{ "type": "URL", "indicator": "https://tycip.live.fiba3x3vs.com/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://tycip.live.fiba3x3vs.com/", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4154237660, "indicator": "https://tycip.live.fiba3x3vs.com/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "692f04e9fa3d782118e94aac", "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed", "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.", "modified": "2026-01-01T15:04:20.907000", "created": "2025-12-02T15:25:29.158000", "tags": [ "levelblue", "open threat", "dynamicloader", "tlsv1", "high", "msie", "windows nt", "delete c", "fwlink", "stream", "powershell", "write", "malware", "local", "united", "flag", "date", "server", "crazy egg", "name server", "gmt flag", "domain address", "markmonitor", "enom", "sugges", "onv incude", "data upload", "find s", "extraction", "types", "type", "indicator", "click", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "dns requests", "contacted hosts", "search", "entries", "read c", "medium", "memcommit", "tls handshake", "failure", "module load", "next", "execution", "dock", "capture", "persistence", "copy", "unknown", "suricata alert", "et info", "bad traffic", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "adversaries", "spawns", "t1480 execution", "file defense", "write c", "x02x82", "xe6x15c6", "x16f", "xc0xc0xc0", "revengerat", "guard", "service", "encrypt", "entries yara", "delphi", "win32", "jordan", "delete app" ], "references": [ "https://otx.alienvault.com/indicator/domain/Tamlegal.com", "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz", "endgames.com \u2022 endgames.us \u2022 endgamesystems.com \u2022 http://www.onyx-ware.com/lander", "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Vmprotect-9880726-0", "display_name": "Win.Malware.Vmprotect-9880726-0", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" } ], "industries": [ "Technology", "Legal" ], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4624, "FileHash-SHA256": 2021, "FileHash-MD5": 51, "FileHash-SHA1": 20, "SSLCertFingerprint": 10, "hostname": 1433, "domain": 728 }, "indicator_count": 8887, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "108 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "692e2d950ac7d1e2a3454a4f", "name": "Gooogle Accounts | Drive-by Compromise \u2022 Ransomware \u2022 Phishing Attack", "description": "Google accounts Drive-by Compromise. Affected Google accounts redirects to a suspicious non - Google homepage. |\nRansomware | Adware | Phishing | Injection | \nExploits seen affecting both OS and iOS devices. Threat actors able to remotely access iOS device, unlock, access iCloud. System root control, fully infected devices, Attackers continue to ravage devices w/ drive by compromise, unsafe adware, malware text, etc., Seeks to remove malicious IoC\u2019s on mock accounts , password stealers", "modified": "2025-12-31T23:04:59.378000", "created": "2025-12-02T00:06:45.807000", "tags": [ "iocs", "drop", "network traffic", "ck id", "mitre att", "ck matrix", "network related", "detected", "t1566", "t1204", "united", "click", "windir", "openurl c", "prefetch2", "tor analysis", "dns requests", "learn", "suspicious", "informative", "name tactics", "adversaries", "command", "initial access", "spawns", "found", "binary file", "t1189", "regsetvalueexa", "regdword", "post http", "medium", "high", "regbinary", "loader", "dock", "write", "malware", "unknown", "romania unknown", "present may", "msie", "chrome", "body", "passive dns", "ip address", "present jun", "welcome", "accept", "encrypt", "gmt content", "ipv4 add", "url analysis", "urls", "files", "reverse dns", "unknown aaaa", "certificate", "hostname add", "error", "flag", "domain address", "contacted hosts", "type", "india unknown", "record value", "body html", "head title", "title", "entries", "read c", "high defense", "evasion", "yara detections", "virtool", "win32", "ahmann", "hacker group", "law firm", "order", "google", "smart assembly" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "VirTool:MSIL/Injector.BF", "display_name": "VirTool:MSIL/Injector.BF", "target": "/malware/VirTool:MSIL/Injector.BF" }, { "id": "Other Malware", "display_name": "Other Malware", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1087", "name": "Account Discovery", "display_name": "T1087 - Account Discovery" }, { "id": "T1087.003", "name": "Email Account", "display_name": "T1087.003 - Email Account" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" }, { "id": "T1459", "name": "Device Unlock Code Guessing or Brute Force", "display_name": "T1459 - Device Unlock Code Guessing or Brute Force" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 115, "FileHash-SHA1": 112, "FileHash-SHA256": 589, "URL": 1795, "SSLCertFingerprint": 3, "domain": 319, "hostname": 847, "email": 1 }, "indicator_count": 3781, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "108 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "692cb6dc24da17618e3d9da6", "name": "Mirai Botnet | HackTool Powershell targets LinkedIn User | 192.168.1.1 \u2022 Remote Inbound Outbound Connection", "description": "Linux Malware - LinkedIn- True Mirai Botnet (192.168.1.1) (Never Connect) Incredibly powerful attack targeting LinkedIn users. In this instance the target is an ex husband of a target. |\nNDO Group relationships seen. This is a Botnet. \n\nMay be \u2018framing\u2019 attack that was launched in 2014. Attackers sent a clear message to target that she + husband would be arrested and charged with possession of 1000\u2019s of \u2018child pornography\u2019 pictures. \n\nAttack 10/10 malicious. Worked from separate system in separate location. Hackers unlocked a device, zero clicks, removed PSW. Tulach malware seen a profile \u2018Michael Robert\u2019s of Rexxfield\u2019 may be entity (NSA) with a face like Tulach. Uses the most WILD compromises. Government contractors? \n\nSame attackers brought down Prudentials \u2018Assurance\u2019 Medicare system forever.\n ESET hackers only allowing \u2018bad traffic\u2019 .", "modified": "2025-12-30T19:04:40.430000", "created": "2025-11-30T21:27:56.239000", "tags": [ "enter", "extract", "enter source", "urls", "address", "remote connect", "private ip", "sql", "inject", "montserrat", "script urls", "germany unknown", "xml title", "wiesinger", "style", "ip address", "script domains", "body doctype", "encrypt", "botnet", "dropper", "unix", "resolverror", "et exploit", "outbound", "mirai variant", "useragent", "inbound", "et trojan", "et webserver", "scan mirai", "hello", "execution", "mirai", "malware", "shell", "nids", "ids detections", "wget command", "http headers", "dlink devices", "home network", "mvpower dvr", "shell uce", "mirai elf", "linux malware", "is__elf", "cnc", "meta http", "content", "gmt server", "files", "reverse dns", "germany", "ismaning", "germany asn", "as5539 spacenet", "germany https", "auto generated security (?)", "redacted for", "name servers", "aaaa", "search", "for privacy", "title", "intel", "ms windows", "pe32", "process32nextw", "write c", "mssql port", "hash", "beapy", "bit32bit", "agent", "write", "hacktool", "win32", "next", "suspicious user", "pybeapy cnc", "checkin", "w32beapy cnc", "beacon", "module load", "external ip", "lookup", "home assistant", "intptr", "uint32", "type", "parameter", "oldprotectflag", "mandatory", "throw", "position", "lkshkdandl", "success", "info", "powershell", "null", "error", "date hash", "next yara", "detections name", "medium", "graph tree", "sample", "sample hash", "exec bypass", "c ipconfig", "world", "jaws webserver", "chmod usage", "strings", "extraction", "data upload", "extre", "include data", "hos hos", "y se", "sugges", "find s", "typ hos", "hos data", "hos hostname", "hos host", "extr data", "tethering", "tulach", "114.114.114.114", "passive dns", "pulse pulses", "http", "related nids", "files location", "united", "flag united", "files domain", "next associated", "ipv4 add", "delphi", "read c", "packing t1045", "t1045", "worm", "code", "june", "irc nick command", "irc", "meta", "status", "record value", "unknown aaaa", "expiration", "url http", "indicator role", "pulses url", "no expiration", "url https", "url url", "o url", "request review", "hosting", "unknown", "medium security", "extra data", "failed", "linkedin", "url add", "ireland flag", "ireland", "dublin", "ireland asn", "as16509", "spyware", "nso", "nso group", "pegasus related", "nso related", "framing", "porn", "python", "flag", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "dns requests", "domain address", "contacted hosts", "apple", "192.168.1.1", "law", "attorney" ], "references": [ "192.168.1.1 - WOW! Use your old equipment in a non - residential environment", "http://xn.com/ \u2022 www.xn--linkedinxn-6u6e.com \u2022 http://www.linkedin-xn.com/ \u2022 www.linkedin-xn.com", "Powerful Exploit: https://otx.alienvault.com/indicator/file/ba32802bdd1f0b91cf8c667b94426d73ee654ba0", "Mirai Botnet - *Inbound & Outbound connection", "IDS Detections: *WGET Command Specifying Output in HTTP Headers", "IDS Detections: *D-Link Devices Home Network Administration Protocol Command Execution", "IDS Detections: *JAWS Webserver Unauthenticated Shell Command Execution", "IDS Detections: *MVPower DVR Shell UCE *Mirai Variant User-Agent (Outbound)", "Yara : Yara Detections : SUSP_XORed_Mozilla , Linux_MiningSoftware , is__elf", "Alerts : dead_host nids_exploit_alert nids_malware_alert persistency_initd network_icmp", "Alerts : tcp_syn_scan nolookup_communication network_cnc_http network_http", "Alerts : network_http_post nids_alert chmod_syscall writes_to_stdout", "Other Mitre ATT&CK T1480 T1553.00 T1027.013 T1057 T1069.002 T1071\tT1071.004", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.pornhub.com/video/search?search=tsara+brashears", "http://www.anyxxxtube.net/search-porn/tsara-brashears", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "pornokind.vgt.pl \u2022 https://pornokind.vgt.pl \u2022 https://www.pornokind.vgt.pl \u2022 https://www.pornokind.vgt.pl/", "pornlynx.com \u2022 www.pornhub.com \u2022 www.anyxxxtube.com", "https://frostty12ice.info/ \u2022 https://lawhubh.info", "Needs researching: http://lib.jerusalem.muni.il.il \u2022 https://lib.jerusalem.muni.il.il" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Unix.Dropper.Botnet-6566040-0", "display_name": "Unix.Dropper.Botnet-6566040-0", "target": null }, { "id": "NIDS", "display_name": "NIDS", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Montserrat", "display_name": "Montserrat", "target": null }, { "id": "Beapy", "display_name": "Beapy", "target": null }, { "id": "HackTool:Win32/PowerSploit!rfn", "display_name": "HackTool:Win32/PowerSploit!rfn", "target": "/malware/HackTool:Win32/PowerSploit!rfn" }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Worm:Win32/Mydoom.PB!MTB", "display_name": "Worm:Win32/Mydoom.PB!MTB", "target": "/malware/Worm:Win32/Mydoom.PB!MTB" } ], "attack_ids": [ { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "TA0036", "name": "Exfiltration", "display_name": "TA0036 - Exfiltration" }, { "id": "TA0039", "name": "Remote Service Effects", "display_name": "TA0039 - Remote Service Effects" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1016.001", "name": "Internet Connection Discovery", "display_name": "T1016.001 - Internet Connection Discovery" }, { "id": "T1583.004", "name": "Server", "display_name": "T1583.004 - Server" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1098", "name": "Account Manipulation", "display_name": "T1098 - Account Manipulation" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1019", "name": "System Firmware", "display_name": "T1019 - System Firmware" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553.001", "name": "Gatekeeper Bypass", "display_name": "T1553.001 - Gatekeeper Bypass" }, { "id": "T1027.005", "name": "Indicator Removal from Tools", "display_name": "T1027.005 - Indicator Removal from Tools" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1585.001", "name": "Social Media Accounts", "display_name": "T1585.001 - Social Media Accounts" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1609", "name": "Container Administration Command", "display_name": "T1609 - Container Administration Command" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1059.006", "name": "Python", "display_name": "T1059.006 - Python" } ], "industries": [ "Government", "Legal", "Healthcare", "Insurance", "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4147, "domain": 871, "hostname": 2194, "FileHash-MD5": 279, "FileHash-SHA1": 257, "FileHash-SHA256": 2183, "CVE": 6, "email": 3, "SSLCertFingerprint": 1 }, "indicator_count": 9941, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "109 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6927ed9849e14dfc59441aba", "name": "ET MALWARE PPI User-Agent (InstallCapital) Targets media personality", "description": "ET MALWARE PPI User-Agent (InstallCapital) Targets a media personality. Tip: Issues noticed when a fan attempted to maneuver through website. A blank page prevented fan from going or wanting to continue exploring the website given the recent content discussed on \u2018 The Candace Owen\u2019s\u2019 YouTube channel. I reviewed several shows over the past several months without noticing an issue. I\u2019ve never been to her website. I believe Candace Owens is likely promoting true information about being targeted. I experienced an issue re: Tucker Carlson prior to several allegations of being targeted. There is a \u2018List\u2019. It\u2019s seriously unsettling.", "modified": "2025-12-26T00:03:48.113000", "created": "2025-11-27T06:20:08.719000", "tags": [ "installcap", "ir ei", "malware ppi", "useragent", "cap cure", "ip unknown", "udp include", "top source", "top destination", "source source", "dynamicloader", "yara detections", "dynamic", "pe section", "av detections", "ids detections", "ransom", "code overlap", "regdword", "search", "show", "medium", "post http", "regbinary", "gb st", "salford o", "virtool", "malware", "dock", "loader", "downloader", "write", "suspicious", "win32" ], "references": [ "Domain Targeted: https://candaceowens.com/", "Detections ET MALWARE PPI User-Agent (InstallCapital)", "Yara Detections : RansomWin32Stampado CodeOverlap TrojanWin32Genkrypet | CodeOverlap", "Domains Contacted : kiss.oatmealscene.loan \u2022 won.channeltest.bid", "IDS Detections : Win32/AdWare.ICLoader Variant Checkin Suspicious (Virtool:Win32/Obfuscator.AOY)", "IDS Detections : User-Agent containing Loader Observed (Virtool:Win32/Obfuscator.AOY)", "Yara Detections RansomWin32Stampado , TrojanWin32Genkrypet", "Tucker Carlson Pulse : https://otx.alienvault.com/pulse/68c73fbd85dfbb4d41006ad1", "Tucker Carlson : palander.stjernstrom.se \u2022 containers-chupalla.palantirfedstart.com", "It\u2019s still illegal to murder , intimidate , harass or threaten harm. It\u2019s happening anyway.", "It\u2019s not illegal to research , examine results, report , share or warn.", "It seems as Palantir has taken over as Commander & Chief and US government infrastructure.", "There has been an unsettling uptick in physical violence against one Colorado targets family." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "ALFPER:InstallCapital", "display_name": "ALFPER:InstallCapital", "target": null }, { "id": "Virtool:Win32/Obfuscator.AOY", "display_name": "Virtool:Win32/Obfuscator.AOY", "target": "/malware/Virtool:Win32/Obfuscator.AOY" } ], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" } ], "industries": [ "Media" ], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 260, "domain": 70, "URL": 481, "FileHash-SHA256": 166, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 1037, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "114 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "It\u2019s still illegal to murder , intimidate , harass or threaten harm. It\u2019s happening anyway.", "IDS Detections: *JAWS Webserver Unauthenticated Shell Command Execution", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "Domain Targeted: https://candaceowens.com/", "Tucker Carlson Pulse : https://otx.alienvault.com/pulse/68c73fbd85dfbb4d41006ad1", "IDS Detections: *MVPower DVR Shell UCE *Mirai Variant User-Agent (Outbound)", "IDS Detections: *WGET Command Specifying Output in HTTP Headers", "Yara Detections : RansomWin32Stampado CodeOverlap TrojanWin32Genkrypet | CodeOverlap", "Detections ET MALWARE PPI User-Agent (InstallCapital)", "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev", "Powerful Exploit: https://otx.alienvault.com/indicator/file/ba32802bdd1f0b91cf8c667b94426d73ee654ba0", "Tucker Carlson : palander.stjernstrom.se \u2022 containers-chupalla.palantirfedstart.com", "Domains Contacted : kiss.oatmealscene.loan \u2022 won.channeltest.bid", "Yara : Yara Detections : SUSP_XORed_Mozilla , Linux_MiningSoftware , is__elf", "http://xn.com/ \u2022 www.xn--linkedinxn-6u6e.com \u2022 http://www.linkedin-xn.com/ \u2022 www.linkedin-xn.com", "https://www.pornhub.com/video/search?search=tsara+brashears", "Needs researching: http://lib.jerusalem.muni.il.il \u2022 https://lib.jerusalem.muni.il.il", "https://otx.alienvault.com/indicator/domain/Tamlegal.com", "Alerts : network_http_post nids_alert chmod_syscall writes_to_stdout", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "pornlynx.com \u2022 www.pornhub.com \u2022 www.anyxxxtube.com", "IDS Detections : User-Agent containing Loader Observed (Virtool:Win32/Obfuscator.AOY)", "https://frostty12ice.info/ \u2022 https://lawhubh.info", "192.168.1.1 - WOW! Use your old equipment in a non - residential environment", "IDS Detections: *D-Link Devices Home Network Administration Protocol Command Execution", "It seems as Palantir has taken over as Commander & Chief and US government infrastructure.", "It\u2019s not illegal to research , examine results, report , share or warn.", "http://www.anyxxxtube.net/search-porn/tsara-brashears", "Alerts : tcp_syn_scan nolookup_communication network_cnc_http network_http", "There has been an unsettling uptick in physical violence against one Colorado targets family.", "Mirai Botnet - *Inbound & Outbound connection", "Yara Detections RansomWin32Stampado , TrojanWin32Genkrypet", "Other Mitre ATT&CK T1480 T1553.00 T1027.013 T1057 T1069.002 T1071\tT1071.004", "endgames.com \u2022 endgames.us \u2022 endgamesystems.com \u2022 http://www.onyx-ware.com/lander", "IDS Detections : Win32/AdWare.ICLoader Variant Checkin Suspicious (Virtool:Win32/Obfuscator.AOY)", "Alerts : dead_host nids_exploit_alert nids_malware_alert persistency_initd network_icmp", "pornokind.vgt.pl \u2022 https://pornokind.vgt.pl \u2022 https://www.pornokind.vgt.pl \u2022 https://www.pornokind.vgt.pl/", "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Virtool:msil/injector.bf", "Montserrat", "Alfper:installcapital", "Other malware", "Tulach", "Virtool:win32/obfuscator.aoy", "Win.malware.vmprotect-9880726-0", "Worm:win32/mydoom.pb!mtb", "Ransomware", "Beapy", "Hacktool:win32/powersploit!rfn", "Nids", "Unix.dropper.botnet-6566040-0", "Mirai" ], "industries": [ "Legal", "Civil society", "Media", "Insurance", "Government", "Healthcare", "Technology" ], "unique_indicators": 21835 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/fiba3x3vs.com", "whois": "http://whois.domaintools.com/fiba3x3vs.com", "domain": "fiba3x3vs.com", "hostname": "tycip.live.fiba3x3vs.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "692f04e9fa3d782118e94aac", "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed", "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.", "modified": "2026-01-01T15:04:20.907000", "created": "2025-12-02T15:25:29.158000", "tags": [ "levelblue", "open threat", "dynamicloader", "tlsv1", "high", "msie", "windows nt", "delete c", "fwlink", "stream", "powershell", "write", "malware", "local", "united", "flag", "date", "server", "crazy egg", "name server", "gmt flag", "domain address", "markmonitor", "enom", "sugges", "onv incude", "data upload", "find s", "extraction", "types", "type", "indicator", "click", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "dns requests", "contacted hosts", "search", "entries", "read c", "medium", "memcommit", "tls handshake", "failure", "module load", "next", "execution", "dock", "capture", "persistence", "copy", "unknown", "suricata alert", "et info", "bad traffic", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "adversaries", "spawns", "t1480 execution", "file defense", "write c", "x02x82", "xe6x15c6", "x16f", "xc0xc0xc0", "revengerat", "guard", "service", "encrypt", "entries yara", "delphi", "win32", "jordan", "delete app" ], "references": [ "https://otx.alienvault.com/indicator/domain/Tamlegal.com", "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz", "endgames.com \u2022 endgames.us \u2022 endgamesystems.com \u2022 http://www.onyx-ware.com/lander", "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Malware.Vmprotect-9880726-0", "display_name": "Win.Malware.Vmprotect-9880726-0", "target": null }, { "id": "Other Malware", "display_name": "Other Malware", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" } ], "industries": [ "Technology", "Legal" ], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4624, "FileHash-SHA256": 2021, "FileHash-MD5": 51, "FileHash-SHA1": 20, "SSLCertFingerprint": 10, "hostname": 1433, "domain": 728 }, "indicator_count": 8887, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "108 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "692e2d950ac7d1e2a3454a4f", "name": "Gooogle Accounts | Drive-by Compromise \u2022 Ransomware \u2022 Phishing Attack", "description": "Google accounts Drive-by Compromise. Affected Google accounts redirects to a suspicious non - Google homepage. |\nRansomware | Adware | Phishing | Injection | \nExploits seen affecting both OS and iOS devices. Threat actors able to remotely access iOS device, unlock, access iCloud. System root control, fully infected devices, Attackers continue to ravage devices w/ drive by compromise, unsafe adware, malware text, etc., Seeks to remove malicious IoC\u2019s on mock accounts , password stealers", "modified": "2025-12-31T23:04:59.378000", "created": "2025-12-02T00:06:45.807000", "tags": [ "iocs", "drop", "network traffic", "ck id", "mitre att", "ck matrix", "network related", "detected", "t1566", "t1204", "united", "click", "windir", "openurl c", "prefetch2", "tor analysis", "dns requests", "learn", "suspicious", "informative", "name tactics", "adversaries", "command", "initial access", "spawns", "found", "binary file", "t1189", "regsetvalueexa", "regdword", "post http", "medium", "high", "regbinary", "loader", "dock", "write", "malware", "unknown", "romania unknown", "present may", "msie", "chrome", "body", "passive dns", "ip address", "present jun", "welcome", "accept", "encrypt", "gmt content", "ipv4 add", "url analysis", "urls", "files", "reverse dns", "unknown aaaa", "certificate", "hostname add", "error", "flag", "domain address", "contacted hosts", "type", "india unknown", "record value", "body html", "head title", "title", "entries", "read c", "high defense", "evasion", "yara detections", "virtool", "win32", "ahmann", "hacker group", "law firm", "order", "google", "smart assembly" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "VirTool:MSIL/Injector.BF", "display_name": "VirTool:MSIL/Injector.BF", "target": "/malware/VirTool:MSIL/Injector.BF" }, { "id": "Other Malware", "display_name": "Other Malware", "target": null }, { "id": "Ransomware", "display_name": "Ransomware", "target": null } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1087", "name": "Account Discovery", "display_name": "T1087 - Account Discovery" }, { "id": "T1087.003", "name": "Email Account", "display_name": "T1087.003 - Email Account" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1110.002", "name": "Password Cracking", "display_name": "T1110.002 - Password Cracking" }, { "id": "T1459", "name": "Device Unlock Code Guessing or Brute Force", "display_name": "T1459 - Device Unlock Code Guessing or Brute Force" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 115, "FileHash-SHA1": 112, "FileHash-SHA256": 589, "URL": 1795, "SSLCertFingerprint": 3, "domain": 319, "hostname": 847, "email": 1 }, "indicator_count": 3781, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "108 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "692cb6dc24da17618e3d9da6", "name": "Mirai Botnet | HackTool Powershell targets LinkedIn User | 192.168.1.1 \u2022 Remote Inbound Outbound Connection", "description": "Linux Malware - LinkedIn- True Mirai Botnet (192.168.1.1) (Never Connect) Incredibly powerful attack targeting LinkedIn users. In this instance the target is an ex husband of a target. |\nNDO Group relationships seen. This is a Botnet. \n\nMay be \u2018framing\u2019 attack that was launched in 2014. Attackers sent a clear message to target that she + husband would be arrested and charged with possession of 1000\u2019s of \u2018child pornography\u2019 pictures. \n\nAttack 10/10 malicious. Worked from separate system in separate location. Hackers unlocked a device, zero clicks, removed PSW. Tulach malware seen a profile \u2018Michael Robert\u2019s of Rexxfield\u2019 may be entity (NSA) with a face like Tulach. Uses the most WILD compromises. Government contractors? \n\nSame attackers brought down Prudentials \u2018Assurance\u2019 Medicare system forever.\n ESET hackers only allowing \u2018bad traffic\u2019 .", "modified": "2025-12-30T19:04:40.430000", "created": "2025-11-30T21:27:56.239000", "tags": [ "enter", "extract", "enter source", "urls", "address", "remote connect", "private ip", "sql", "inject", "montserrat", "script urls", "germany unknown", "xml title", "wiesinger", "style", "ip address", "script domains", "body doctype", "encrypt", "botnet", "dropper", "unix", "resolverror", "et exploit", "outbound", "mirai variant", "useragent", "inbound", "et trojan", "et webserver", "scan mirai", "hello", "execution", "mirai", "malware", "shell", "nids", "ids detections", "wget command", "http headers", "dlink devices", "home network", "mvpower dvr", "shell uce", "mirai elf", "linux malware", "is__elf", "cnc", "meta http", "content", "gmt server", "files", "reverse dns", "germany", "ismaning", "germany asn", "as5539 spacenet", "germany https", "auto generated security (?)", "redacted for", "name servers", "aaaa", "search", "for privacy", "title", "intel", "ms windows", "pe32", "process32nextw", "write c", "mssql port", "hash", "beapy", "bit32bit", "agent", "write", "hacktool", "win32", "next", "suspicious user", "pybeapy cnc", "checkin", "w32beapy cnc", "beacon", "module load", "external ip", "lookup", "home assistant", "intptr", "uint32", "type", "parameter", "oldprotectflag", "mandatory", "throw", "position", "lkshkdandl", "success", "info", "powershell", "null", "error", "date hash", "next yara", "detections name", "medium", "graph tree", "sample", "sample hash", "exec bypass", "c ipconfig", "world", "jaws webserver", "chmod usage", "strings", "extraction", "data upload", "extre", "include data", "hos hos", "y se", "sugges", "find s", "typ hos", "hos data", "hos hostname", "hos host", "extr data", "tethering", "tulach", "114.114.114.114", "passive dns", "pulse pulses", "http", "related nids", "files location", "united", "flag united", "files domain", "next associated", "ipv4 add", "delphi", "read c", "packing t1045", "t1045", "worm", "code", "june", "irc nick command", "irc", "meta", "status", "record value", "unknown aaaa", "expiration", "url http", "indicator role", "pulses url", "no expiration", "url https", "url url", "o url", "request review", "hosting", "unknown", "medium security", "extra data", "failed", "linkedin", "url add", "ireland flag", "ireland", "dublin", "ireland asn", "as16509", "spyware", "nso", "nso group", "pegasus related", "nso related", "framing", "porn", "python", "flag", "windir", "openurl c", "prefetch2", "analysis", "tor analysis", "dns requests", "domain address", "contacted hosts", "apple", "192.168.1.1", "law", "attorney" ], "references": [ "192.168.1.1 - WOW! Use your old equipment in a non - residential environment", "http://xn.com/ \u2022 www.xn--linkedinxn-6u6e.com \u2022 http://www.linkedin-xn.com/ \u2022 www.linkedin-xn.com", "Powerful Exploit: https://otx.alienvault.com/indicator/file/ba32802bdd1f0b91cf8c667b94426d73ee654ba0", "Mirai Botnet - *Inbound & Outbound connection", "IDS Detections: *WGET Command Specifying Output in HTTP Headers", "IDS Detections: *D-Link Devices Home Network Administration Protocol Command Execution", "IDS Detections: *JAWS Webserver Unauthenticated Shell Command Execution", "IDS Detections: *MVPower DVR Shell UCE *Mirai Variant User-Agent (Outbound)", "Yara : Yara Detections : SUSP_XORed_Mozilla , Linux_MiningSoftware , is__elf", "Alerts : dead_host nids_exploit_alert nids_malware_alert persistency_initd network_icmp", "Alerts : tcp_syn_scan nolookup_communication network_cnc_http network_http", "Alerts : network_http_post nids_alert chmod_syscall writes_to_stdout", "Other Mitre ATT&CK T1480 T1553.00 T1027.013 T1057 T1069.002 T1071\tT1071.004", "https://www.anyxxxtube.net/search-porn/tsara-brashears/", "https://www.pornhub.com/video/search?search=tsara+brashears", "http://www.anyxxxtube.net/search-porn/tsara-brashears", "http://www.anyxxxtube.net/search-porn/tsara-brashears/", "pornokind.vgt.pl \u2022 https://pornokind.vgt.pl \u2022 https://www.pornokind.vgt.pl \u2022 https://www.pornokind.vgt.pl/", "pornlynx.com \u2022 www.pornhub.com \u2022 www.anyxxxtube.com", "https://frostty12ice.info/ \u2022 https://lawhubh.info", "Needs researching: http://lib.jerusalem.muni.il.il \u2022 https://lib.jerusalem.muni.il.il" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Unix.Dropper.Botnet-6566040-0", "display_name": "Unix.Dropper.Botnet-6566040-0", "target": null }, { "id": "NIDS", "display_name": "NIDS", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Montserrat", "display_name": "Montserrat", "target": null }, { "id": "Beapy", "display_name": "Beapy", "target": null }, { "id": "HackTool:Win32/PowerSploit!rfn", "display_name": "HackTool:Win32/PowerSploit!rfn", "target": "/malware/HackTool:Win32/PowerSploit!rfn" }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Worm:Win32/Mydoom.PB!MTB", "display_name": "Worm:Win32/Mydoom.PB!MTB", "target": "/malware/Worm:Win32/Mydoom.PB!MTB" } ], "attack_ids": [ { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "TA0036", "name": "Exfiltration", "display_name": "TA0036 - Exfiltration" }, { "id": "TA0039", "name": "Remote Service Effects", "display_name": "TA0039 - Remote Service Effects" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1016.001", "name": "Internet Connection Discovery", "display_name": "T1016.001 - Internet Connection Discovery" }, { "id": "T1583.004", "name": "Server", "display_name": "T1583.004 - Server" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1098", "name": "Account Manipulation", "display_name": "T1098 - Account Manipulation" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1019", "name": "System Firmware", "display_name": "T1019 - System Firmware" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553.001", "name": "Gatekeeper Bypass", "display_name": "T1553.001 - Gatekeeper Bypass" }, { "id": "T1027.005", "name": "Indicator Removal from Tools", "display_name": "T1027.005 - Indicator Removal from Tools" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1585.001", "name": "Social Media Accounts", "display_name": "T1585.001 - Social Media Accounts" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1609", "name": "Container Administration Command", "display_name": "T1609 - Container Administration Command" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1059.006", "name": "Python", "display_name": "T1059.006 - Python" } ], "industries": [ "Government", "Legal", "Healthcare", "Insurance", "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4147, "domain": 871, "hostname": 2194, "FileHash-MD5": 279, "FileHash-SHA1": 257, "FileHash-SHA256": 2183, "CVE": 6, "email": 3, "SSLCertFingerprint": 1 }, "indicator_count": 9941, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "109 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6927ed9849e14dfc59441aba", "name": "ET MALWARE PPI User-Agent (InstallCapital) Targets media personality", "description": "ET MALWARE PPI User-Agent (InstallCapital) Targets a media personality. Tip: Issues noticed when a fan attempted to maneuver through website. A blank page prevented fan from going or wanting to continue exploring the website given the recent content discussed on \u2018 The Candace Owen\u2019s\u2019 YouTube channel. I reviewed several shows over the past several months without noticing an issue. I\u2019ve never been to her website. I believe Candace Owens is likely promoting true information about being targeted. I experienced an issue re: Tucker Carlson prior to several allegations of being targeted. There is a \u2018List\u2019. It\u2019s seriously unsettling.", "modified": "2025-12-26T00:03:48.113000", "created": "2025-11-27T06:20:08.719000", "tags": [ "installcap", "ir ei", "malware ppi", "useragent", "cap cure", "ip unknown", "udp include", "top source", "top destination", "source source", "dynamicloader", "yara detections", "dynamic", "pe section", "av detections", "ids detections", "ransom", "code overlap", "regdword", "search", "show", "medium", "post http", "regbinary", "gb st", "salford o", "virtool", "malware", "dock", "loader", "downloader", "write", "suspicious", "win32" ], "references": [ "Domain Targeted: https://candaceowens.com/", "Detections ET MALWARE PPI User-Agent (InstallCapital)", "Yara Detections : RansomWin32Stampado CodeOverlap TrojanWin32Genkrypet | CodeOverlap", "Domains Contacted : kiss.oatmealscene.loan \u2022 won.channeltest.bid", "IDS Detections : Win32/AdWare.ICLoader Variant Checkin Suspicious (Virtool:Win32/Obfuscator.AOY)", "IDS Detections : User-Agent containing Loader Observed (Virtool:Win32/Obfuscator.AOY)", "Yara Detections RansomWin32Stampado , TrojanWin32Genkrypet", "Tucker Carlson Pulse : https://otx.alienvault.com/pulse/68c73fbd85dfbb4d41006ad1", "Tucker Carlson : palander.stjernstrom.se \u2022 containers-chupalla.palantirfedstart.com", "It\u2019s still illegal to murder , intimidate , harass or threaten harm. It\u2019s happening anyway.", "It\u2019s not illegal to research , examine results, report , share or warn.", "It seems as Palantir has taken over as Commander & Chief and US government infrastructure.", "There has been an unsettling uptick in physical violence against one Colorado targets family." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "ALFPER:InstallCapital", "display_name": "ALFPER:InstallCapital", "target": null }, { "id": "Virtool:Win32/Obfuscator.AOY", "display_name": "Virtool:Win32/Obfuscator.AOY", "target": "/malware/Virtool:Win32/Obfuscator.AOY" } ], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" } ], "industries": [ "Media" ], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 260, "domain": 70, "URL": 481, "FileHash-SHA256": 166, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 1037, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "114 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://tycip.live.fiba3x3vs.com/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://tycip.live.fiba3x3vs.com/", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776611790.3241367 }