.13.1/css/all.css", "https://vars.hotjar.com/box-4924254a9ce4dc9b959b6e4a9b662d60.html", "https://consentcdn.cookiebot.com/sdk/bc-v4.min.html", "https://cpanel.net/wp-content/themes/cPbase/style.css?ver=5.6", "https://cpanel.net/wp-includes/css/dist/block-library/style.min.css?ver=5.6", "https://fonts.googleapis.com/css?family=Open+Sans:100,200,300,400,500,600,700%7CMontserrat:100,200,300,400,500,600,700", "https://cpanel.net/wp-content/themes/cPbase/assets/css/version96.css", "https://cpanel.net/wp-content/themes/cPbase/assets/css/roadmap.css", "xfe-URL-pi.pardot.com-stix2-2.1-export.json", "xfe-URL-Cpanel.net-stix2-2.1-export.json", "https://secure.gaug.es/track.js", "https://www.googletagmanager.com/gtm.js?id=GTM-WRDF3CB", "https://149371662.v2.pressablecdn.com/wp-includes/js/jquery/jquery.js", "https://149371662.v2.pressablecdn.com/wp-content/plugins/user-verification/assets/front/js/scripts-otp.js", "https://player.vimeo.com/video/571271613", "https://bid.g.doubleclick.net/xbbe/pixel?d=KAE" ], "public": 1, "adversary": "", "targeted_countries": [ "Tunisia" ], "malware_families": [ { "id": "Qe", "display_name": "Qe", "target": null }, { "id": "hj", "display_name": "hj", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3487, "URL": 10195, "domain": 1182, "FileHash-SHA256": 815, "FileHash-MD5": 3, "FileHash-SHA1": 1 }, "indicator_count": 15683, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "1431 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "625f3287d722d8d85700b75d", "name": "Leaseweb.com - malware hosting", "description": "function D(t,e,n), as well as window.com, has been frozen by a single function, as part of a series of \"snoopers' checks\"...", "modified": "2022-05-19T00:00:49.028000", "created": "2022-04-19T22:07:03.024000", "tags": [ "11px center", "html", "typetext", "typeurl", "typeemail", "typetel", "typenumber", "typedate", "color", "marketo forms", "cross domain", "null", "click", "forceclose", "lightbox", "slideshow", "controls", "hide", "safari", "image", "mozilla", "explorer", "entity", "linear", "date", "jquery", "iframe", "close", "loops", "class", "stretch", "false", "function", "abbb", "typeerror", "boolean", "body", "object", "array", "regexp", "bind", "error", "void", "hammer", "form", "this", "views slideshow", "zindex1", "ajax", "href", "default", "thumb", "msgesture", "mspointerdown", "next", "stop", "type", "index", "event", "snapabugcbmbtn", "chat", "hidden", "leaf", "open", "dump", "window", "win32", "footer", "front", "drupal", "command", "implement", "copyright", "route", "foundation", "thecookie", "remove", "example", "backport", "grab", "span", "import", "attr", "string", "invalid json", "domparser", "number", "script", "closure library", "symbol", "array int8array", "caregexp", "legacy", "boardman", "fontface", "typeof d", "promise", "parseint", "marketo", "rangeerror", "uint8array", "typeof b", "buffer", "path", "takk", "kiitos", "buttons};kb(convertedmessage);break;case\"/sys\":var", "acum", "ufunction", "ffunction", "gfunction", "mchtd", "cancel", "thank", "enter", "please", "cobrowsing", "accept", "decline", "back", "comment", "grazie", "klik", "super", "dados", "hello", "vd", "reduceright", "trackevent", "lead", "query", "videos", "leaseweb", "trackpageview", "contact", "download", "metal", "code", "functional", "member", "hnew regexp", "qfunction", "adview", "addbillinginfo", "addtocart", "addtolist", "install", "cookiebot", "iabv2", "jsonversion", "cookie script", "methodstrict", "ticket", "id attribute", "cookiebot setup", "cookieconsent", "customevent", "09af", "ver0", "tag0", "extdata0", "ua ch", "invalid", "iterator", "service", "phonenumber", "facebook", "meta", "ytconfig", "edge", "swhealthlog", "logsdatabasev2", "trident", "android", "infinity", "pnull", "style", "ctnull", "post", "uint32array", "fanull", "license", "ynull", "config" ], "references": [ "https://consent.cookiebot.com/1e27dadb-e278-4c02-aa4f-43f9222c4fbb/cc.js?renew=false&referer=www.leaseweb.com&culture=en&dnt=false", "https://j.clarity.ms/s/0.6.34/clarity.js", "https://www.google-analytics.com/plugins/ua/linkid.js", "https://www.youtube.com/s/player/19eb72e4/www-widgetapi.vflset/www-widgetapi.js", "https://www.youtube.com/iframe_api", "https://connect.facebook.net/signals/config/399164440484826?v=2.9.57&r=stable", "https://bat.bing.com/bat.js", "https://consent.cookiebot.com/uc.js?cbid=1e27dadb-e278-4c02-aa4f-43f9222c4fbb&culture=en", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://www.googletagmanager.com/gtm.js?id=GTM-NWPHSS", "https://storage.googleapis.com/snapengage-eu/js/e9219576-8f74-40b5-8b6f-bbad33f6ca57.js", "https://munchkin.marketo.net/161/munchkin.js", "https://app-lon04.marketo.com/js/forms2/js/forms2.min.js", "https://munchkin.marketo.net/munchkin.js", "https://www.leaseweb.com/sites/all/modules/custom/lsw_marketo/js/lsw_marketo_forms.js", "https://use.fortawesome.com/03018d9d.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1001847692/?random=1650405011980&cv=9&fst=1650405011980&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4i1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.leaseweb.com%2F&tiba=Leaseweb%20%7C%20Global%20Hosted%20Infrastructure%20(IaaS)%20and%20Cloud%20Solutions&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/952389962/?random=1650405011982&cv=9&fst=1650405011982&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4i1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.leaseweb.com%2F&tiba=Leaseweb%20%7C%20Global%20Hosted%20Infrastructure%20(IaaS)%20and%20Cloud%20Solutions&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "https://eu.snapengage.com/chatjs/ServiceGetConfig?w=e9219576-8f74-40b5-8b6f-bbad33f6ca57", "https://eu.snapengage.com/chatjs/servicegetproactivegeodata?w=e9219576-8f74-40b5-8b6f-bbad33f6ca57", "https://bat.bing.com/p/action/5602105.js", "https://eu.snapengage.com/chatjs/servicegetallavailableagents?w=e9219576-8f74-40b5-8b6f-bbad33f6ca57&t=1", "https://www.googleadservices.com/pagead/conversion_async.js", "https://www.leaseweb.com/sites/default/files/js/js_kwxcSFD2Y0_BPtdJClYUy5H8THI_5EycUmIgIGWaGYs.js", "https://www.leaseweb.com/sites/default/files/js/js_wcSNEXVJ4Xjhkf8qhMguEPZJTDTMNmPaJM-YWdAOhQE.js", "https://www.leaseweb.com/sites/default/files/js/js_kI_QwKJlaBz9CzQdENdUBFiEl4aehfjf4_-9taiwcCE.js", "https://www.leaseweb.com/sites/default/files/js/js_zoLA7TweXam0kYiqJrXepqBWmyDoP1sLSlHoZcveFnY.js", "https://www.leaseweb.com/sites/default/files/js/js_6FowaFXT9bT78hf9earPdGcdTmvsFiaBzKgFl9P4fSo.js", "https://www.leaseweb.com/sites/default/files/js/js_6lTJ_m6ahwXas7Efbw8ZYEMSaecrGw8ilNALfvIPNUw.js", "https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nxsfu&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=511b6f48-2639-478c-a251-b09fcbae76e7&tw_document_href=https%3A%2F%2Fwww.leaseweb.com%2F&tpx_cb=twttr.conversion.loadPixels", "https://bid.g.doubleclick.net/xbbe/pixel?d=KAE", "https://consentcdn.cookiebot.com/sdk/bc-v4.min.html", "https://app-lon04.marketo.com/index.php/form/XDFrame", "https://app-lon04.marketo.com/js/forms2/css/forms2-theme-plain.css", "https://www.leaseweb.com/sites/default/files/css/css_47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU.css", "https://www.leaseweb.com/sites/default/files/css/css_7CYF9En6DNp6AojfSKnT8USKR3GvzPwznmTqLTKT9VM.css" ], "public": 1, "adversary": "", "targeted_countries": [ "Tunisia" ], "malware_families": [ { "id": "Ajax", "display_name": "Ajax", "target": null }, { "id": "Kiitos", "display_name": "Kiitos", "target": null }, { "id": "Takk", "display_name": "Takk", "target": null }, { "id": "Acum", "display_name": "Acum", "target": null }, { "id": "buttons};kb(convertedMessage);break;case\"/SYS\":var", "display_name": "buttons};kb(convertedMessage);break;case\"/SYS\":var", "target": null }, { "id": "Vd", "display_name": "Vd", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 648, "domain": 469, "URL": 2037, "FileHash-SHA256": 705, "email": 7 }, "indicator_count": 3866, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1431 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "622f4574af9ba0d28f7a053c", "name": "www.smartmatic.com:%22,_Cloudflare Wed, 02 Feb 2022", "description": "", "modified": "2022-04-13T00:01:48.292000", "created": "2022-03-14T13:39:00.594000", "tags": [ "WannaCry" ], "references": [ "www.smartmatic.com:%22,_Cloudflare.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Ransomware.WannaCry-9856297-0", "display_name": "Win.Ransomware.WannaCry-9856297-0", "target": null } ], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 472, "hostname": 267, "domain": 56, "FileHash-SHA256": 630, "CIDR": 3, "FileHash-MD5": 11 }, "indicator_count": 1439, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1467 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "", "Domains Contacted: electricpresident.net recordcaught.net electriccaught.net streetstrong.net tradestrong.net", "http://download.virtualbox.org/virtualbox/debian", "Alerts: ransomware_dropped_files ransomware_mass_file_delete antivm_vmware_in_instruction", "sabey.com", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b", "https://www.virustotal.com/gui/collection/f3bb0fe192a7a669edd061", "https://tria.ge/240517-vdwb5shc71/behavioral1", "https://www.robtex.com/en/dns-lookup/ca/ualberta", "https://8794842.fls.doubleclick.net/activityi;src=8794842;type=front;cat=newun0;ord=1047846285161;gtm=2wg4k0;auiddc=1226623845.1650908333;~oref=https%3A%2F%2Fwww.inap.com%2F", "http://Object.prototype.hasOwnProperty.call", "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA1 ad560bee21bf7aefc1f1a1be2762d852c7301c07", "Related Tags: https://www.virustotal.com/graph/embed/g17b255d00de64c0faa707968", "https://pulsedive.com/indicator/?indicator=ualberta.ca", "https://viz.greynoise.io/analysis/4627bc3a-0238-4f2f-ad5c-c50527", "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43/680e723df123be6c63004290", "https://www.urlvoid.com/dns-records-lookup/", "https://static.ads-twitter.com/uwt.js", "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43/67db93032dc368d2d80c3df1", "https://whois.easycounter.com/ualberta.ca", "https://app.pentester.com/scans/U2NhblR5cGU6NDcwNDM5Mw==", "Malvertizing, Phishing, Botnet PWD: https://pin.it/ | https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | www.pornhub.com", "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx", "Security Contact Email: 212d0c197dca818es@hq.dhs.gov \u2022ACTIVE Domain Name: DHS.GOV", "https://www.googleadservices.com/pagead/conversion_async.js", "https://search.odin.io/hosts?query=ualberta.ca", "onlinebanking.usbank.com.blackboxconstruction.com.ph", "Malware Behavior Catalog: Defense Evasion OB0006 \u2022 Delayed Execution B0003.003 \u2022 Move File C0063 \u2022 Process Environment Block B0001.019", "https://www.redditstatic.com/ads/pixel.js", "f.search schema.org t.final", "Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel | 103.246.145.111", "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256\t3744b06ebb5465c1b3601abc9899e0448c3bb53e81ad6a3101780ab94931ba69", "https://eu.snapengage.com/chatjs/servicegetproactivegeodata?w=e9219576-8f74-40b5-8b6f-bbad33f6ca57", "jpocxaar1---r3---sn-jpocxaa-a03e.gvt1.com", "https://www.googletagmanager.com/gtm.js?id=GTM-NWPHSS", "Related Tags: https://www.virustotal.com/graph/embed/g17b255d00de64c0faa707968 [OG:dorkingbeauty | Cloned: StreaminingEx]", "https://cdn.taboola.com/scripts/cds-pips.js", "https://cpanel.net/wp-includes/js/wp-embed.min.js?ver=5.6", "https://www.hallrender.com/attorney/brian-sabey/", "https://cellebrite.com/en/federal-government/ [Pegasus ck privilege collection]", "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22", "Domains Contacted: bettercaught.net electricstrong.net recordtrouble.net electrictrouble.net recordpresident.net", "https://bat.bing.com/bat.js", "https://www.filescan.io/uploads/67db2f67b93e688233ef36e9/reports/7e4e4377-5eb9-48a7-848d-bfdca4fb244c/ioc", "https://www.iubenda.com/cookie-solution/confs/js/53119375.js", "Yara Detections: Yara Detections Nrv2x , UPX_OEP_place , UPX_Modified_Or_Inside , UPX20030XMarkusOberhumerLaszloMolnarJohnReiser , UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , Toxoplasmosis , UPX", "Malware: 0a6e883228a04a6e8738511a6210914dea1773d88cf57950c83e092f02c7f3bf - Other:Malware-gen\\ [Trj]", "https://munchkin.marketo.net/161/munchkin.js", "https://vars.hotjar.com/box-4924254a9ce4dc9b959b6e4a9b662d60.html", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6", "https://cdn.jst.ai/vck.js", "https://www.inap.com/inap/wp-content/plugins/wp-user-avatar/assets/js/frontend.min.js?ver=3.2.4", "https://www.tiktok.com/@jeffersonultra/video/7404142059327687942?is_from_webapp=1&sender_device=pc&web_id=7408601050825868806", "newbrazzers.com [y8.com]", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs", "https://cdn.taboola.com/libtrc/unip/1262365/tfa.js", "Yara Detections invalid_trailer_structure , multiple_versions", "https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js", "https://www.criminalip.io/domain/report?scan_id=13798622", "Hostname device-local-fb18804d-348e-49ea-8c17-cc8a29f18082.remotewd.com | 192.168.56.104: IPv4", "https://www.virustotal.com/graph/embed/g4022b02acb3b46ddb4b24043845853d9f56a84d80b5849188fee79c90217d4ca?theme=dark", "http://x.com/denverpolice/status/", "IDS Detections: TLS Handshake Failure Yara Detections: Nullsoft_NSIS", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/952389962/?random=1650405011982&cv=9&fst=1650405011982&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4i1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.leaseweb.com%2F&tiba=Leaseweb%20%7C%20Global%20Hosted%20Infrastructure%20(IaaS)%20and%20Cloud%20Solutions&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "https://app-lon04.marketo.com/index.php/form/XDFrame", "https://www.googletagmanager.com/gtm.js?id=GTM-WRDF3CB", "https://secure.gaug.es/track.js", "xfe-URL-Cpanel.com-stix2-2.1-export.json", "Malware Families: ALF:PUA:Block:IObit ALF:Program:Win32/Webcompanion ALF:Ransom:Win32/Babax Win.Keylogger.Banbra-9936388-0", "https://cpanel.net/wp-content/themes/cPbase/assets/js/dist/cpbase.js?ver=5.6", "wallet.mewards.bing.com | https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net | wallpapers-nature.com", "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22", "PATHETIC redirect: rainn.org | victims of violence & abuse disclose extremely sensitive details. Reported false information given to disorient victims.", "114.114.114.114 [Tulach]", "https://j.clarity.ms/s/0.6.34/clarity.js", "http://flexlucky.com/isurvey/en/?devicemodel=iPhone&carrier=\u00aeion=Tbilisi&brand=Apple&browser=GoogleApp&prize=cur&u=track.bawiwia.com&isp=JSCGlobalErty&ts=29900ce7-726c-4c9f-b0c3-21ff2f859648&country=GE&click_id=wuo4jm6db011lufu2f8h138c&partner=5658402&skip=yes&frame={frame}&cost=0.010100&lang=en", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/728582492/?random=1650418372747&cv=9&fst=1650418372747&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4i1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fcpanel.net%2F&tiba=Hosting%20Platform%20of%20Choice&hn=www.googleadservices.com&us_privacy=1---&async=1&rfmt=3&fmt=4", "https://www.googletagmanager.com/gtm.js?id=GTM-NWH4DH2", "Aspnet collect: https://otx.alienvault.com/otxapi/indicators/file/screenshot/000444cc67b97f45f11e1fdf89ad8f5127c87aa858fe151fa9c4975276f53b42", "defenselawyernj.com", "trojan.cosmu/xpiro - 960879004e1059a9e7eaca7b95f45ab9baf8f5b905e2714f1c65f92244396758", "https://www.youtube.com/s/player/19eb72e4/www-widgetapi.vflset/www-widgetapi.js", "https://www.virustotal.com/graph/embed/g1313cfcd67d34e9c8d8438d6", "http://www1.mychartahn.org/?tm=1&subid4=1671014887.0191400000&kw=Patient+Portal&KW1=Patient+Access+Network&KW2=Patient+Self+Check+In+System&KW3=Electronic+Health+Record+EHR+System&KW4=Patient+Appointment+Scheduling+System&KW5=Medical+Billing+System+Software&KW6=Patient+Financial+Assistance&searchbox=0&domainname=0&backfill=0", "https://bat.bing.com/p/action/5602105.js", "Unix.Malware.Generic-9875933-0 | FileHash-SHA256 be1c1ee886185dff2b29ab84649484e3f01a9dfe303213ff9ce3f652aa98b2b9", "Virus:Win32/Sality.AM FileHash-SHA256 538cd5aba2f96d17324b9063807a061424b921dcd6769afb210687d32276a2da", "https://theorg.com", "Emotet: FileHash-SHA256 db9d59b0f192c91f8ecf939c415b3252b13b0fb052d4a66ceefb80dfb43d6e8a |", "https://www.blackberry.com/etc.clientlibs/bbcom/clientlibs/clientlib-etc-legacy/resources/cylance-web/global/bb-default-thumbnail-social.png", "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview", "Yara Detections: Delphi", "Malware Behavior Catalog: Get File Attributes C0049 \u2022 Set File Attributes C0050 \u2022 Read File C0051 \u2022 Writes File C0052", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2", "Bayrob: 3744b06ebb5465c1b3601abc9899e0448c3bb53e81ad6a3101780ab94931ba69 ef55e2c918f9678e97037d5505b0c8a3.virus", "Matches rule PROTOCOL-ICMP PING Windows Matches rule PROTOCOL-ICMP Unusual PING detected Matches rule PROTOCOL-ICMP", "pornhub.dev, http://matrix.pornhub.dev, https://twitter.com/PORNO_SEXYBABES, https://www.anon-v.com/porno/fenella/", "www.videolan.org [info solutions]", "IDS Detections: Win32/Adware.Ymeta.A CnC Beacon Win32/Adware.Ymeta.A CnC Win32/Adware.Ymeta Variant Activity", "https://web.archive.org/web/20250000000000*/ualberta.ca", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093", "https://tria.ge/240517-vqxezaaa33/behavioral1", "http://dropbox.com/ [ intrusions/ dropbox stealer]", "https://js.pvd.to/c/v1/pixel-1sdz.js?t=1653350400000", "https://use.fortawesome.com/03018d9d.js", "hanmail.net", "Matches rule ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz", "https://viewdns.info/portscan/?host=ualberta.ca", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary", "Command and Control IP: 5.41.21.250 | Location Saudi Arabia flag Jeddah, Saudi Arabia ASN AS39891 saudi telecom company jsc", "https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nxsfu&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=511b6f48-2639-478c-a251-b09fcbae76e7&tw_document_href=https%3A%2F%2Fwww.leaseweb.com%2F&tpx_cb=twttr.conversion.loadPixels", "Matches rule SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)", "WannaCry | NSA -Anity Cert: https://otx.alienvault.com/indicator/url/https://www.antiy.com/response/Antiy_Wannacry_NSA.html", "wallpapers-nature.com | https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net", "https://s.pinimg.com/ct/core.js", "https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C3I4VUA8DUF9JOO44QC0&lib=ttq", "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph", "www.hallinjurylaw.com |\tMinneapolis Personal Injury Lawyer Personal Injury Law Experts", "https://www.googletagmanager.com/gtm.js?id=GTM-KPQ5FFK", "xfe-URL-Cpanel.net-stix2-2.1-export.json", "[cisa gov] https://otx.alienvault.com/indicator/domain/cisa.gov \u2022 [hq.dhs.gov] https://otx.alienvault.com/indicator/hostname/hq.dhs.gov", "https://www.youtube.com/iframe_api", "https://viewdns.info/traceroute/?domain=ualberta.ca", "https://149371662.v2.pressablecdn.com/wp-content/plugins/user-verification/assets/front/js/scripts-otp.js", "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****", "https://www.google-analytics.com/analytics.js", "Alerts: nids_malware_alert network_icmp dumped_buffer network_cnc_http network_http network_http_post allocates_rwx", "Malware Families: VirTool:Win32/Injector TrojanDownloader:Win32/Upatre Unix VirTool:Win32/Obfuscator Win.Dropper.LokiBot-9975730-0", "www2.blackbagtech.com [hidden users included]", "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3", "https://js.driftt.com/core?embedId=puh6a6h2pc6k®ion=US&forceShow=false&skipCampaigns=false&sessionId=34bf8b51-4431-413e-ac31-6833e0d5600c&sessionStarted=1650908334.439&campaignRefreshToken=6e5a949b-b933-4b76-8614-902cd18d34a6&hideController=false&pageLoadStartTime=1650908332393&mode=CHAT&driftEnableLog=false", "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22", "Yara Detections: ConventionEngine_Term_Desktop , LZMA , mpress_2_xx_x86 , dbgdetect_procs", "Alerts: network_icmp modifies_proxy_wpad multiple_useragents injection_resumethread", "Tulach! It's been a minute - 114.114.114.114", "Query to a *.top domain - Likely Hostile Query for .cc TLD", "Trojan:Win32/Zombie.A: FileHash-SHA256: 72bd98a9157afcd3ae38b60a7cf3ae4f23d6bb069a7aa7be7080b6967a6cf0cc", "m.pornsexer.xxx.3.1.adiosfil.roksit.net", "https://www.googleadservices.com/pagead/conversion/854235671/?random=1650418372749&cv=9&fst=1650418372749&num=1&value=0&label=PRNxCIWemu8BEJe0qpcD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4i1&sendb=1&ig=1&data=ads_data_redaction%3Dfalse&frm=0&url=https%3A%2F%2Fcpanel.net%2F&tiba=Hosting%20Platform%20of%20Choice&gcs=G111&did=dMWZhNz&edid=dMWZhNz&auid=2050955691.1650418373&capi=2&hn=www.googleadservices.com&btty", "https://tulach.cc/", "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a", "https://www.google-analytics.com/plugins/ua/linkid.js", "What's going on here judiciary? Karen - cisa.gov? e.final", "09.10.25 - https://urlscan.io/search/#page.domain%3Awww.ualberta.ca", "https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.38.0/core-en.js", "https://consent.cookiebot.com/1e27dadb-e278-4c02-aa4f-43f9222c4fbb/cc.js?renew=false&referer=www.leaseweb.com&culture=en&dnt=false", "TrojanSpy:Win32/Nivdort.CW: FileHash-MD5\t9d6de961a498f831acb63c95e7b2ff0c", "attorney-marketing-specialists.com ?", "https://www.leaseweb.com/sites/default/files/js/js_wcSNEXVJ4Xjhkf8qhMguEPZJTDTMNmPaJM-YWdAOhQE.js", "09.10.25 - https://viz.greynoise.io/ip/analysis/df2c8c37-f8f2-4398-b709-7c716b03b697", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be", "Malware Behavior Catalog: COMSPEC Environment Variable F0007.001 \u2022 Install Additional Program B0023 \u2022 Delete File C0047 \u2022", "https://bgp.he.net/dns/ualberta.ca", "https://cpanel.net/wp-content/themes/cPbase/assets/css/roadmap.css", "Unix.Malware.Generic:", "https://research.domaintools.com/research/whois-history/search/?q=ualberta.ca", "Domain: hicloudcam.com | https://otx.alienvault.com/indicator/hostname/alarmeu.sslproxy.gatewayvvlilly3lilly.alpha.hicloudcam.com", "https://www.googletagmanager.com/gtm.js?id=GTM-WB4LHQ4", "https://cpanel.net/wp-includes/js/wp-emoji-release.min.js?ver=5.6", "nr-data.net [Apple Private Data Collection]", "All - EnterpriseAppsList.csv", "hyundai-smg.com | http://hyundai-smg.com/index.php?route=information/contact | http://hyundai-smg.com/index.php?route=information/contact", "https://centralops.net/co/DomainDossier.aspx", "Alerts: infostealer_cookies infostealer_keylog persistence_ads suspicious_command_tools anomalous_deletefile", "ALF:JASYP:TrojanDownloader:Win32/Quireap!atmn: FileHash-SHA256 18f62aec151e9f17c55987f80ed1244d9812895018d2bc931df083fb846a52dc", "xfe-URL-Inap.com-stix2-2.1-export.json", "Ransom: CVE-2023-4966", "https://reverseip.domaintools.com/search/?q=ualberta.ca", "Unix.Malware.Generic: IDS Detections Generic.Go.Bruteforcer CnC Beacon Generic.Go.Bruteforcer Receiving Config", "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs", "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark", "https://fonts.googleapis.com/css?family=Open+Sans:100,200,300,400,500,600,700%7CMontserrat:100,200,300,400,500,600,700", "originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com | 108.160.165.139 Location: USA |ASN AS19679 dropbox inc. Nameservers ns-136.awsdns-17.com. ns-1518.awsdns-61.org. ,\u00a0 ns-1573.awsdns-04.co.uk. ,\u00a0 ns-809.awsdns-37.net. Less WHOIS Registrar: https://www.101domain.com/,\u00a0\u00a0 Creation Date: Oct 21, 2010 Related Pulses None Related Tags None Indicator Facts Running webserver External Resources Whois,\u00a0 UrlVoid,\u00a0 VirusTotal Analysis Related Pulses Comments (0) Whois Show 100 entr", "Malware Families: Win.Dropper.LokiBot-9975730-0 #LowFiEnableDTContinueAfterUnpacking #LowFiMalf_gen Worm:Win32/Mofksys", "Unix.Malware.Generic: Observed DNS Query for Israel Domain (.il) | Alerts: cape_detected_threat", "Matches rule ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst", "https://www.criminalip.io/asset/search?query=ualberta.ca", "https://itunes.apple.com/app/apple-store/id284815942/us/app/image-recognition-and-searcher/id1450230225", "https://otx.alienvault.com/indicator/url/https://theorg.com/_next/data/Gh7c6NpBHZESb74aisPB8/org/springboard-collaborative.json?companySlug=springboard-collaborative", "Alerts: dead_host network_icmp nolookup_communication disables_proxy modifies_certificates modifies_proxy_wpad", "https://analytics.tiktok.com/i18n/pixel/config.js?sdkid=C3I4VUA8DUF9JOO44QC0&hostname=lumen.me", "13.107.21.200 Bat.Bing - Trojan:Win32/Qbot | ALF:Ransom:Win32/Babax | Worm:Win32/Mofksys | ALF:Program:Win32/Webcompanion", "https://consentcdn.cookiebot.com/consentconfig/da52fc49-8e48-42b7-9ad3-c219404f6f92/cpanel.net/configuration.js", "https://crt.sh/?q=ualberta.ca&exclude=expired&group=none", "Emotet: FileHash-SHA1\t19c14ab0aaab2c1dd922f0baca3cf64056f80acc", "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark", "telejoint.net", "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf", "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/summary", "Phishing, Botnet PWD:https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing | https://www.sweetheartvideo.com/tsara-brashears/ | www.sweetheartvideo.com", "cellebrite.com | https://cellebrite.com/en/federal-government/", "Malware Behavior Catalog: Tree Anti-Behavioral: Environment Variable C0034 \u2022 Anti-Behavioral Analysis OB0001 \u2022 Process OC0003", "[https://cisa gov] https://otx.alienvault.com/indicator/ip/92.123.203.73 \u2022 https://otx.alienvault.com/indicator/hostname/hq.dhs.gov", "https://connect.facebook.net/signals/config/399164440484826?v=2.9.57&r=stable", "match.pegasus.isi.edu", "https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=28453&account_id=235392&title=Hybrid%20IT%20%26%20Enterprise%20Cloud%20Solutions%20-%20INAP&url=https%3A%2F%2Fwww.inap.com%2F&referrer=", "AppRegistrationList.csv", "https://tria.ge/240517-vc7c1shc62/behavioral1", "Malware Behavior Catalog: Dynamic Analysis Evasion B0003 \u2022 Create File C0016 \u2022 Create Process C0017 \u2022 Create Thread C0038", "https://app.netlas.io/domains/stats/?facets=domain&indices=&q=domain%3A%2A.ualberta.ca&size=1100", "Bayrob: FileHash-SHA1 ad560bee21bf7aefc1f1a1be2762d852c7301c07", "https://who.is/whois/ualberta.ca", "http://michaela.young@uchealth.com", "Trojan:Win32/Zombie.A: FileHash-MD5: 36b71d23ca7553fb9db0730e56e6bf77", "https://s.pinimg.com/ct/lib/main.32155010.js", "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=ualberta.ca", "Emotet: FileHash-MD5 bafae95c36402dfc1ea5fa04523e4e81", "https://vtbehaviour.commondatastorage.googleapis.com/528831360d5c49743bf0dcf9cb0af1f76c694de9dfff79b32098d68c3c592f8a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775980441&Signature=QefJtz2s096UJTV1NljpeJrvdFWJBbHJre5UDOJQeemvu9EGI8UaxLTPvZxejJToeSgqCCu4zCWniB2V9Xer1ozcM5Vy2xhgRO%2BaFeWFRkjfd5yRyZIGLi65ORYA2oyDhTBUZuQco3NNHZWaS0mWYOpAI662c%2BecYNp5SJTXMB4oKzu9bstiszUfM1HNlWjSpySaxCD4j34gZFgiv5xZGW34IcBSvzfQUWECgUu6jW5Pu4Rr%2FH5TJS%2", "https://track.toccha.com/978eb025-0a62-46fa-827c-d71aa0524818?zoneid=5939372&ua=high&subzone_id=3038557&set=social&country=SY®ion=49&isp=syriatelmobiletelecom&useragent=Mozilla/5.0", "https://www.pornhub.com/video/search?search=tsara+brashears", "https://www.filescan.io/uploads/678dca8c2d219e36112b2dd4/reports/1d6e1a12-c26b-4506-aeb4-a8f539b75bee/overview", "ALF:JASYP:TrojanDownloader:Win32/Quireap!atmn: FileHash-SHA1 48dc18f70b2dfdf554e8247eb9e4a8910e19bd3b", "Unix.Malware.Generic-9875933-0 | High Priority Alert: cape_detected_threat", "Malware Behavior Catalog: Operating System OC0008 \u2022 Environment Variable C0034 \u2022 Self Deletion F0007 \u2022 : Tree Anti-Behavioral Analysis", "QuantumFiber.com a 2nd look", "https://twitter.com/PORNO_SEXYBABES", "go.sabey.com", "https://cpanel.net/wp-content/themes/cPbase/assets/css/version96.css", "ALF:JASYP:TrojanDownloader:Win32/Quireap!atmn: FileHash-SHA256 215fbe9cf76ccbdde60eaa66538edeecadb844078b4379e66cacb83c7ac05690", "https://cpanel.net/wp-includes/css/dist/block-library/style.min.css?ver=5.6", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "https://dnsdumpster.com/", "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb", "hillary.ua.pdf", "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf", "https://consentcdn.cookiebot.com/sdk/bc-v4.min.html", "https://viz.greynoise.io/query/AS3359", "https://www.leaseweb.com/sites/default/files/js/js_6FowaFXT9bT78hf9earPdGcdTmvsFiaBzKgFl9P4fSo.js", "https://www.verizon.com/business/", "https://www.1.cpanel.net/analytics?conly=true&visitor_id=311218274&visitor_id_sign=3e1116a56bfd91923fe15cac565b502779c6ec3fe7449557f3940ba04e77079951b9efb044c2275f4211d26742585a9d14544eae&pi_opt_in=&campaign_id=33566&account_id=872471&title=Hosting%20Platform%20of%20Choice&url=https://cpanel.net/&referrer=", "https://www.virustotal.com/gui/url/6314e10278e55b5f02aa1f8e588ad7e20bf90534cd813c7eff24d261e8dc4250", "https://whois.domaintools.com/ualberta.ca", "https://www.googletagmanager.com/gtag/js?id=G-5VS2LL0P80&l=dataLayer&cx=c", "Bayrob: FileHash-SHA256 3744b06ebb5465c1b3601abc9899e0448c3bb53e81ad6a3101780ab94931ba69", "114.114.114.114", "Malware Behavior Catalog: System Information Discovery E1082 \u2022 File and Directory Discovery E1083 \u2022 Execution OB0009 \u2022 File System OC0001", "WannaCry MS17-010 'Shadow' https://otx.alienvault.com/otxapi/indicators/url/screenshot/https://www.antiy.com/response/wannacry.html", "IP address: 104.244.42.1 Hosting: Unknown Running on: Tsa B CMS: Express", "https://ws.zoominfo.com/pixel/1FBtpCEkYmFObuGSt7zC", "https://www.leaseweb.com/sites/default/files/css/css_7CYF9En6DNp6AojfSKnT8USKR3GvzPwznmTqLTKT9VM.css", "https://static.hotjar.com/c/hotjar-1683409.js?sv=7", "Malware Behavior Catalog: Tree Anti-Behavioral Analysis: C0017 Create Thread \u2022 C0038 Operating System \u2022 Debugger Detection B0001", "IDS Detections: Terse HTTP 1.0 Request Possible Nivdort W32/Bayrob Attempted Checkin 403 Forbidden", "https://cdn.jst.ai/mwgt_4.1.js?v=5.28", "Unix -Yara: is__elf , UPXProtectorv10x2 , UPX , ELFHighEntropy , ElfUPX , elf_empty_sections", "https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=33566&account_id=872471&title=Hosting%20Platform%20of%20Choice&url=https%3A%2F%2Fcpanel.net%2F&referrer=", "https://hybrid-analysis.com/sample/ac09d7f6b26675a529a366b47bc09b3fd776576fb099c020f57204ff7b4ea31c", "https://pro.fontawesome.com/releases/v5.13.1/css/all.css", "uchealth.com", "http://www.hybrid-analysis.com/sample/c047a23d603e9babce4db32175ecad13f5209027f24772908879d40bb392cefe", "https://app-lon04.marketo.com/js/forms2/js/forms2.min.js", "https://viz.greynoise.io/analysis/5692e934-322f-48b9-bd9b-556e653ff5b6", "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7", "https://intelx.io/?s=ualberta.ca", "IDS Detections: Windows 98 User-Agent Detected - Possible Malware or Non-Updated System Unsupported/Fake Internet Explorer Version MSIE 5.", "https://consent.cookiebot.com/uc.js?cbid=1e27dadb-e278-4c02-aa4f-43f9222c4fbb&culture=en", "https://otx.alienvault.com/indicator/file/000054fa2b0d1004464350ee9acc40707fec51223dba36c702a3db4139af9717", "https://www.leaseweb.com/sites/default/files/js/js_kwxcSFD2Y0_BPtdJClYUy5H8THI_5EycUmIgIGWaGYs.js", "work.a-poster.info", "Thor Scan: S-I9VvMTB6cZU", "https://149371662.v2.pressablecdn.com/wp-includes/js/jquery/jquery.js", "networkservice.exe: Matches rule SERVER-OTHER Spring Data Commons remote code execution attempt", "ACTIVE Emails: IS2OSecurity@hq.dhs.gov \u2022 CISA.GOV Status \u2022 schoolsafety.gov \u2022 power2prevent.gov \u2022 is2osecurity@hq.dhs.gov", "https://js.driftt.com/include/1650908400000/puh6a6h2pc6k.js", "www-stage40.pornhub.com", "Alerts: packer_entropy packer_upx antivm_memory_available pe_features", "fds.cellebrite.com", "https://eu.snapengage.com/chatjs/servicegetallavailableagents?w=e9219576-8f74-40b5-8b6f-bbad33f6ca57&t=1", "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview", "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43", "Trojan:Win32/Zombie.A: FileHash-SHA1: 1fa3519b200cf5078c1c6c7df1cf44cd747c2320", "CVE-2007-3896 | CVE-2023-22518 | CVE-2023-4966", "IDS Detections: Observed Suspicious UA (Mozilla/5.0) Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)", "https://connect.facebook.net/signals/config/285857426541675?v=2.9.57&r=stable", "https://www.leaseweb.com/sites/default/files/js/js_6lTJ_m6ahwXas7Efbw8ZYEMSaecrGw8ilNALfvIPNUw.js", "https://munchkin.marketo.net/munchkin.js", "https://imp0rtp3.wordpress.com/2021/08/12/tetris/", "Unix -IDS Detections: Generic.Go.Bruteforcer CnC Beacon Generic.Go.Bruteforcer Receiving Config Observed", "https://www.hudsonrock.com/search?domain=ualberta.ca", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing", "https://viz.greynoise.io/ip/analysis/d90b0bd7-aaa1-4ea6-93c1-92bfd2d8f930", "https://urlscan.io/result/858b39b1-7162-4b94-914a-b3040cd28c9f/#redirects", "https://cpanel.net/wp-content/themes/cPbase/style.css?ver=5.6", "ALF:JASYP:TrojanDownloader:Win32/Quireap!atmn: FileHash-MD5 da9b9e892ced7ec90841d813f6e42339", "Ransom: ransomed.vc", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1001847692/?random=1650405011980&cv=9&fst=1650405011980&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4i1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.leaseweb.com%2F&tiba=Leaseweb%20%7C%20Global%20Hosted%20Infrastructure%20(IaaS)%20and%20Cloud%20Solutions&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43", "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/iocs", "Malware Families: ALF:Trojan:Win32/FormBook AWS PDF:UrlMal-inf\\ [Trj] Trojan:Win32/Qbot Unix.Malware.Generic-9875933-0", "remote.aciscomputers.com", "api-stage.pornhub.com", "https://t.me/hermitspyware/24", "Unix.Malware.Generic: Yara Detections: is__elf , UPXProtectorv10x2 , UPX , ELFHighEntropy , ElfUPX , elf_empty_sections", "https://otx.alienvault.com/indicator/file/72bd98a9157afcd3ae38b60a7cf3ae4f23d6bb069a7aa7be7080b6967a6cf0cc", "http://ci-www.threatcrowd.org/domain.php?domain=ualberta.ca", "IDS Detections: Win32.Lexip Checkin Unsupported/Fake FireFox Version 2.", "https://www.googleoptimize.com/optimize.js?id=OPT-TQC6JW4", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (iPhone unlocker)", "https://www.inap.com/inap/wp-includes/js/jquery/jquery.min.js?ver=3.6.0", "Scanning host: 31.214.178.54 , 37.152.88.54", "https://www.shodan.io/search?query=ualberta.ca", "Yara Detections: Ursnif_201904 , aPLib , PECompact_2xx , pecompact2 , PECompact2xxBitSumTechnologies , PECompactV2XBitsumTechnologies , PECompactv2xx", "https://urlscan.io/result/858b39b1-7162-4b94-914a-b3040cd28c9f/#transactions", "https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1650908332393", "https://tria.ge/240521-q4s79agb25/static1", "https://bgpview.io/asn/3359#whois", "https://pulsedive.com/ioc/ualberta.ca", "https://www.tiktok.com/@jeffersonultra/video/7401970649561894150", "https://centralops.net/co/", "https://pi.pardot.com/pd.js", "https://viz.greynoise.io/analysis/f3d70a4f-14b1-4d26-8617-98d591", "www.smartmatic.com:%22,_Cloudflare.pdf", "https://www.quantumfiber.com/moving.html?utm_source=Digital&utm_medium=DV360_YouTube&utm_campaign=QuantumFiber_Residential_Prospecting&utm_content=Movers-RES-QF-Movers-ACH-OLV30-50-YouTube-NA&gclid=CjwKCAjwooq3BhB3Eiw", "https://tria.ge/240517-t9pc2ahb2t", "https://player.vimeo.com/video/571271613", "https://js.driftt.com/conductor/assets/4.fa5fc959.chunk.js", "Win.Dropper.LokiBot-9975730-0 FileHash-SHA256 8f65d7817731cf1b7fada1be16d85464383813dd1f0388a933cec2abbeda4ba9", "https://consent.cookiebot.com/da52fc49-8e48-42b7-9ad3-c219404f6f92/cc.js?renew=false&referer=cpanel.net&dnt=false", "https://otx.alienvault.com/indicator/domain/asp.net \u2022 https://otx.alienvault.com/indicator/hostname/ts1.mm.bing.net", "Yara Detections: vad_contains_network_strings information | HackToolWin32Patch CodeOverlap | PWSWin32Phorex CodeOverlap", "Https://BluetoothVirus.com", "http://subtitles.rest7.com/subs/The.Expanse.S03E11.720p.HDTV.x264-KILLERS[eztv].mkv", "Https://BiosVir.us", "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview", "[dhs gov] https://otx.alienvault.com/indicator/domain/dhs.gov \u2022 https://otx.alienvault.com/indicator/url/https:%2F%2Fwww.cisa.gov%2Fcybersecurity-advisories%2Fics-advisories.xml", "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22", "cellebrite.com", "https://consent.cookiebot.com/uc.js", "uploads-cserver-alumni-profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com", "Alerts: (cisa gov) ransomware_file_modifications script_created_process antisandbox_mouse_hook antivm_generic_disk infostealer_cookies suspicious_command_tools antidebug_guardpages dynamic_function_loading reads_self stealth_window", "https://www.googletagmanager.com/gtm.js?id=GTM-PF3JNK2>m_auth=a6AgvzJ0SAOcyjADNwrdlQ>m_preview=env-1>m_cookies_win=x", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a", "PDF:UrlMal-inf\\ [Trj] FileHash-SHA256 30d8d75f9457b13b8e4802a6f5b2a6379616f5f2ddd0b5db18b503628a429be7", "https://otx.alienvault.com/indicator/file/f7636eef1d9df0664cd0f205ad8864b659bf9898ce6231376778c4411986912e", "Matches rule ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses", "development.digitalphotogallery.com _YandexDropperExtend", "http://www.apple.com/appleca/AppleIncRootCertificate.cer", "wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language", "https://urlquery.net/report/0b60a80e-d3a5-4ca3-8644-190f32f28c65", "https://script.hotjar.com/survey-v2.3716506838f2208ab9e2.js", "https://urlquery.net/report/e9f9c430-fb2f-4166-8bfb-500339fdb9c0", "https://otx.alienvault.com/indicator/file/00001aff2ea1acd6087f9fba8d8316d90d29e391d9969bc70cc607461467797e", "https://www.merklemap.com/search?query=ualberta.ca&page=0", "Alerts: cape_detected_threat cape_extracted_content", "https://app.threat.zone/submission/c70698bf-881e-491a-a582-eee634b4bf73/url-analysis-report", "Win.Keylogger.Banbra FileHash-SHA256 94517bb37a8ebe48a06a64b20237e287101bc93bbc840bf6e1ab7dfb28a2da5a", "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview", "https://bid.g.doubleclick.net/xbbe/pixel?d=KAE", "https://otx.alienvault.com/indicator/url/www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "https://storage.googleapis.com/snapengage-eu/js/e9219576-8f74-40b5-8b6f-bbad33f6ca57.js", "09.20.25 - https://urlscan.io/search/#page.domain%3Aualberta.ca", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List", "asp.net", "Malware Hosting IP addresses: 141.193.213.20 | 185.199.108.153| 185.199.110.153 | 185.199.111.153", "https://viewdns.info/iphistory/?domain=ualberta.ca", "https://www.filescan.io/uploads/666d69ff6b8dba248b414767", "https://app-lon04.marketo.com/js/forms2/css/forms2-theme-plain.css", "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca", "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll", "Bayrob: FileHash-MD5 871f1532a8f0f9cf9ec3e82b5da3a120", "Win.Dropper.LokiBot-9975730-0", "Crouching Yeti: Appendixes - according to source ArcSight Threat Intelligence", "https://www.filescan.io/uploads/68b608d639a6221faa7935aa/reports/dd218cea-f81d-43ed-97fe-dd8c5aec52a3/ioc", "xfe-URL-pi.pardot.com-stix2-2.1-export.json", "FormBook: a4ec4c6ea1c92e2e6.awsglobalaccelerator.com", "Yara: TrojanDropperWin32Ropest | CodeOverlap TrojanWin32Gatsorm | CodeOverlap TrojanWinNTConficker | CodeOverlap Alerts: WormWin32Pykspa", "https://vtbehaviour.commondatastorage.googleapis.com/edb4c21d60daa44b3429e7ba9bfa342759ebef23c136c934f74aef145453ce19_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775737710&Signature=fbsokraSd7lsYmUfaTEl8Phs2K3hp7AtVmQU9axeEBcYmYbrrYrrfpP5lPEQaE%2Fh3%2BEP9Rn8mD8D1haqQVXCN0VVlxJ4sddjWmyC5USsgBsvUb0%2F72h1WHDS2KXHlteZWE%2Bauckabain9D5kX501AnqFY38s77OIqO6SMOkQ%2BvXiDSSRK%2FZhbfradBnei3ZLHsXGxkoshTyvB0%2BC%2F8SiUzdVsqSjik0Bn2r%2BIlLpDQK90GlZTD0N", "Redirects to https://twitter.com?mx=1", "https://www.leaseweb.com/sites/default/files/js/js_kI_QwKJlaBz9CzQdENdUBFiEl4aehfjf4_-9taiwcCE.js", "https://viz.greynoise.io/analysis/a40cf3ce-d048-47c1-94b7-730b71", "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview", "https://imazing.com/guides/detect-pegasus-and-other-spyware-on-iphone", "https://www.leaseweb.com/sites/all/modules/custom/lsw_marketo/js/lsw_marketo_forms.js", "https://otx.alienvault.com/indicator/hostname/originb0b.profile-cassandra-5.redirectme.netoppofentryd.staging.0025-kr.ali.zomans.com", "https://www.whoxy.com/ualberta.ca", "https://www.leaseweb.com/sites/default/files/js/js_zoLA7TweXam0kYiqJrXepqBWmyDoP1sLSlHoZcveFnY.js", "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea", "Redirects to >https://twitter.com/x/migrate?tok=eyJlIjoiL2RlbnZlcnBvbGljZS9zdGF0dXMvIiwidCI6MTcxNjcwMzc3M33oZya0EO4PtEbRwq4XZboX", "https://www.bugherd.com/sidebarv2.js?apikey=kmu00qbvuigehexs5chefq", "https://www.inap.com/inap/wp-content/themes/inap/assets/js/bootstrap.bundle.min.js?ver=2.0.0", "thevisafirm.com | Immigration Lawyers Capital Immigration Lawyers Green Card Lawyer [ London, DC] malicious", "healthcare.greatcall.com [fake call centers | PHI & PII info stealers]", "TrojanDownloader:Win32/Upatre FileHash-SHA256 dbffd83df979087e6a896ddc069cb84e1cdae1cf3dccbebcc7b544778e3d76ae", "Alerts: creates_largekey script_created_process antisandbox_mouse_hook antivm_generic_disk dead_connect", "https://sitereport.netcraft.com/?url=http://ualberta.ca", "https://www.leaseweb.com/sites/default/files/css/css_47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU.css", "http://pegasus.diskel.co.uk/ [phishing]", "http://watchhers.net/index.php [remote attackers | malware spreader]", "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24", "https://vtbehaviour.commondatastorage.googleapis.com/edb4c21d60daa44b3429e7ba9bfa342759ebef23c136c934f74aef145453ce19_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775737365&Signature=S%2B7RcHYjab1hbKlKwFfvUbDirFPJS1A2TJQ3bVIObMcON4PD9pRDvhMtYMCnEBrYsICi0UJCFW5eUDolL5Jlbngsc587kF36vvuhlkPprbkSOY1jOyDTpe3Qsb6jRFz3xwOfZc9S5QervoLnRKb%2FyGSyZE6ZK6TxzBrOPczPtZ7sLf9NfD6E%2B2gMRXaRjEqVwVITLG7YqCiiNuohFOuNlK3uNHFpIk53viKvBSAIqLtSklH9bHW4q1DX", "https://urlscan.io/search/#ualberta.ca", "https://eu.snapengage.com/chatjs/ServiceGetConfig?w=e9219576-8f74-40b5-8b6f-bbad33f6ca57", "Packer UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]", "https://go.inap.com/analytics?conly=true&visitor_id=377865231&visitor_id_sign=fcd1b8a6054d2c2490cb77f4d0581558910b2792df8a7d07c6a0b0282eba2cd0db306c84706e8688a4165a4437c383a8e130703a&pi_opt_in=&campaign_id=28453&account_id=235392&title=Hybrid%20IT%20%26%20Enterprise%20Cloud%20Solutions%20-%20INAP&url=https%3A%2F%2Fwww.inap.com%2F&referrer=", "https://cpanel.net/wp-content/themes/cPbase/assets/js/dist/script.js?ver=5.6", "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "dosdean@ualberta[.]ca // ciso@ualberta[.]ca", "TrojanDownloader:Win32/Nemucod", "Blind Eagle" ], "malware_families": [ "Worm:win32/mofksys", "Mimikatz", "Win32:malware-gen", "Kzmiutmy", "Win32/vflooder.b vtapi dos", "Win.dropper.qqpass-9895638-0", "Kiitos", "Win32:trojan-gen", "Ransomware", "Trojandownloader:win32/upatre", "Lumma stealer", "Acum", "Wannacry", "Exodus", "Artemis", "Aws", "Trojan.bayrob/lazy", "Win.trojan.agent-752791", "Trojanspy:win32/nivdort.cw", "Win.trojan.downloader-63174", "Alf:ransom:win32/babax", "Formbook", "Trojan-ransom.win32.blocker.xhaw", "Meterpreter", "Trojan:bat/gamaredon", "Trojan:win32/comspec", "Hacktool", "Comspec", "Reduceright", "Win.ransomware.wannacry-9856297-0", "Takk", "Win.worm.pykspa-1", "Serwer a przed\u0142u\u017cenie sesji #{text} wojcieszyce pl", "Trojandropper:win32", "Lazarus", "Tulach", "Apollolocker", "Ajax", "Other:malware-gen\\ [trj]", "Dark power", "Pws:win32/raven", "#lowfimalf_gen", "Alf:pua:block:iobit", "Lolkek", "Lj", "Win.malware.vtflooder-6723768-0", "Quasar rat", "Win32:renos-ky\\ [trj]", "Trojan-downloader.win32.upatre", "Clicker.bgou", "Virtool:win32/injector", "Unruy", "Sabey", "Trojan:win32/zombie.a", "Network rat", "Kimsuky", "Virtool:win32/tofsee", "Cobalt strike", "Redline stealer", "Hj", "Worm.mimail", "Buttons};kb(convertedmessage);break;case\"/sys\":var", "Unix", "Worm:win32/pykspa.c", "Alf:jasyp:trojandownloader:win32/quireap!atmn", "W32/bagle.rc.worm", "Opencandy", "Qe", "Alf:program:win32/webcompanion", "Win.keylogger.banbra-9936388-0", "Raccoon", "Brontok", "Vd", "Unix.malware.generic-9875933-0", "Win32/vflooder.b checkin", "Android:agent-ovb [trj]", "Trojan:vbs/renos", "Trojanx", "Bayrob", "Qakbot", "Pdf:urlmal-inf\\ [trj]", "#lowfienabledtcontinueafterunpacking", "Virtool:win32/obfuscator", "Trojanspy", "Ransom:win32/wannaren.a", "Trojan:win32/qbot", "Swisyn", "Emotet", "Ransom", "Hallrender", "Blacknet rat", "Win.dropper.lokibot-9975730-0", "Trj/ci.a", "Win32:pitou-c [rtk]", "Trojan:win32/qqpass", "Alf:trojan:win32/formbook" ], "industries": [ "Healthcare", "Patient", "Chemical", "Finance", "Immigration", "Survivor", "Telecommunications", "Individual", "Education", "Agriculture", "Government", "Technology", "Civilian society", "Media" ], "unique_indicators": 230246 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/ads-twitter.com", "whois": "http://whois.domaintools.com/ads-twitter.com", "domain": "ads-twitter.com", "hostname": "static.ads-twitter.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 50, "pulses": [ { "id": "699c3b796fcaed878ca94c5c", "name": "https://m.vzw.com/wIvzrd8", "description": "the wizard", "modified": "2026-04-18T05:30:18.690000", "created": "2026-02-23T11:35:21.673000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1818, "hostname": 575, "URL": 200, "FileHash-SHA1": 450, "CIDR": 11, "domain": 887, "email": 7, "FileHash-MD5": 402, "CVE": 21 }, "indicator_count": 4371, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "1 day ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b283a733a36fe75a38bb9c", "name": "The Gatby Script Loader", "description": "Im still hooked on the Belasco Chain being a thing.", "modified": "2026-04-18T05:29:25.398000", "created": "2026-03-12T09:13:11.392000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 227, "FileHash-MD5": 24, "FileHash-SHA1": 14, "domain": 64, "URL": 42, "hostname": 57, "CVE": 3, "IPv4": 1, "JA3": 1 }, "indicator_count": 433, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "1 day ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b6044b1389957c1d2afb58", "name": "Pulses in Question", "description": "Following.", "modified": "2026-04-14T01:10:24.056000", "created": "2026-03-15T00:58:51.761000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 56, "FileHash-SHA1": 56, "FileHash-SHA256": 93, "URL": 122, "hostname": 150, "email": 1, "domain": 37 }, "indicator_count": 515, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "5 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b650d954218108114d88e3", "name": "Files Corpus Redirected to these PDFKIT.net", "description": "PDFKIT.NET DMV version \"\" see old posts for details. Recommendation, PDFkit.net DMV versions should be aggregated with data to rule out anything like ability to connect to Mac ids, or general safety. Docusign states that to fall within a secure Docusign protocol documents are not modified after creation. Please check old pdfs for post modification violating forgery, cryptography, electronic claims act integrity violations.", "modified": "2026-04-14T00:14:29.475000", "created": "2026-03-15T06:25:29.875000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 6, "hostname": 12, "URL": 15, "FileHash-SHA256": 3 }, "indicator_count": 36, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "5 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699ffe2a0a48bdf23d11efb4", "name": "Cardconnect Ecosystem", "description": "The cardconnect.com infrastructure reveals a fragmented and high-risk network topology characterized by an atypical shift from Fastly edge delivery to Radware-Ukraine (AS30779) routing. While core transaction processing remains anchored within Fiserv (AS11121/AS39992) and status monitoring is partitioned to AWS, the persistent resolution of root and www traffic to Ukrainian IP space (176.100.165.28) creates a significant geolocation anomaly for a US financial entity. This volatility, coupled with orphaned NXDOMAIN records and inconsistent CNAME nesting (aliasing vendor-specific subdomains like idexx and frazer to centralized b2c/fts endpoints), suggests a non-unified deployment strategy that complicates the domain\u2019s security perimeter and increases its exposure to DNS-based interception.", "modified": "2026-04-13T23:46:24.779000", "created": "2026-02-26T08:02:50.501000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 301, "FileHash-SHA256": 198, "hostname": 1359, "URL": 229, "email": 8, "FileHash-SHA1": 49, "CIDR": 4, "FileHash-MD5": 11, "CVE": 2 }, "indicator_count": 2161, "is_author": false, "is_subscribing": null, "subscriber_count": 50, "modified_text": "5 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69db4f2dc509a1e8210f1b68", "name": "CAPE Sandbox", "description": "CivicPlus, LLC (ICONE-2) is a US-based company with a name that includes the word \"CIVICPLUS\", \"civicplus\", and \"icon Enterprises, Inc\".", "modified": "2026-04-12T08:36:17.724000", "created": "2026-04-12T07:52:13.594000", "tags": [ "network admin", "civicplus", "net192", "net1920000", "houston", "suite e", "city", "server", "select contact", "domain holder", "date", "form", "submission", "ssdeep", "file type", "text text", "magic unicode", "utf8", "crlf line", "trid text", "magika txt", "file size", "chatgpt", "doctype html", "meta", "ai system", "research", "preview", "gmt server", "self", "dynamic", "html info", "title chatgpt", "meta tags", "thumbprint" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/528831360d5c49743bf0dcf9cb0af1f76c694de9dfff79b32098d68c3c592f8a_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775980441&Signature=QefJtz2s096UJTV1NljpeJrvdFWJBbHJre5UDOJQeemvu9EGI8UaxLTPvZxejJToeSgqCCu4zCWniB2V9Xer1ozcM5Vy2xhgRO%2BaFeWFRkjfd5yRyZIGLi65ORYA2oyDhTBUZuQco3NNHZWaS0mWYOpAI662c%2BecYNp5SJTXMB4oKzu9bstiszUfM1HNlWjSpySaxCD4j34gZFgiv5xZGW34IcBSvzfQUWECgUu6jW5Pu4Rr%2FH5TJS%2" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 2, "URL": 602, "domain": 166, "email": 37, "hostname": 837, "FileHash-MD5": 125, "FileHash-SHA1": 136, "FileHash-SHA256": 1230, "IPv4": 399 }, "indicator_count": 3534, "is_author": false, "is_subscribing": null, "subscriber_count": 49, "modified_text": "7 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b27c9ac35999221fac31ba", "name": "VirusTotal https://www.cloudflare.com/5xx-error-landing/", "description": "Wow.", "modified": "2026-04-11T08:33:01.447000", "created": "2026-03-12T08:43:06.589000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 9, "FileHash-MD5": 11, "FileHash-SHA1": 3, "URL": 64, "domain": 8, "hostname": 40 }, "indicator_count": 135, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "8 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d79c38e0a059039b475ebe", "name": "CAPE Sandbox", "description": "Email today from them on my line. Very wild things happening here. trying to close my line", "modified": "2026-04-09T12:55:23.059000", "created": "2026-04-09T12:31:52.495000", "tags": [ "html document", "unicode text", "utf8 text", "crlf", "lf line", "site", "meta", "verizon", "wireless", "internet", "phone services", "official", "shop verizon", "lte network", "get fios", "title", "code", "error", "utc na", "utc google", "tag manager", "gtmw2vn2cq", "utc dc9849921", "utc dc685973", "utc g12r1dx1lx7", "utc aw647962234", "utc aw2761768", "utc aw685973", "verizon business", "verizon for business", "verizon business account", "verizon business phone", "verizon wireless for business", "verizon business service", "verizon business plan", "business internet services", "learn", "gartner", "contact", "find", "discover", "support", "close log", "shop", "upgrade", "small", "voice", "chat", "mitre attack", "network info", "program", "html page", "t1055 process", "overview", "processes extra", "overview zenbox", "verdict", "guest system", "phishing", "next", "ver2", "msclkidn", "utc amazon", "analytics na", "utc bing", "vids1", "vids0", "gdlname" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/edb4c21d60daa44b3429e7ba9bfa342759ebef23c136c934f74aef145453ce19_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775737365&Signature=S%2B7RcHYjab1hbKlKwFfvUbDirFPJS1A2TJQ3bVIObMcON4PD9pRDvhMtYMCnEBrYsICi0UJCFW5eUDolL5Jlbngsc587kF36vvuhlkPprbkSOY1jOyDTpe3Qsb6jRFz3xwOfZc9S5QervoLnRKb%2FyGSyZE6ZK6TxzBrOPczPtZ7sLf9NfD6E%2B2gMRXaRjEqVwVITLG7YqCiiNuohFOuNlK3uNHFpIk53viKvBSAIqLtSklH9bHW4q1DX", "https://www.verizon.com/business/", "https://vtbehaviour.commondatastorage.googleapis.com/edb4c21d60daa44b3429e7ba9bfa342759ebef23c136c934f74aef145453ce19_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775737710&Signature=fbsokraSd7lsYmUfaTEl8Phs2K3hp7AtVmQU9axeEBcYmYbrrYrrfpP5lPEQaE%2Fh3%2BEP9Rn8mD8D1haqQVXCN0VVlxJ4sddjWmyC5USsgBsvUb0%2F72h1WHDS2KXHlteZWE%2Bauckabain9D5kX501AnqFY38s77OIqO6SMOkQ%2BvXiDSSRK%2FZhbfradBnei3ZLHsXGxkoshTyvB0%2BC%2F8SiUzdVsqSjik0Bn2r%2BIlLpDQK90GlZTD0N" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 772, "hostname": 706, "domain": 875, "FileHash-SHA256": 2348, "FileHash-MD5": 2237, "FileHash-SHA1": 2260, "IPv4": 442, "CVE": 1, "email": 9 }, "indicator_count": 9650, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "10 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d79c38622d6235b8c04603", "name": "CAPE Sandbox", "description": "Email today from them on my line. Very wild things happening here. trying to close my line", "modified": "2026-04-09T12:35:40.120000", "created": "2026-04-09T12:31:52.780000", "tags": [ "html document", "unicode text", "utf8 text", "crlf", "lf line", "site", "meta", "verizon", "wireless", "internet", "phone services", "official", "shop verizon", "lte network", "get fios", "title", "code", "error", "utc na", "utc google", "tag manager", "gtmw2vn2cq", "utc dc9849921", "utc dc685973", "utc g12r1dx1lx7", "utc aw647962234", "utc aw2761768", "utc aw685973", "verizon business", "verizon for business", "verizon business account", "verizon business phone", "verizon wireless for business", "verizon business service", "verizon business plan", "business internet services", "learn", "gartner", "contact", "find", "discover", "support", "close log", "shop", "upgrade", "small", "voice", "chat", "mitre attack", "network info", "program", "html page", "t1055 process", "overview", "processes extra", "overview zenbox", "verdict", "guest system", "phishing", "next", "ver2", "msclkidn", "utc amazon", "analytics na", "utc bing", "vids1", "vids0", "gdlname" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/edb4c21d60daa44b3429e7ba9bfa342759ebef23c136c934f74aef145453ce19_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775737365&Signature=S%2B7RcHYjab1hbKlKwFfvUbDirFPJS1A2TJQ3bVIObMcON4PD9pRDvhMtYMCnEBrYsICi0UJCFW5eUDolL5Jlbngsc587kF36vvuhlkPprbkSOY1jOyDTpe3Qsb6jRFz3xwOfZc9S5QervoLnRKb%2FyGSyZE6ZK6TxzBrOPczPtZ7sLf9NfD6E%2B2gMRXaRjEqVwVITLG7YqCiiNuohFOuNlK3uNHFpIk53viKvBSAIqLtSklH9bHW4q1DX", "https://www.verizon.com/business/", "https://vtbehaviour.commondatastorage.googleapis.com/edb4c21d60daa44b3429e7ba9bfa342759ebef23c136c934f74aef145453ce19_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775737710&Signature=fbsokraSd7lsYmUfaTEl8Phs2K3hp7AtVmQU9axeEBcYmYbrrYrrfpP5lPEQaE%2Fh3%2BEP9Rn8mD8D1haqQVXCN0VVlxJ4sddjWmyC5USsgBsvUb0%2F72h1WHDS2KXHlteZWE%2Bauckabain9D5kX501AnqFY38s77OIqO6SMOkQ%2BvXiDSSRK%2FZhbfradBnei3ZLHsXGxkoshTyvB0%2BC%2F8SiUzdVsqSjik0Bn2r%2BIlLpDQK90GlZTD0N" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 196, "hostname": 128, "domain": 4, "FileHash-SHA256": 90, "FileHash-MD5": 6, "FileHash-SHA1": 1, "IPv4": 90, "CVE": 1 }, "indicator_count": 516, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ccd2f7984fad6feebb4ca4", "name": "VirusTotal report\n for index.html", "description": "The full text of the full report-to-gws, which was published on 1 April 2026, has been published online by the Csp website, following a request from the BBC>pretext .", "modified": "2026-04-01T08:44:36.825000", "created": "2026-04-01T08:10:31.621000", "tags": [ "self", "downlink rtt", "html document", "ascii text", "crlf line", "windows", "linux", "build web", "html", "javascript", "https", "acceptencoding", "cookie", "dynamic", "authorization", "contentmd5", "wp engine", "xmsedgeref ref", "bl2edge1520 ref", "expires sun", "gmt date", "gmt xcache", "tcphit", "gmt etag", "b8glwd", "afeap", "bmxagc", "e5bfse", "bgs6mb", "bjwmce", "ciztgb", "kqhykb", "cxxawb", "fevhcf", "code", "server", "registrar abuse", "admin country", "expiration date", "registry domain", "registrar iana", "creation date", "admin city", "redmond tech", "samesitelax", "path", "httponly", "secure", "priorityhigh", "gmt contenttype", "contentlength", "connection", "cfray", "accept", "anycast", "wifi display", "android", "hdtv", "anycast og", "anything", "big screen", "mobileoptimized", "try shopify", "platform", "businesses", "shopify fb", "shopify og", "snapchat", "chat", "snaps", "a snap", "utc google", "adobe dynamic", "tag management", "amazon", "utc amazon", "utc facebook", "connect na", "analytics na", "tag manager", "gdlname", "miss", "drupal", "miss xtimer", "ve9 xcache", "miss date", "gmt link", "build", "home og", "cloudfront", "iad6", "kb body", "sha256", "aspen", "aspen one", "return", "transformed og", "aioseo", "site kit", "google", "file type", "name file", "html internet", "unicode text", "utf8 text" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 238, "URL": 367, "domain": 80, "hostname": 155, "FileHash-MD5": 115, "FileHash-SHA1": 105, "email": 5, "IPv4": 40, "SSLCertFingerprint": 4 }, "indicator_count": 1109, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "18 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://static.ads-twitter.com/uwt.js", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://static.ads-twitter.com/uwt.js", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776641436.5519125 }