{ "type": "URL", "indicator": "https://vercel.app", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://vercel.app", "type": "url", "type_title": "URL", "validation": [ { "source": "majestic", "message": "Whitelisted domain vercel.app", "name": "Whitelisted domain" } ], "base_indicator": { "id": 4186920587, "indicator": "https://vercel.app", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "6a1b57af6e1986d0628bca12", "name": "SystemBC RAT, Quant Loader, and LogMeIn.com, combined to execute a multi-stage Corporate Styled Network Intrusion", "description": "\"Living off the Land\" Takeover (LogMeIn.com)\u201c\nINCIDENT REPORT: HIGH-VALUE TARGET NETWORK INTRUSION Threat Profile: Human-operated corporate-grade attack chain targeting an isolated device.Vector: Local network exposure (compromised router/neighboring device) or physical media (USB).Attack Chain Stages:Quant Script: Obfuscated entry file bypassing network filters.SystemBC RAT: Creates a silent, persistent SOCKS5/Tor tunnel for attacker commands.LogMeIn Abuse: Attackers use legitimate remote software to control the device undetected.Crowti (CryptoWall): Final ransomware payload to encrypt high-value data.Key Observations: Because the target device lacked direct internet access, adversaries are actively abusing the local network infrastructure or physical proximity to bridge the gap. \n\nI\u2019m open to other opinions regarding this report. I have been unwell and my thinking has been unclear and even off as I focus on getting well.\nThank you.", "modified": "2026-05-30T21:33:35.237000", "created": "2026-05-30T21:33:35.237000", "tags": [ "united", "unknown aaaa", "servers", "certificate", "urls", "logmein", "ipv4", "url analysis", "files", "america flag", "level", "data upload", "extraction", "failed", "enter sc", "extri data", "include review", "stop typ", "domain don", "united states", "america asn", "net20525119201", "amazon data", "net20525119202", "address range", "cidr", "network name", "allocation type", "whois server", "entity adsn1", "handle", "sc data", "netherlands asn", "as204601 zomro", "dns resolutions", "log id", "gmtn", "timestamp", "tls web", "expiresfri", "path", "httponly", "salford", "sectigo limited", "sectigo rsa", "accept", "organization", "false", "authentication", "ocsp", "c179044d", "b89a", "d4n timestamp", "df9b", "post na", "lredmond", "stwa", "cnmicrosoft tls", "g2 rsa", "ca ocsp", "rmm domain", "search", "flashpix", "write", "unknown", "malware", "encrypt", "high", "medium", "write c", "template", "registers", "moved", "record value", "tls sni", "observed rmm", "omicrosoft", "stwashington", "server ca", "extr data", "error", "a50 data", "pattern match", "ascii text", "mitre att", "ck id", "general", "local", "click", "strings", "u extractio", "extrac data", "learn", "command", "name tactics", "suspicious", "informative", "adversaries", "spawns", "signing defense", "discovery att", "code signing", "defense evasion", "t1480.002", "mrasn", "cachecontrol", "connection", "date tue", "gmt etag", "self", "etag w/\"leknjhepnj99sn\"", "name servers", "extre data", "observed dns", "query", "show", "localsm05208304", "localsm03520304", "title error", "all ipv4", "reverse dns", "as14618", "extraction data", "creato touc", "digice rsa", "sh certific", "hid iv", "trojandropper", "backdoor", "present may", "please", "x msedge", "exploit", "as8068", "av detection", "ratio", "ids detections", "content length", "content type", "x powered", "asn as16509", "x vercel", "vercel", "gmt content", "ransom", "dynamicloader", "msie", "windows nt", "wow64", "slcc2", "media center", "sysv", "buildid", "germany as8560", "yara detections", "contacted", "elf", "filehash", "av detections", "alerts", "analysis date", "file score", "low risk", "elf executable", "exec amd6464", "linux", "elf64 operation", "unix", "compiler", "elf info", "progbits", "offset size", "flags", "null", "hashes o", "get http", "post http", "entries", "trojan", "pegasus", "apple", "amazonaws", "smtp", "self-delete", "service-scan", "applayer", "madagascar", "qnapcrypt", "mal_elf_systembc_rat", "rat", "hacktool code", "systembc", "t1064", "create", "modify system", "process", "t1543 privile", "ta0004 cr", "t1543", "creation date", "whois show", "emails", "name logmein", "org logmein", "summer st", "date hash", "avast avg", "mtb jul", "k jun", "ai", "ai report", "appleremotesupport", "remotelyanywhere", "pegasus related" ], "references": [ "https://www.logmein.com/products/resolve \u2022 http://devices-iot.console.gotoresolve.com/", "https://adservice.google.com.uy/clk \u2022 adservice.google.com.uy", "Amazonaws.com \u2022 Amazon.com", "screenmaxxxing.com \u2022 wiki.xxkcamffk.cc \u2022 playfoundermode.com", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 www.anyxxxtube.net", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "103.246.145.111 \u2022 http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel", "13.107.226.70 \u2022 13.107.253.70 - Malware Hosting", "http://212.33.237.86/images/1/report.php", "http://watchhers.net/index.php", "remoteexecution-runner-api.services.gotoresolve.com", "firebaseremoteconfig.googleapis.com", "alerts-frontend-api-fd-stage.services-stage.gotoresolve.com", "alerts-monitor-api-fd-prodeu.services.gotoresolve.com", "testpaging SHA256 756f0b598741a6fdff640a158b6b490472e546d411da2850836b9a8ca76afdc1", "Yara Detections: is__elf", "IP\u2019s Contacted: 104.17.118.12 57.144.248.1 176.114.120.24 80.12.24.14 95.163.61.73 142.251.98.113 212.227.17.162 77.88.44.55 142.93.142.17 104.18.14.206", "Domains Contacted: checkip.amazonaws.com vk.com arena.ai www.yandex.ru stripchat.com", "Names: testpaging upof6w.exe", "Names: 2026-04-07_259af8b0d0bc540384a06bb730cee9cd_qnapcrypt ELF Info", "https://cdn.console.gotoresolve.com/applet", "Crowdsourced Signa: Matches rule Suspicious Outbound SMTP", "Suspicious DNS Query for IP post), Thomas Patzke Lookup Service APls by Brandon George (blog Crowdsourced)", "Crowdsourced IDS: Matches rule ET DROP Spamhaus DROP Listed Traffic Inbound group 60", "Matches rule ET INFO External IP Lookup Domain in DNS Lookup (checkip .amazonaws .com)", "Matches rule ET INFO External IP Check (checkip .amazonaws .com)", "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)", "Matches rule SURICATA Applayer Detect protocol only one direction", "SystemBC to map the backend network secretly, and a hijacked or fraudulent LogMeIn account ->", "to act as their human-controlled, \"living off the land\" command station.", "Attack ChainThreat actors chain these three specific components together to bypass traditional ->", "security filters:[Quant Script (Initial Drop)] \u2794 [SystemBC (SOCKS5/Tor Tunnel)] \u2794", "[LogMeIn.com (Legitimate Remote Access)] \u2794 [Ransomware]", "RaaS attack designed to deploy ransomware against \u2018high value\u2019 targets or corporations.", "In this specific attack chain, the threat actors use the Quant Loader script for initial entry,", "The Entry Vector (Quant Loader): A user interacts with a phishing link or malicious archive file.", "An obfuscated Quant Loader script runs natively in the background, evading anti-malware detection", "by pulling its primary files over public SMB shares.", "The Persistent Backdoor (SystemBC RAT): Quant Loader downloads and executes SystemBC.", "SystemBC sets up a scheduled task to stay persistent and opens a stealthy SOCKS5 proxy or Tor network tunnel.", "This lets the threat actor route malicious command traffic into the local corporate network undetected.", "Once inside the network, attackers avoid deploying more loud hacking tools & Download or abuse LogMeIn[.]com software.", "Because LogMeIn is a legitimate remote management tool used by actual IT departments,", "its outbound traffic to logmein.com domains looks completely normal to firewalls.", "The Objective: The hackers use the trusted LogMeIn connection to freely move laterally, steal data, turn off local security defenses, and deploy network-wide ransomware", "remoteexecution-runner-api.services.gotoresolve.com\t\u2022 appleremotesupport.com\t\u2022", "firebaseremoteconfig.googleapis.com \u2022 remoteexecution-runner-api.services.gotoresolve.com", "remotelyanywhere.com \u2022,http://watchhers.net/index.php \u2022 firebaseremoteconfig.googleapis.com", "appleremotesupport.com \u2022 remotelyanywhere.com", "Immediate Recommendations: Disconnect all routers and isolate the network.", "Air-gap the target device (disable Wi-Fi, pull cables). Expensive : Dispose of all devices.", "Change all credentials from a separate, clean network.", "If possible: Move to Switzerland" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Ransom:Win32/Crowti.A", "display_name": "Ransom:Win32/Crowti.A", "target": "/malware/Ransom:Win32/Crowti.A" }, { "id": "Trojan.Systembc/yxgdgz", "display_name": "Trojan.Systembc/yxgdgz", "target": null }, { "id": "TrojanSpy:Win32/Nivdort.CW", "display_name": "TrojanSpy:Win32/Nivdort.CW", "target": "/malware/TrojanSpy:Win32/Nivdort.CW" }, { "id": "Win.Downloader.Nemucod-6769668-0", "display_name": "Win.Downloader.Nemucod-6769668-0", "target": null }, { "id": "TrojanDownloader:JS/Swabfex.P", "display_name": "TrojanDownloader:JS/Swabfex.P", "target": "/malware/TrojanDownloader:JS/Swabfex.P" }, { "id": "Win.Downloader.Nemucod-6769668-0", "display_name": "Win.Downloader.Nemucod-6769668-0", "target": null }, { "id": "Doc.Downloader.EmotetRed02220-9938909-0", "display_name": "Doc.Downloader.EmotetRed02220-9938909-0", "target": null }, { "id": "TrojanDropper:Win32/Cutwail.gen!K", "display_name": "TrojanDropper:Win32/Cutwail.gen!K", "target": "/malware/TrojanDropper:Win32/Cutwail.gen!K" }, { "id": "Win.Trojan.Gh0stRAT-9955419-1", "display_name": "Win.Trojan.Gh0stRAT-9955419-1", "target": null }, { "id": "Win.Trojan.Hupigon-6989556-0", "display_name": "Win.Trojan.Hupigon-6989556-0", "target": null }, { "id": "ALF:Trojan:Win32/Cassini_6d4ebdc9!ibt", "display_name": "ALF:Trojan:Win32/Cassini_6d4ebdc9!ibt", "target": null }, { "id": "Win.Malware.Jaik-9968280-0", "display_name": "Win.Malware.Jaik-9968280-0", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "T1543.002", "name": "Systemd Service", "display_name": "T1543.002 - Systemd Service" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 275, "FileHash-SHA1": 243, "FileHash-SHA256": 1320, "URL": 897, "domain": 796, "email": 7, "hostname": 783, "IPv4": 446, "CIDR": 2, "SSLCertFingerprint": 33 }, "indicator_count": 4802, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "9 hours ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69770bdfbdd845a3d5cb2484", "name": "Drive-by Compromise | Rootkit installed on Apple Device", "description": "Drive-by Compromise | Rootkit installed on Apple Device | The devices in this example are obviously compromised. We tested a device another Apple device by viewing a Sprouts Farmers Market E-commerce website. The App crashed revealing the source of the issue. I admit that even though device is HEAVILY compromised by threat actors; it continued to preform.\nThis week the Apple devices have experienced a series of BLACK & PINK stutters One had the letter \u2018P\u2019. The most important part of the research is who & why someone targets victims of crime who are either deceased or catastrophically injured. One victims \u2018voice\u2019 has been captured and is now calling people she knew and creeping them out. \n\nAlso curious about the \u2018Hello\u2019 api lineages. Malware packed. Check-ins & Bot Network found.\n\n[OTX auto populated- Here is the full list of URLs from the 20th anniversary of the birth of Daylin Olson, who was born and raised in New York in the US, and who he is now.]\n\n#stop", "modified": "2026-02-25T06:02:12.072000", "created": "2026-01-26T06:38:23.334000", "tags": [ "url https", "url http", "netherlands", "france", "united", "canada", "spain", "ascii text", "pattern match", "mitre att", "ck id", "null", "refresh", "title", "span", "hybrid", "general", "local", "path", "strings", "error", "tools", "look", "verify", "restart", "meta", "form", "bad traffic", "et info", "tls handshake", "failure", "flag", "windir", "openurl c", "prefetch2", "analysis", "ck matrix", "href", "network traffic", "encrypt", "learn", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "ssl certificate", "initial access", "zerobits", "allocationtype", "protect", "programfiles", "processhandle", "commitsize", "viewsize", "regionsize", "viewsize d5000", "viewsize c9000", "phishing", "filehandle", "report uid", "handles modules", "files amsi", "streams", "path filehandle", "porthandle", "modules files", "amsi streams", "accept", "starfield", "onload", "root", "backdoor", "passive dns", "next associated", "gmt location", "ipv4 add", "urls", "files", "search", "domain address", "markmonitor", "name server", "se referen", "ntprotec", "data upload", "extraction", "country", "overview dns", "requests domain", "date", "contacted hosts", "ip address", "defense evasion", "found", "size", "mask", "enterprise", "trojanspy", "checkin", "gmt content", "vercel x", "twitter", "trojan", "malware", "for privacy", "servers", "domains ii", "record value", "ca issuers", "unknown aaaa", "status", "present jul", "moved", "present jan", "present oct", "present sep", "unknown ns", "present dec", "ipv4", "url analysis", "location united", "1.25.26", "q.vashti pulse", "cloud", "foundry", "process details", "formbook cnc", "cape", "autoit", "high", "formbook", "yara rule", "delete", "get na", "write", "unknown", "copy", "autoit error", "autoIt paused", "global", "div div", "script script", "h6 div", "p div", "registrar", "project", "showing", "emails", "name servers", "ids detec", "domain", "hostname", "hello", "spyware" ], "references": [ "https://hello.extendedstay.com/api/mailings/unsubscribe/PMRGSZBCHIYTGOBWGYYTOLBCN5ZGOIR2EI2DGYZVMQ3DMNZNGY3GEYZNGQ2GIMBNMEYGENBNGQZDMMZYGA3DGZRZGI4SELBCOZSXE43JN5XCEORCGQRCYITTNFTSEORCHAZEKSCRNZ3UWTKHLA4US2BWNFVWK2SKKNXHAZTBO5RGOY2FGFYUOTTGNRJHQ5RZFU4TAPJCPU", "NtProtectVirtualMemory@NTDLL.DLL", "66.33.60.130 command_and_control", "76.76.21.61 command_and_control", "IDS Detections Trojan.Generic.KDV.545753 Checkin", "https://communityinviter.com/apps/cloudfoundry/cloud-foundry", "http://cve.chainguard.dev", "http://partners.spycloud.com", "https://signin-pro-azure.crayon.com/signin-oidc", "Invalid IP (052.105.023.053)", "https://codesearch.criteois.com/opengrok/search?q=", "https://grok-chatbot.tapnetic.pro/$", "spywarewatchdog.org", "http://git.spywarewatchdog.org", "https://bot.dev.talos-systems.io/", "https://otx.alienvault.com/pulse/6976d6afd744c55bd596ed6e" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Dropper.Gh0stRAT-10028210-0", "display_name": "Win.Dropper.Gh0stRAT-10028210-0", "target": null }, { "id": "Backdoor:Win32/Kanav.A", "display_name": "Backdoor:Win32/Kanav.A", "target": "/malware/Backdoor:Win32/Kanav.A" }, { "id": "Win.Trojan.Upatre-3371", "display_name": "Win.Trojan.Upatre-3371", "target": null }, { "id": "TrojanDownloader:Win32/Upatre.A", "display_name": "TrojanDownloader:Win32/Upatre.A", "target": "/malware/TrojanDownloader:Win32/Upatre.A" }, { "id": "Win.Trojan.Upatre-3371", "display_name": "Win.Trojan.Upatre-3371", "target": null }, { "id": "TrojanDownloader:Win32/Upatre.A", "display_name": "TrojanDownloader:Win32/Upatre.A", "target": "/malware/TrojanDownloader:Win32/Upatre.A" }, { "id": "Win.Dropper.LokiBot-10010685-0", "display_name": "Win.Dropper.LokiBot-10010685-0", "target": null }, { "id": "Win.Packed.Dapato-10021645-0", "display_name": "Win.Packed.Dapato-10021645-0", "target": null }, { "id": "TrojanSpy:Win32/Nivdort.CW", "display_name": "TrojanSpy:Win32/Nivdort.CW", "target": "/malware/TrojanSpy:Win32/Nivdort.CW" }, { "id": "Win.Packed.Malwarex-9792170-0", "display_name": "Win.Packed.Malwarex-9792170-0", "target": null }, { "id": "Trojan:Win32/Glupteba.MT!MTB", "display_name": "Trojan:Win32/Glupteba.MT!MTB", "target": "/malware/Trojan:Win32/Glupteba.MT!MTB" }, { "id": "AutoIt", "display_name": "AutoIt", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null } ], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1598", "name": "Phishing for Information", "display_name": "T1598 - Phishing for Information" }, { "id": "T1456", "name": "Drive-by Compromise", "display_name": "T1456 - Drive-by Compromise" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1116", "name": "Code Signing", "display_name": "T1116 - Code Signing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1016.001", "name": "Internet Connection Discovery", "display_name": "T1016.001 - Internet Connection Discovery" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1583.004", "name": "Server", "display_name": "T1583.004 - Server" }, { "id": "T1078.004", "name": "Cloud Accounts", "display_name": "T1078.004 - Cloud Accounts" }, { "id": "T1584.003", "name": "Virtual Private Server", "display_name": "T1584.003 - Virtual Private Server" } ], "industries": [ "Ecommerce", "Government" ], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6777, "domain": 907, "hostname": 2070, "FileHash-SHA256": 1120, "FileHash-MD5": 202, "FileHash-SHA1": 184, "SSLCertFingerprint": 23, "email": 4 }, "indicator_count": 11287, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "95 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "This lets the threat actor route malicious command traffic into the local corporate network undetected.", "alerts-frontend-api-fd-stage.services-stage.gotoresolve.com", "103.246.145.111 \u2022 http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel", "Crowdsourced IDS: Matches rule ET DROP Spamhaus DROP Listed Traffic Inbound group 60", "spywarewatchdog.org", "Once inside the network, attackers avoid deploying more loud hacking tools & Download or abuse LogMeIn[.]com software.", "IP\u2019s Contacted: 104.17.118.12 57.144.248.1 176.114.120.24 80.12.24.14 95.163.61.73 142.251.98.113 212.227.17.162 77.88.44.55 142.93.142.17 104.18.14.206", "https://otx.alienvault.com/pulse/6976d6afd744c55bd596ed6e", "https://signin-pro-azure.crayon.com/signin-oidc", "Attack ChainThreat actors chain these three specific components together to bypass traditional ->", "Domains Contacted: checkip.amazonaws.com vk.com arena.ai www.yandex.ru stripchat.com", "In this specific attack chain, the threat actors use the Quant Loader script for initial entry,", "NtProtectVirtualMemory@NTDLL.DLL", "Invalid IP (052.105.023.053)", "Names: 2026-04-07_259af8b0d0bc540384a06bb730cee9cd_qnapcrypt ELF Info", "https://codesearch.criteois.com/opengrok/search?q=", "https://bot.dev.talos-systems.io/", "The Entry Vector (Quant Loader): A user interacts with a phishing link or malicious archive file.", "Because LogMeIn is a legitimate remote management tool used by actual IT departments,", "SystemBC to map the backend network secretly, and a hijacked or fraudulent LogMeIn account ->", "to act as their human-controlled, \"living off the land\" command station.", "https://hello.extendedstay.com/api/mailings/unsubscribe/PMRGSZBCHIYTGOBWGYYTOLBCN5ZGOIR2EI2DGYZVMQ3DMNZNGY3GEYZNGQ2GIMBNMEYGENBNGQZDMMZYGA3DGZRZGI4SELBCOZSXE43JN5XCEORCGQRCYITTNFTSEORCHAZEKSCRNZ3UWTKHLA4US2BWNFVWK2SKKNXHAZTBO5RGOY2FGFYUOTTGNRJHQ5RZFU4TAPJCPU", "https://communityinviter.com/apps/cloudfoundry/cloud-foundry", "remoteexecution-runner-api.services.gotoresolve.com\t\u2022 appleremotesupport.com\t\u2022", "The Persistent Backdoor (SystemBC RAT): Quant Loader downloads and executes SystemBC.", "SystemBC sets up a scheduled task to stay persistent and opens a stealthy SOCKS5 proxy or Tor network tunnel.", "http://watchhers.net/index.php", "RaaS attack designed to deploy ransomware against \u2018high value\u2019 targets or corporations.", "http://cve.chainguard.dev", "An obfuscated Quant Loader script runs natively in the background, evading anti-malware detection", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 www.anyxxxtube.net", "Matches rule ET INFO External IP Check (checkip .amazonaws .com)", "http://git.spywarewatchdog.org", "testpaging SHA256 756f0b598741a6fdff640a158b6b490472e546d411da2850836b9a8ca76afdc1", "Yara Detections: is__elf", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "remoteexecution-runner-api.services.gotoresolve.com", "by pulling its primary files over public SMB shares.", "Change all credentials from a separate, clean network.", "66.33.60.130 command_and_control", "Air-gap the target device (disable Wi-Fi, pull cables). Expensive : Dispose of all devices.", "http://partners.spycloud.com", "screenmaxxxing.com \u2022 wiki.xxkcamffk.cc \u2022 playfoundermode.com", "IDS Detections Trojan.Generic.KDV.545753 Checkin", "https://adservice.google.com.uy/clk \u2022 adservice.google.com.uy", "13.107.226.70 \u2022 13.107.253.70 - Malware Hosting", "https://grok-chatbot.tapnetic.pro/$", "Matches rule ET INFO External IP Lookup Domain in DNS Lookup (checkip .amazonaws .com)", "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)", "alerts-monitor-api-fd-prodeu.services.gotoresolve.com", "Amazonaws.com \u2022 Amazon.com", "The Objective: The hackers use the trusted LogMeIn connection to freely move laterally, steal data, turn off local security defenses, and deploy network-wide ransomware", "If possible: Move to Switzerland", "76.76.21.61 command_and_control", "http://212.33.237.86/images/1/report.php", "https://www.logmein.com/products/resolve \u2022 http://devices-iot.console.gotoresolve.com/", "Matches rule SURICATA Applayer Detect protocol only one direction", "firebaseremoteconfig.googleapis.com \u2022 remoteexecution-runner-api.services.gotoresolve.com", "appleremotesupport.com \u2022 remotelyanywhere.com", "Suspicious DNS Query for IP post), Thomas Patzke Lookup Service APls by Brandon George (blog Crowdsourced)", "its outbound traffic to logmein.com domains looks completely normal to firewalls.", "Names: testpaging upof6w.exe", "https://cdn.console.gotoresolve.com/applet", "[LogMeIn.com (Legitimate Remote Access)] \u2794 [Ransomware]", "Crowdsourced Signa: Matches rule Suspicious Outbound SMTP", "Immediate Recommendations: Disconnect all routers and isolate the network.", "remotelyanywhere.com \u2022,http://watchhers.net/index.php \u2022 firebaseremoteconfig.googleapis.com", "security filters:[Quant Script (Initial Drop)] \u2794 [SystemBC (SOCKS5/Tor Tunnel)] \u2794", "firebaseremoteconfig.googleapis.com" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Trojandownloader:js/swabfex.p", "Win.packed.dapato-10021645-0", "Trojandropper:win32/cutwail.gen!k", "Trojandownloader:win32/upatre.a", "Win.trojan.upatre-3371", "Trojan:win32/glupteba.mt!mtb", "Backdoor:win32/kanav.a", "Ransom:win32/crowti.a", "Trojanspy:win32/nivdort.cw", "Win.downloader.nemucod-6769668-0", "Win.dropper.gh0strat-10028210-0", "Win.malware.jaik-9968280-0", "Win.packed.malwarex-9792170-0", "Trojan.systembc/yxgdgz", "Alf:trojan:win32/cassini_6d4ebdc9!ibt", "Win.trojan.hupigon-6989556-0", "Formbook", "Doc.downloader.emotetred02220-9938909-0", "Autoit", "Win.dropper.lokibot-10010685-0", "Win.trojan.gh0strat-9955419-1" ], "industries": [ "Ecommerce", "Government" ], "unique_indicators": 16130 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/vercel.app", "whois": "http://whois.domaintools.com/vercel.app", "domain": "vercel.app", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "6a1b57af6e1986d0628bca12", "name": "SystemBC RAT, Quant Loader, and LogMeIn.com, combined to execute a multi-stage Corporate Styled Network Intrusion", "description": "\"Living off the Land\" Takeover (LogMeIn.com)\u201c\nINCIDENT REPORT: HIGH-VALUE TARGET NETWORK INTRUSION Threat Profile: Human-operated corporate-grade attack chain targeting an isolated device.Vector: Local network exposure (compromised router/neighboring device) or physical media (USB).Attack Chain Stages:Quant Script: Obfuscated entry file bypassing network filters.SystemBC RAT: Creates a silent, persistent SOCKS5/Tor tunnel for attacker commands.LogMeIn Abuse: Attackers use legitimate remote software to control the device undetected.Crowti (CryptoWall): Final ransomware payload to encrypt high-value data.Key Observations: Because the target device lacked direct internet access, adversaries are actively abusing the local network infrastructure or physical proximity to bridge the gap. \n\nI\u2019m open to other opinions regarding this report. I have been unwell and my thinking has been unclear and even off as I focus on getting well.\nThank you.", "modified": "2026-05-30T21:33:35.237000", "created": "2026-05-30T21:33:35.237000", "tags": [ "united", "unknown aaaa", "servers", "certificate", "urls", "logmein", "ipv4", "url analysis", "files", "america flag", "level", "data upload", "extraction", "failed", "enter sc", "extri data", "include review", "stop typ", "domain don", "united states", "america asn", "net20525119201", "amazon data", "net20525119202", "address range", "cidr", "network name", "allocation type", "whois server", "entity adsn1", "handle", "sc data", "netherlands asn", "as204601 zomro", "dns resolutions", "log id", "gmtn", "timestamp", "tls web", "expiresfri", "path", "httponly", "salford", "sectigo limited", "sectigo rsa", "accept", "organization", "false", "authentication", "ocsp", "c179044d", "b89a", "d4n timestamp", "df9b", "post na", "lredmond", "stwa", "cnmicrosoft tls", "g2 rsa", "ca ocsp", "rmm domain", "search", "flashpix", "write", "unknown", "malware", "encrypt", "high", "medium", "write c", "template", "registers", "moved", "record value", "tls sni", "observed rmm", "omicrosoft", "stwashington", "server ca", "extr data", "error", "a50 data", "pattern match", "ascii text", "mitre att", "ck id", "general", "local", "click", "strings", "u extractio", "extrac data", "learn", "command", "name tactics", "suspicious", "informative", "adversaries", "spawns", "signing defense", "discovery att", "code signing", "defense evasion", "t1480.002", "mrasn", "cachecontrol", "connection", "date tue", "gmt etag", "self", "etag w/\"leknjhepnj99sn\"", "name servers", "extre data", "observed dns", "query", "show", "localsm05208304", "localsm03520304", "title error", "all ipv4", "reverse dns", "as14618", "extraction data", "creato touc", "digice rsa", "sh certific", "hid iv", "trojandropper", "backdoor", "present may", "please", "x msedge", "exploit", "as8068", "av detection", "ratio", "ids detections", "content length", "content type", "x powered", "asn as16509", "x vercel", "vercel", "gmt content", "ransom", "dynamicloader", "msie", "windows nt", "wow64", "slcc2", "media center", "sysv", "buildid", "germany as8560", "yara detections", "contacted", "elf", "filehash", "av detections", "alerts", "analysis date", "file score", "low risk", "elf executable", "exec amd6464", "linux", "elf64 operation", "unix", "compiler", "elf info", "progbits", "offset size", "flags", "null", "hashes o", "get http", "post http", "entries", "trojan", "pegasus", "apple", "amazonaws", "smtp", "self-delete", "service-scan", "applayer", "madagascar", "qnapcrypt", "mal_elf_systembc_rat", "rat", "hacktool code", "systembc", "t1064", "create", "modify system", "process", "t1543 privile", "ta0004 cr", "t1543", "creation date", "whois show", "emails", "name logmein", "org logmein", "summer st", "date hash", "avast avg", "mtb jul", "k jun", "ai", "ai report", "appleremotesupport", "remotelyanywhere", "pegasus related" ], "references": [ "https://www.logmein.com/products/resolve \u2022 http://devices-iot.console.gotoresolve.com/", "https://adservice.google.com.uy/clk \u2022 adservice.google.com.uy", "Amazonaws.com \u2022 Amazon.com", "screenmaxxxing.com \u2022 wiki.xxkcamffk.cc \u2022 playfoundermode.com", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 www.anyxxxtube.net", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "103.246.145.111 \u2022 http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel", "13.107.226.70 \u2022 13.107.253.70 - Malware Hosting", "http://212.33.237.86/images/1/report.php", "http://watchhers.net/index.php", "remoteexecution-runner-api.services.gotoresolve.com", "firebaseremoteconfig.googleapis.com", "alerts-frontend-api-fd-stage.services-stage.gotoresolve.com", "alerts-monitor-api-fd-prodeu.services.gotoresolve.com", "testpaging SHA256 756f0b598741a6fdff640a158b6b490472e546d411da2850836b9a8ca76afdc1", "Yara Detections: is__elf", "IP\u2019s Contacted: 104.17.118.12 57.144.248.1 176.114.120.24 80.12.24.14 95.163.61.73 142.251.98.113 212.227.17.162 77.88.44.55 142.93.142.17 104.18.14.206", "Domains Contacted: checkip.amazonaws.com vk.com arena.ai www.yandex.ru stripchat.com", "Names: testpaging upof6w.exe", "Names: 2026-04-07_259af8b0d0bc540384a06bb730cee9cd_qnapcrypt ELF Info", "https://cdn.console.gotoresolve.com/applet", "Crowdsourced Signa: Matches rule Suspicious Outbound SMTP", "Suspicious DNS Query for IP post), Thomas Patzke Lookup Service APls by Brandon George (blog Crowdsourced)", "Crowdsourced IDS: Matches rule ET DROP Spamhaus DROP Listed Traffic Inbound group 60", "Matches rule ET INFO External IP Lookup Domain in DNS Lookup (checkip .amazonaws .com)", "Matches rule ET INFO External IP Check (checkip .amazonaws .com)", "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)", "Matches rule SURICATA Applayer Detect protocol only one direction", "SystemBC to map the backend network secretly, and a hijacked or fraudulent LogMeIn account ->", "to act as their human-controlled, \"living off the land\" command station.", "Attack ChainThreat actors chain these three specific components together to bypass traditional ->", "security filters:[Quant Script (Initial Drop)] \u2794 [SystemBC (SOCKS5/Tor Tunnel)] \u2794", "[LogMeIn.com (Legitimate Remote Access)] \u2794 [Ransomware]", "RaaS attack designed to deploy ransomware against \u2018high value\u2019 targets or corporations.", "In this specific attack chain, the threat actors use the Quant Loader script for initial entry,", "The Entry Vector (Quant Loader): A user interacts with a phishing link or malicious archive file.", "An obfuscated Quant Loader script runs natively in the background, evading anti-malware detection", "by pulling its primary files over public SMB shares.", "The Persistent Backdoor (SystemBC RAT): Quant Loader downloads and executes SystemBC.", "SystemBC sets up a scheduled task to stay persistent and opens a stealthy SOCKS5 proxy or Tor network tunnel.", "This lets the threat actor route malicious command traffic into the local corporate network undetected.", "Once inside the network, attackers avoid deploying more loud hacking tools & Download or abuse LogMeIn[.]com software.", "Because LogMeIn is a legitimate remote management tool used by actual IT departments,", "its outbound traffic to logmein.com domains looks completely normal to firewalls.", "The Objective: The hackers use the trusted LogMeIn connection to freely move laterally, steal data, turn off local security defenses, and deploy network-wide ransomware", "remoteexecution-runner-api.services.gotoresolve.com\t\u2022 appleremotesupport.com\t\u2022", "firebaseremoteconfig.googleapis.com \u2022 remoteexecution-runner-api.services.gotoresolve.com", "remotelyanywhere.com \u2022,http://watchhers.net/index.php \u2022 firebaseremoteconfig.googleapis.com", "appleremotesupport.com \u2022 remotelyanywhere.com", "Immediate Recommendations: Disconnect all routers and isolate the network.", "Air-gap the target device (disable Wi-Fi, pull cables). Expensive : Dispose of all devices.", "Change all credentials from a separate, clean network.", "If possible: Move to Switzerland" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Ransom:Win32/Crowti.A", "display_name": "Ransom:Win32/Crowti.A", "target": "/malware/Ransom:Win32/Crowti.A" }, { "id": "Trojan.Systembc/yxgdgz", "display_name": "Trojan.Systembc/yxgdgz", "target": null }, { "id": "TrojanSpy:Win32/Nivdort.CW", "display_name": "TrojanSpy:Win32/Nivdort.CW", "target": "/malware/TrojanSpy:Win32/Nivdort.CW" }, { "id": "Win.Downloader.Nemucod-6769668-0", "display_name": "Win.Downloader.Nemucod-6769668-0", "target": null }, { "id": "TrojanDownloader:JS/Swabfex.P", "display_name": "TrojanDownloader:JS/Swabfex.P", "target": "/malware/TrojanDownloader:JS/Swabfex.P" }, { "id": "Win.Downloader.Nemucod-6769668-0", "display_name": "Win.Downloader.Nemucod-6769668-0", "target": null }, { "id": "Doc.Downloader.EmotetRed02220-9938909-0", "display_name": "Doc.Downloader.EmotetRed02220-9938909-0", "target": null }, { "id": "TrojanDropper:Win32/Cutwail.gen!K", "display_name": "TrojanDropper:Win32/Cutwail.gen!K", "target": "/malware/TrojanDropper:Win32/Cutwail.gen!K" }, { "id": "Win.Trojan.Gh0stRAT-9955419-1", "display_name": "Win.Trojan.Gh0stRAT-9955419-1", "target": null }, { "id": "Win.Trojan.Hupigon-6989556-0", "display_name": "Win.Trojan.Hupigon-6989556-0", "target": null }, { "id": "ALF:Trojan:Win32/Cassini_6d4ebdc9!ibt", "display_name": "ALF:Trojan:Win32/Cassini_6d4ebdc9!ibt", "target": null }, { "id": "Win.Malware.Jaik-9968280-0", "display_name": "Win.Malware.Jaik-9968280-0", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "T1543.002", "name": "Systemd Service", "display_name": "T1543.002 - Systemd Service" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 275, "FileHash-SHA1": 243, "FileHash-SHA256": 1320, "URL": 897, "domain": 796, "email": 7, "hostname": 783, "IPv4": 446, "CIDR": 2, "SSLCertFingerprint": 33 }, "indicator_count": 4802, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "9 hours ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69770bdfbdd845a3d5cb2484", "name": "Drive-by Compromise | Rootkit installed on Apple Device", "description": "Drive-by Compromise | Rootkit installed on Apple Device | The devices in this example are obviously compromised. We tested a device another Apple device by viewing a Sprouts Farmers Market E-commerce website. The App crashed revealing the source of the issue. I admit that even though device is HEAVILY compromised by threat actors; it continued to preform.\nThis week the Apple devices have experienced a series of BLACK & PINK stutters One had the letter \u2018P\u2019. The most important part of the research is who & why someone targets victims of crime who are either deceased or catastrophically injured. One victims \u2018voice\u2019 has been captured and is now calling people she knew and creeping them out. \n\nAlso curious about the \u2018Hello\u2019 api lineages. Malware packed. Check-ins & Bot Network found.\n\n[OTX auto populated- Here is the full list of URLs from the 20th anniversary of the birth of Daylin Olson, who was born and raised in New York in the US, and who he is now.]\n\n#stop", "modified": "2026-02-25T06:02:12.072000", "created": "2026-01-26T06:38:23.334000", "tags": [ "url https", "url http", "netherlands", "france", "united", "canada", "spain", "ascii text", "pattern match", "mitre att", "ck id", "null", "refresh", "title", "span", "hybrid", "general", "local", "path", "strings", "error", "tools", "look", "verify", "restart", "meta", "form", "bad traffic", "et info", "tls handshake", "failure", "flag", "windir", "openurl c", "prefetch2", "analysis", "ck matrix", "href", "network traffic", "encrypt", "learn", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "ssl certificate", "initial access", "zerobits", "allocationtype", "protect", "programfiles", "processhandle", "commitsize", "viewsize", "regionsize", "viewsize d5000", "viewsize c9000", "phishing", "filehandle", "report uid", "handles modules", "files amsi", "streams", "path filehandle", "porthandle", "modules files", "amsi streams", "accept", "starfield", "onload", "root", "backdoor", "passive dns", "next associated", "gmt location", "ipv4 add", "urls", "files", "search", "domain address", "markmonitor", "name server", "se referen", "ntprotec", "data upload", "extraction", "country", "overview dns", "requests domain", "date", "contacted hosts", "ip address", "defense evasion", "found", "size", "mask", "enterprise", "trojanspy", "checkin", "gmt content", "vercel x", "twitter", "trojan", "malware", "for privacy", "servers", "domains ii", "record value", "ca issuers", "unknown aaaa", "status", "present jul", "moved", "present jan", "present oct", "present sep", "unknown ns", "present dec", "ipv4", "url analysis", "location united", "1.25.26", "q.vashti pulse", "cloud", "foundry", "process details", "formbook cnc", "cape", "autoit", "high", "formbook", "yara rule", "delete", "get na", "write", "unknown", "copy", "autoit error", "autoIt paused", "global", "div div", "script script", "h6 div", "p div", "registrar", "project", "showing", "emails", "name servers", "ids detec", "domain", "hostname", "hello", "spyware" ], "references": [ "https://hello.extendedstay.com/api/mailings/unsubscribe/PMRGSZBCHIYTGOBWGYYTOLBCN5ZGOIR2EI2DGYZVMQ3DMNZNGY3GEYZNGQ2GIMBNMEYGENBNGQZDMMZYGA3DGZRZGI4SELBCOZSXE43JN5XCEORCGQRCYITTNFTSEORCHAZEKSCRNZ3UWTKHLA4US2BWNFVWK2SKKNXHAZTBO5RGOY2FGFYUOTTGNRJHQ5RZFU4TAPJCPU", "NtProtectVirtualMemory@NTDLL.DLL", "66.33.60.130 command_and_control", "76.76.21.61 command_and_control", "IDS Detections Trojan.Generic.KDV.545753 Checkin", "https://communityinviter.com/apps/cloudfoundry/cloud-foundry", "http://cve.chainguard.dev", "http://partners.spycloud.com", "https://signin-pro-azure.crayon.com/signin-oidc", "Invalid IP (052.105.023.053)", "https://codesearch.criteois.com/opengrok/search?q=", "https://grok-chatbot.tapnetic.pro/$", "spywarewatchdog.org", "http://git.spywarewatchdog.org", "https://bot.dev.talos-systems.io/", "https://otx.alienvault.com/pulse/6976d6afd744c55bd596ed6e" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Dropper.Gh0stRAT-10028210-0", "display_name": "Win.Dropper.Gh0stRAT-10028210-0", "target": null }, { "id": "Backdoor:Win32/Kanav.A", "display_name": "Backdoor:Win32/Kanav.A", "target": "/malware/Backdoor:Win32/Kanav.A" }, { "id": "Win.Trojan.Upatre-3371", "display_name": "Win.Trojan.Upatre-3371", "target": null }, { "id": "TrojanDownloader:Win32/Upatre.A", "display_name": "TrojanDownloader:Win32/Upatre.A", "target": "/malware/TrojanDownloader:Win32/Upatre.A" }, { "id": "Win.Trojan.Upatre-3371", "display_name": "Win.Trojan.Upatre-3371", "target": null }, { "id": "TrojanDownloader:Win32/Upatre.A", "display_name": "TrojanDownloader:Win32/Upatre.A", "target": "/malware/TrojanDownloader:Win32/Upatre.A" }, { "id": "Win.Dropper.LokiBot-10010685-0", "display_name": "Win.Dropper.LokiBot-10010685-0", "target": null }, { "id": "Win.Packed.Dapato-10021645-0", "display_name": "Win.Packed.Dapato-10021645-0", "target": null }, { "id": "TrojanSpy:Win32/Nivdort.CW", "display_name": "TrojanSpy:Win32/Nivdort.CW", "target": "/malware/TrojanSpy:Win32/Nivdort.CW" }, { "id": "Win.Packed.Malwarex-9792170-0", "display_name": "Win.Packed.Malwarex-9792170-0", "target": null }, { "id": "Trojan:Win32/Glupteba.MT!MTB", "display_name": "Trojan:Win32/Glupteba.MT!MTB", "target": "/malware/Trojan:Win32/Glupteba.MT!MTB" }, { "id": "AutoIt", "display_name": "AutoIt", "target": null }, { "id": "FormBook", "display_name": "FormBook", "target": null } ], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1598", "name": "Phishing for Information", "display_name": "T1598 - Phishing for Information" }, { "id": "T1456", "name": "Drive-by Compromise", "display_name": "T1456 - Drive-by Compromise" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1116", "name": "Code Signing", "display_name": "T1116 - Code Signing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1016.001", "name": "Internet Connection Discovery", "display_name": "T1016.001 - Internet Connection Discovery" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1583.004", "name": "Server", "display_name": "T1583.004 - Server" }, { "id": "T1078.004", "name": "Cloud Accounts", "display_name": "T1078.004 - Cloud Accounts" }, { "id": "T1584.003", "name": "Virtual Private Server", "display_name": "T1584.003 - Virtual Private Server" } ], "industries": [ "Ecommerce", "Government" ], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6777, "domain": 907, "hostname": 2070, "FileHash-SHA256": 1120, "FileHash-MD5": 202, "FileHash-SHA1": 184, "SSLCertFingerprint": 23, "email": 4 }, "indicator_count": 11287, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "95 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://vercel.app", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://vercel.app", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780212257.2344794 }