{ "type": "URL", "indicator": "https://translate.googleapis.com/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://translate.googleapis.com/", "type": "url", "type_title": "URL", "validation": [ { "source": "akamai", "message": "Akamai rank: #5790", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain googleapis.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain googleapis.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 3156548749, "indicator": "https://translate.googleapis.com/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 12, "pulses": [ { "id": "685afb805ba518e374abc735", "name": "Home - RMHS - Ransom", "description": "I can only imagine what is going on. This is a real organization, with a building, ever changing case workers who don\u2019t want to meet with clients in person . I have received several incoming concerns since 2021. It seems that a threat actor may be ringing along or certain people are being handled / investigated / silenced and closely monitored by a very large interconnected Cyber Intelligence entity \u2022 Trojan:X97M/ShellHide.C |\n\u2022 Trojan:PDF/Phish.RR!MTB |\n\u2022 Win.Trojan.Agent-370485 |\nAntivirus Detections:\n\u2022 Win.Trojan.Agent-370485\nYara: VirusWin32Span |\nAlerts\nransomware_file_modifications\nstealth_file\nDomains Contacted: Unknown\n(efbkfqpcdh.com) [\t\t\t\t2025-07-24T16:00:00\t14\t\n\nURL\nhttp://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel] #phishing #malware #intel? #trojan #infectiin", "modified": "2025-07-24T19:04:24.993000", "created": "2025-06-24T19:24:48.632000", "tags": [ "wordpress", "home", "rmhs og", "rmhs article", "wpbakery page", "builder", "slider plugin", "utc google", "tag manager", "g5cygkcj7g1", "dynamicloader", "ms windows", "intel", "users", "medium", "pe32", "search", "show", "windows", "videos", "music", "copy", "write", "next", "ford mustang", "converter pdf", "gt convertible", "trim", "models ford", "mustang coupe", "createdate", "producer solid", "filehash", "trojan", "format", "united", "moved", "passive dns", "ipv4 add", "pulse submit", "url analysis", "urls", "files", "location united", "america flag", "encrypt", "date", "sc onlogon", "write c", "port", "showing", "entries", "module load", "execution", "malware", "self", "reverse dns", "url https", "resource", "general full", "name value", "security tls", "hash", "san francisco", "june", "input", "form", "dom get", "search start", "get https", "post", "value", "variables", "msgoriginaltext", "msgoptions", "isns function", "setupns", "rsiw number", "rsih object", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "found", "spawns", "ck techniques", "flag", "markmonitor", "name server", "server", "rocky mountain", "human", "domain address", "enom", "copy sha256", "path", "copy md5", "copy sha1", "sha256", "size", "sha1", "attrib", "rowcycur", "hz4urdyi", "stop", "false", "soldier", "model", "youth", "baby", "core", "warrior", "green", "emotion", "flash", "nina", "hunk", "fono", "daam", "destination", "tlsv1", "dyndns domain", "irfan skiljan", "yara detections", "pdf pdf", "producer pdftk", "title data", "pulse pulses", "av detections", "ids detections", "alerts", "analysis date", "pictures", "read", "delete", "thumbprint", "graph summary", "url http", "gna7hdu", "g4 rsa4096", "adobe systems", "services1", "adobe product", "creatortool", "ascii text", "description svg", "scalable vector", "graphics image" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 34, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 56, "URL": 262, "hostname": 165, "FileHash-SHA256": 2141, "FileHash-MD5": 308, "FileHash-SHA1": 308, "SSLCertFingerprint": 3, "email": 1 }, "indicator_count": 3244, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "313 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657091a4533a832480459e15", "name": "dos.myflorida.com:elections", "description": "", "modified": "2023-12-06T15:22:12.430000", "created": "2023-12-06T15:22:12.430000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 809, "hostname": 160, "domain": 105, "URL": 434, "CIDR": 1, "FileHash-MD5": 9, "FileHash-SHA1": 1 }, "indicator_count": 1519, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570843b02a76f986c48cf1f", "name": "ncdoj.gov.", "description": "", "modified": "2023-12-06T14:24:59.025000", "created": "2023-12-06T14:24:59.025000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1037, "domain": 117, "hostname": 116, "URL": 266, "CIDR": 1, "FileHash-MD5": 19, "FileHash-SHA1": 4 }, "indicator_count": 1560, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708400230da39043d8f3eb", "name": "www.ca.gov_08.27.2021.", "description": "", "modified": "2023-12-06T14:24:00.576000", "created": "2023-12-06T14:24:00.576000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1081, "hostname": 288, "domain": 158, "URL": 699, "FileHash-MD5": 33, "CIDR": 3, "FileHash-SHA1": 1 }, "indicator_count": 2263, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657080d20f7e10c1e37fcf89", "name": "TarrantCounty.com ~ 03.01.2022", "description": "", "modified": "2023-12-06T14:10:26.301000", "created": "2023-12-06T14:10:26.301000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1078, "domain": 838, "hostname": 1607, "URL": 4134, "email": 3, "FileHash-SHA1": 2, "CIDR": 4, "FileHash-MD5": 15 }, "indicator_count": 7681, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707fecb6939e601d10efa6", "name": "myflorida.gov", "description": "", "modified": "2023-12-06T14:06:36.777000", "created": "2023-12-06T14:06:36.777000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 662, "domain": 103, "hostname": 207, "URL": 422, "CIDR": 3, "FileHash-MD5": 19 }, "indicator_count": 1416, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656aa9afda328379fe4643ce", "name": "ncdoj.gov (Pulse by StremMiningEx)", "description": "", "modified": "2023-12-02T03:51:11.165000", "created": "2023-12-02T03:51:11.165000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "656a0e3e0117497d07a12ea5", "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 117, "hostname": 116, "URL": 266, "FileHash-SHA256": 1037, "CIDR": 1, "FileHash-MD5": 19, "FileHash-SHA1": 4 }, "indicator_count": 1560, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "914 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63012cdfb8b36960045a2deb", "name": "dos.myflorida.com:elections", "description": "", "modified": "2022-09-19T00:10:46.535000", "created": "2022-08-20T18:50:07.448000", "tags": [ "Ransomware" ], "references": [ "dos.myflorida.com:elections.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Ransom:Win32/Wannaren.A", "display_name": "Ransom:Win32/Wannaren.A", "target": "/malware/Ransom:Win32/Wannaren.A" } ], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 160, "URL": 435, "domain": 105, "FileHash-SHA256": 809, "CIDR": 1, "FileHash-MD5": 9, "FileHash-SHA1": 1 }, "indicator_count": 1520, "is_author": false, "is_subscribing": null, "subscriber_count": 404, "modified_text": "1353 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6231f4578903e31103502c87", "name": "www.ca.gov_08.27.2021.", "description": "", "modified": "2022-04-15T00:03:47.669000", "created": "2022-03-16T14:29:43.470000", "tags": [], "references": [ "www.ca.gov 08.27.2021.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 288, "URL": 700, "domain": 158, "FileHash-SHA256": 1081, "CIDR": 3, "FileHash-MD5": 33, "FileHash-SHA1": 1 }, "indicator_count": 2264, "is_author": false, "is_subscribing": null, "subscriber_count": 405, "modified_text": "1510 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "623241350f0a874e72533eb4", "name": "ncdoj.gov.", "description": "", "modified": "2022-04-15T00:03:47.669000", "created": "2022-03-16T19:57:41.379000", "tags": [ "WannaCry", "NCdoj.gov" ], "references": [ "ncdoj.gov.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Ransomware.WannaCry-9856297-0", "display_name": "Win.Ransomware.WannaCry-9856297-0", "target": null } ], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 117, "hostname": 116, "URL": 267, "FileHash-SHA256": 1037, "CIDR": 1, "FileHash-MD5": 19, "FileHash-SHA1": 4 }, "indicator_count": 1561, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1510 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62276abfaa65cd33f64331f8", "name": "TarrantCounty.com ~ 03.01.2022", "description": "", "modified": "2022-04-07T00:04:02.553000", "created": "2022-03-08T14:39:59.235000", "tags": [ "march", "lookup go", "rescan add", "verdict report", "de summary", "http", "redirects links", "behaviour", "similar dom", "content api", "value", "search url", "search domain", "scan url", "url search", "domain scan", "url url", "motor vehicle", "aqb1", "eventsevent10", "meta", "show", "download go", "full url", "reverse dns", "resource", "windows nt", "win64", "khtml", "gecko", "response", "main", "milan", "apache", "paris", "accept" ], "references": [ "TarrantCounty3df.pdf", "TarantCounty2df.pdf", "TarrantCounty4df.pdf", "TarrantCounty5df.pdf", "tarrant23df.pdf", "TarrantCounty1df.pdf", "tarrantcounty.com:en:elections:Voter-Information:Voter- Registration.html%22,.pdf", "TarrantCounty6df.pdf", "TarrantCounty7df.pdf", "TarrantCounty10df.pdf", "TarrantCounty9df.pdf", "TarrantCounty17df.pdf", "TarrantCounty15df.pdf", "TarrantCounty12df.pdf", "TarrantCounty14df.pdf", "tarrantcounty8df.pdf", "TarrantCounty18df.pdf", "TarrantCounty19df.pdf", "TarrantCounty21df.pdf", "tarrantcounty22df.pdf", "TarrantCounty20df.pdf", "tarrantcountydf.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4134, "hostname": 1607, "domain": 838, "FileHash-SHA256": 1078, "FileHash-SHA1": 2, "email": 3, "CIDR": 4, "FileHash-MD5": 15 }, "indicator_count": 7681, "is_author": false, "is_subscribing": null, "subscriber_count": 405, "modified_text": "1518 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6220488cb1b01309c635fa53", "name": "myflorida.gov", "description": "", "modified": "2022-04-01T00:01:54.852000", "created": "2022-03-03T04:48:12.379000", "tags": [], "references": [ "myflorida.gov.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 207, "URL": 422, "domain": 103, "FileHash-SHA256": 662, "CIDR": 3, "FileHash-MD5": 19 }, "indicator_count": 1416, "is_author": false, "is_subscribing": null, "subscriber_count": 405, "modified_text": "1524 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "www.ca.gov 08.27.2021.pdf", "TarrantCounty3df.pdf", "ncdoj.gov.pdf", "TarrantCounty9df.pdf", "TarrantCounty5df.pdf", "TarrantCounty17df.pdf", "TarrantCounty4df.pdf", "tarrantcounty.com:en:elections:Voter-Information:Voter- Registration.html%22,.pdf", "TarrantCounty10df.pdf", "dos.myflorida.com:elections.pdf", "TarrantCounty6df.pdf", "TarrantCounty21df.pdf", "TarantCounty2df.pdf", "tarrantcountydf.pdf", "TarrantCounty1df.pdf", "tarrantcounty8df.pdf", "TarrantCounty18df.pdf", "TarrantCounty20df.pdf", "TarrantCounty15df.pdf", "TarrantCounty12df.pdf", "tarrant23df.pdf", "tarrantcounty22df.pdf", "myflorida.gov.pdf", "TarrantCounty7df.pdf", "TarrantCounty14df.pdf", "TarrantCounty19df.pdf" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Ransom:win32/wannaren.a", "Win.ransomware.wannacry-9856297-0" ], "industries": [ "Government" ], "unique_indicators": 14392 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/googleapis.com", "whois": "http://whois.domaintools.com/googleapis.com", "domain": "googleapis.com", "hostname": "translate.googleapis.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 12, "pulses": [ { "id": "685afb805ba518e374abc735", "name": "Home - RMHS - Ransom", "description": "I can only imagine what is going on. This is a real organization, with a building, ever changing case workers who don\u2019t want to meet with clients in person . I have received several incoming concerns since 2021. It seems that a threat actor may be ringing along or certain people are being handled / investigated / silenced and closely monitored by a very large interconnected Cyber Intelligence entity \u2022 Trojan:X97M/ShellHide.C |\n\u2022 Trojan:PDF/Phish.RR!MTB |\n\u2022 Win.Trojan.Agent-370485 |\nAntivirus Detections:\n\u2022 Win.Trojan.Agent-370485\nYara: VirusWin32Span |\nAlerts\nransomware_file_modifications\nstealth_file\nDomains Contacted: Unknown\n(efbkfqpcdh.com) [\t\t\t\t2025-07-24T16:00:00\t14\t\n\nURL\nhttp://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel] #phishing #malware #intel? #trojan #infectiin", "modified": "2025-07-24T19:04:24.993000", "created": "2025-06-24T19:24:48.632000", "tags": [ "wordpress", "home", "rmhs og", "rmhs article", "wpbakery page", "builder", "slider plugin", "utc google", "tag manager", "g5cygkcj7g1", "dynamicloader", "ms windows", "intel", "users", "medium", "pe32", "search", "show", "windows", "videos", "music", "copy", "write", "next", "ford mustang", "converter pdf", "gt convertible", "trim", "models ford", "mustang coupe", "createdate", "producer solid", "filehash", "trojan", "format", "united", "moved", "passive dns", "ipv4 add", "pulse submit", "url analysis", "urls", "files", "location united", "america flag", "encrypt", "date", "sc onlogon", "write c", "port", "showing", "entries", "module load", "execution", "malware", "self", "reverse dns", "url https", "resource", "general full", "name value", "security tls", "hash", "san francisco", "june", "input", "form", "dom get", "search start", "get https", "post", "value", "variables", "msgoriginaltext", "msgoptions", "isns function", "setupns", "rsiw number", "rsih object", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "found", "spawns", "ck techniques", "flag", "markmonitor", "name server", "server", "rocky mountain", "human", "domain address", "enom", "copy sha256", "path", "copy md5", "copy sha1", "sha256", "size", "sha1", "attrib", "rowcycur", "hz4urdyi", "stop", "false", "soldier", "model", "youth", "baby", "core", "warrior", "green", "emotion", "flash", "nina", "hunk", "fono", "daam", "destination", "tlsv1", "dyndns domain", "irfan skiljan", "yara detections", "pdf pdf", "producer pdftk", "title data", "pulse pulses", "av detections", "ids detections", "alerts", "analysis date", "pictures", "read", "delete", "thumbprint", "graph summary", "url http", "gna7hdu", "g4 rsa4096", "adobe systems", "services1", "adobe product", "creatortool", "ascii text", "description svg", "scalable vector", "graphics image" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 34, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 56, "URL": 262, "hostname": 165, "FileHash-SHA256": 2141, "FileHash-MD5": 308, "FileHash-SHA1": 308, "SSLCertFingerprint": 3, "email": 1 }, "indicator_count": 3244, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "313 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657091a4533a832480459e15", "name": "dos.myflorida.com:elections", "description": "", "modified": "2023-12-06T15:22:12.430000", "created": "2023-12-06T15:22:12.430000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 809, "hostname": 160, "domain": 105, "URL": 434, "CIDR": 1, "FileHash-MD5": 9, "FileHash-SHA1": 1 }, "indicator_count": 1519, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570843b02a76f986c48cf1f", "name": "ncdoj.gov.", "description": "", "modified": "2023-12-06T14:24:59.025000", "created": "2023-12-06T14:24:59.025000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1037, "domain": 117, "hostname": 116, "URL": 266, "CIDR": 1, "FileHash-MD5": 19, "FileHash-SHA1": 4 }, "indicator_count": 1560, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708400230da39043d8f3eb", "name": "www.ca.gov_08.27.2021.", "description": "", "modified": "2023-12-06T14:24:00.576000", "created": "2023-12-06T14:24:00.576000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1081, "hostname": 288, "domain": 158, "URL": 699, "FileHash-MD5": 33, "CIDR": 3, "FileHash-SHA1": 1 }, "indicator_count": 2263, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657080d20f7e10c1e37fcf89", "name": "TarrantCounty.com ~ 03.01.2022", "description": "", "modified": "2023-12-06T14:10:26.301000", "created": "2023-12-06T14:10:26.301000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1078, "domain": 838, "hostname": 1607, "URL": 4134, "email": 3, "FileHash-SHA1": 2, "CIDR": 4, "FileHash-MD5": 15 }, "indicator_count": 7681, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707fecb6939e601d10efa6", "name": "myflorida.gov", "description": "", "modified": "2023-12-06T14:06:36.777000", "created": "2023-12-06T14:06:36.777000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 662, "domain": 103, "hostname": 207, "URL": 422, "CIDR": 3, "FileHash-MD5": 19 }, "indicator_count": 1416, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "656aa9afda328379fe4643ce", "name": "ncdoj.gov (Pulse by StremMiningEx)", "description": "", "modified": "2023-12-02T03:51:11.165000", "created": "2023-12-02T03:51:11.165000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "656a0e3e0117497d07a12ea5", "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 117, "hostname": 116, "URL": 266, "FileHash-SHA256": 1037, "CIDR": 1, "FileHash-MD5": 19, "FileHash-SHA1": 4 }, "indicator_count": 1560, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "914 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63012cdfb8b36960045a2deb", "name": "dos.myflorida.com:elections", "description": "", "modified": "2022-09-19T00:10:46.535000", "created": "2022-08-20T18:50:07.448000", "tags": [ "Ransomware" ], "references": [ "dos.myflorida.com:elections.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Ransom:Win32/Wannaren.A", "display_name": "Ransom:Win32/Wannaren.A", "target": "/malware/Ransom:Win32/Wannaren.A" } ], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 160, "URL": 435, "domain": 105, "FileHash-SHA256": 809, "CIDR": 1, "FileHash-MD5": 9, "FileHash-SHA1": 1 }, "indicator_count": 1520, "is_author": false, "is_subscribing": null, "subscriber_count": 404, "modified_text": "1353 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6231f4578903e31103502c87", "name": "www.ca.gov_08.27.2021.", "description": "", "modified": "2022-04-15T00:03:47.669000", "created": "2022-03-16T14:29:43.470000", "tags": [], "references": [ "www.ca.gov 08.27.2021.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 288, "URL": 700, "domain": 158, "FileHash-SHA256": 1081, "CIDR": 3, "FileHash-MD5": 33, "FileHash-SHA1": 1 }, "indicator_count": 2264, "is_author": false, "is_subscribing": null, "subscriber_count": 405, "modified_text": "1510 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "623241350f0a874e72533eb4", "name": "ncdoj.gov.", "description": "", "modified": "2022-04-15T00:03:47.669000", "created": "2022-03-16T19:57:41.379000", "tags": [ "WannaCry", "NCdoj.gov" ], "references": [ "ncdoj.gov.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Ransomware.WannaCry-9856297-0", "display_name": "Win.Ransomware.WannaCry-9856297-0", "target": null } ], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 117, "hostname": 116, "URL": 267, "FileHash-SHA256": 1037, "CIDR": 1, "FileHash-MD5": 19, "FileHash-SHA1": 4 }, "indicator_count": 1561, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1510 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://translate.googleapis.com/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://translate.googleapis.com/", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780499991.4070613 }