{ "type": "URL", "indicator": "https://ww16.textrush.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://ww16.textrush.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3838685612, "indicator": "https://ww16.textrush.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "686ab98ff0cb9baa4e2b2000", "name": "https://house.mo.gov/ Palantir Technologies HARMFUL (copied OctoseekPulse) Attacks SA victims?", "description": "", "modified": "2025-08-05T21:02:46.419000", "created": "2025-07-06T17:59:43.440000", "tags": [ "runtime process", "localappdata", "size", "sha256", "sha1", "temp", "prefetch8", "prefetch1", "unicode text", "type data", "hybrid", "general", "click", "strings", "contact", "mitre", "writes a pe file header to disc", "show process", "date", "document file", "v2 document", "ascii text", "malicious", "local", "path", "found", "ssl certificate", "whois record", "threat roundup", "contacted", "october", "resolutions", "apple ios", "referrer", "communicating", "execution", "june", "august", "emotet", "qakbot", "agent tesla", "azorult", "core", "maze", "metro", "dark", "team", "critical", "copy", "awful", "ursnif", "hacktool", "info", "qbot", "april", "njrat", "nokoyawa", "djvu", "flubot", "ransomware", "bandit stealer", "hallrender", "spyware", "safebae", "tsara brashears", "westlaw", "river.rocks", "brian sabey", "targeting", "dnspionage", "united", "unknown", "search", "aaaa", "showing", "domain", "creation date", "record value", "dnssec", "body", "passive dns", "encrypt", "as14061", "germany unknown", "as397240", "gmt server", "443 ma2592000", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "main", "installing", "as16276", "france unknown", "name servers", "as8075", "servers", "next", "as63949 linode", "as206834 team", "canada unknown", "status", "as61969 team", "msie", "chrome", "ransom", "gone", "title", "head body", "malware" ], "references": [ "\u2193\u2192Found in: https://house.mo.gov/\u2193", "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/", "demo.auth.civicalg.com.sni.cloudflaressl.com", "happyrabbit.kr [Apple iOS threat]", "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz", "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022", "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639", "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join", "http://nudeteenporn.site" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nokoyawa Ransomware", "display_name": "Nokoyawa Ransomware", "target": null }, { "id": "Bandit Stealer", "display_name": "Bandit Stealer", "target": null }, { "id": "FluBot", "display_name": "FluBot", "target": null }, { "id": "Agent Tesla", "display_name": "Agent Tesla", "target": null }, { "id": "QBot", "display_name": "QBot", "target": null }, { "id": "QakBot", "display_name": "QakBot", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Ursnif", "display_name": "Ursnif", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Djvu", "display_name": "Djvu", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Maze", "display_name": "Maze", "target": null }, { "id": "Dark", "display_name": "Dark", "target": null }, { "id": "NjRAT", "display_name": "NjRAT", "target": null }, { "id": "HallRender", "display_name": "HallRender", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null } ], "attack_ids": [ { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1065", "name": "Uncommonly Used Port", "display_name": "T1065 - Uncommonly Used Port" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" } ], "industries": [], "TLP": "green", "cloned_from": "65c96df8fe0657d56a206a49", "export_count": 42, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 251, "FileHash-SHA1": 211, "FileHash-SHA256": 3226, "domain": 1867, "URL": 10030, "hostname": 2919, "CVE": 7, "email": 6 }, "indicator_count": 18517, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "257 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66ac1de146fa19aeb4bb119a", "name": "Ransom.Win32.Birele.gsg: affecting a global cyber security entity", "description": "Ransomware, hacking, Linux attacks. 7notrump.com has been in circulation for more than 1 year. Malicious, pre-existing and not the result of hackers attempting to suddenly attack recently made vulnerable entities. Backdoor:Linux/Tsunami.C!MTB\nBackdoor:Linux/Tsunami.C!MTB , Ransom.Win32.Birele.gsg , Trojan:Win32/Neconyd.A , VirTool:Win32/CeeInject.SN!bit , \nC!MTB ,\nCheckin Win32/ExpressDownloader , \nET ,\nRansom.Win32.Birele.gsg , \nTrojan:Win32/Neconyd.A\nVirTool:Win32/CeeInject.SN!bit , Win.Worm.Mydoom-5 ,\nWin32.Birele.gsg", "modified": "2024-10-01T16:04:13.437000", "created": "2024-08-01T23:44:33.058000", "tags": [ "no expiration", "domain", "expiration", "hostname", "filehashsha256", "url http", "ipv4", "url https", "iocs", "email abuse", "next", "all scoreblue", "create new", "pulse provide", "public tlp", "green", "adversary tags", "x509v3", "trojan", "virtool", "backdoor", "antivirus", "united", "et trojan", "possible", "sinkhole cookie", "et", "checkin win32/expressdownloader", "kw1ethical", "kw2ip", "kw3cloud", "kw4augmented", "filehashsha1", "filehashmd5", "termsurlhttp", "privacyurlhttp", "download", "ipv6", "versionid1", "pulse use", "pdf report", "pcap", "stix", "contact", "contacted", "adversaries", "adload", "dns", "activity", "acint", "aaaa", "analysis", "all scoreblue", "agent algorithm", "alexa top", "agent", "analyzer", "alexa", "alerts", "threat", "c!mtb", "win32.birele.gsg", "add malware", "ck t1027", "files", "xrat xtrat", "yara", "ransomware", "virus", "phishing", "paste analyzer", "threat anonymizer", "level as4230", "as32421", "gigenet", "as32181", "ntt", "as2914", "as20940", "as133618", "asyncrat", "ascii text", "claro", "babe", "pornhub", "av detections", "avast avg", "avatier ccir", "crack", "copy", "contact phone", "conduit", "command decode", "cnc", "command", "code command", "cobalt strike", "dos", "cnwe1 validity", "click", "cleaner", "ck techniques", "ck matrix", "backdoor", "ck id", "cisco umbrella", "choke", "bq jul", "body", "blacklist http", "module behav", "bcrypt", "bank", "zeus derivative", "yara rule", "yara detections", "crowdstrike", "xtrat", "xrat", "x509v3 key", "write", "worm", "windows nt", "win64", "win32", "network w", "network", "virus", "virtool virus", "validity", "v3 serial", "cus", "ogoogle", "cus olet", "cyber threat", "upxoepplace url", "upx alerts", "unsafe", "unknown", "united", "union", "twitter", "ttl value", "tsunami", "trust", "trojanspy", "trojan", "trident", "data redacted", "hash", "deepscan", "detection list", "malware", "potential ip", "exploit", "facebook", "false", "possible postal code", "files location", "port", "porno", "pink", "phishing site", "phishing", "files matching", "files related", "filetour", "firehol", "first", "flag united", "full name", "fusioncor", "genkryptik", "get na", "girlfriend", "hackers", "heur", "high", "high priority", "hostile", "html", "http spammer", "hybrid identifier", "ids detections", "iframe", "resource phish", "injection", "pattern match", "pe", "patcher", "passive dns", "null number", "nuance china", "nsis245zlib", "notice nsis", "no data", "nircmd", "namecheap inc", "name tactics", "name servers", "indicator", "informative", "installcore", "installpack", "invalid url", "iocs ip", "iocs ip", "ip summary", "ipv4", "javascript", "key algorithm", "key identifier", "key info", "crowdstrike", "known tor", "local", "luna host", "malicious", "malicious host", "malicious site", "malware", "malware site", "memscan", "meta", "million", "misc attack", "mitre att", "module load", "msdos", "mtb" ], "references": [ "crowdstrike.com \u00bb 7notrump.com contains pornhub.com and pastebin.com", "192.184.12.62 - Verdict: Suspicious Location: Los Angeles, United States of America ASN AS32421 Level 3 Parent Llc", "7notrump.com@privacy.above.com | Why are YOU hiding? Aren't you proud of your hateful and damaging works?", "Backdoor:Linux/Tsunami.C!MTB: FileHash-SHA256 94f82ebb09bc3ac922789af2ce272ecbf9fe303e5220c7ab3a31d6db1bea8ec4", "Backdoor:Linux/Tsunami.C!MTB: FileHash-MD5 c721d0c9d0daba37cc3e0d06331f7493", "Backdoor:Linux/Tsunami.C!MTB: FileHash-SHA1 8fceac50c534ddf1fc8d1c84b9f7fa06e41d891c", "Antivirus Detections: Win.Trojan.Tsunami-5 , Backdoor:Linux/Tsunami.C!MTB", "IDS Detections: Query to a .tk domain - Likely Hostile Yara Detections: is__elf , LinuxTsunami Alerts: suricata_alert", "VirTool:Win32/CeeInject.SN!bit: FileHash-MD5 d90dc74c1377355f3a58e3883fa8e38f", "VirTool:Win32/CeeInject.SN!bit: FileHash-SHA1 a6df4e57a54c4f9ecc5ed0d0759c57d8702f270f", "VirTool:Win32/CeeInject.SN!bit: FileHash-SHA256 9ae6df6d6c273c3037b083d3b3a78ed8329802f3ca065ceef644f5b1f7311269", "Antivirus Detections: Win32:TrojanX-gen\\ [Trj] , Win.Trojan.BlackMoon-7136668-0 , VirTool:Win32/CeeInject.SN!bit", "Hacktools_CN_WinEggDrop , CN_Portscan , Ping_Command_in_EXE More | Alerts: dead_host network_icmp persistence_autorun recon_beacon injection_resumethread creates_exe creates_service", "IDS Detections: ET TROJAN Win32/PurpleFox Related Domain in DNS Lookup Yara Detections: mimikatz , Mimikatz_Strings ,", "IDS Detections: Adware/Gertokr.C Variant Checkin MSIL/Linkury Toolbar Activity PUP.Win32.BoBrowser User-Agent (VersionDwl)", "IDS Detections: Rogue.Win32/FakeRean Checkin Win32/ExpressDownloader Variant CnC Beacon 1", "https://www.pornhub.com/video/search?search=tsara+brashears", "https://hybrid-analysis.com/sample/db695a96adb70d5f6246273f4e6c218b2c44f02b3726c3dee4d56b6428bb0ddf", "Ransom.Win32.Birele.gsg: FileHash-MD5 06c2c738f40c310fb9eb2b6c35afe18d", "Ransom.Win32.Birele.gsg: FileHash-SHA1 51995c8b1002cf27d22a2026a825f1f4fedca280 955549cbca6acdbd617aebade070259efaf6cec6", "Ransom.Win32.Birele.gsg: FileHash-SHA256 00e1b6c35691a64a327eb642c80321e7c54956de106a254688062cdda3d265a9", "T1027 - Obfuscated Files or Information T1031 - Modify Existing Service T1040 - Network Sniffing T1045 - Software Packing T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1059.007 - JavaScript T1060 - Registry Run Keys / Startup Folder T1071 - Application Layer Protocol T1071.001 - Web Protocols T1071.004 - DNS T1105 - Ingress Tool Transfer T1114 - Email Collection T1129 - Shared Modules T1132 - Data Encoding T1132.001 - Standard Encoding T1140 - Deobfuscate/Decode Files or Information T", "Antivirus Detections: Win32:Buterat-WQ\\ [Trj] , Win.Malware.Ulise-7170100-0 , Trojan:Win32/Neconyd.A", "IDS Detections: Ransom.Win32.Birele.gsg Checkin Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz", "ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst", "Alerts: network_icmp creates_user_folder_exe disables_proxy modifies_proxy_wpad creates_exe", "Alerts: antivm_network_adapters packer_polymorphic network_cnc_http network_http" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia", "Brazil" ], "malware_families": [ { "id": "ET", "display_name": "ET", "target": null }, { "id": "Checkin Win32/ExpressDownloader", "display_name": "Checkin Win32/ExpressDownloader", "target": null }, { "id": "Backdoor:Linux/Tsunami.C!MTB Ransom.Win32.Birele.gsg Trojan:Win32/Neconyd.A VirTool:Win32/CeeInject.SN!bit", "display_name": "Backdoor:Linux/Tsunami.C!MTB Ransom.Win32.Birele.gsg Trojan:Win32/Neconyd.A VirTool:Win32/CeeInject.SN!bit", "target": null }, { "id": "Win.Worm.Mydoom-5", "display_name": "Win.Worm.Mydoom-5", "target": null }, { "id": "Ransom.Win32.Birele.gsg", "display_name": "Ransom.Win32.Birele.gsg", "target": null }, { "id": "VirTool:Win32/CeeInject.SN!bit", "display_name": "VirTool:Win32/CeeInject.SN!bit", "target": "/malware/VirTool:Win32/CeeInject.SN!bit" }, { "id": "Trojan:Win32/Neconyd.A", "display_name": "Trojan:Win32/Neconyd.A", "target": "/malware/Trojan:Win32/Neconyd.A" }, { "id": "Backdoor:Linux/Tsunami.C!MTB", "display_name": "Backdoor:Linux/Tsunami.C!MTB", "target": "/malware/Backdoor:Linux/Tsunami.C!MTB" }, { "id": "C!MTB", "display_name": "C!MTB", "target": null }, { "id": "Win32.Birele.gsg", "display_name": "Win32.Birele.gsg", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1472", "name": "Generate Fraudulent Advertising Revenue", "display_name": "T1472 - Generate Fraudulent Advertising Revenue" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1530", "name": "Data from Cloud Storage Object", "display_name": "T1530 - Data from Cloud Storage Object" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1132.001", "name": "Standard Encoding", "display_name": "T1132.001 - Standard Encoding" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" } ], "industries": [ "Media", "Technology", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 69, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2164, "FileHash-MD5": 2939, "FileHash-SHA1": 2271, "FileHash-SHA256": 3553, "domain": 1075, "email": 13, "hostname": 1064, "CVE": 8 }, "indicator_count": 13087, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "565 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d49947eaaf6c57bec78719", "name": "Ransom.Win32.Birele.gsg: affecting a global cyber security entity", "description": "", "modified": "2024-10-01T16:04:13.437000", "created": "2024-09-01T16:41:43.676000", "tags": [ "no expiration", "domain", "expiration", "hostname", "filehashsha256", "url http", "ipv4", "url https", "iocs", "email abuse", "next", "all scoreblue", "create new", "pulse provide", "public tlp", "green", "adversary tags", "x509v3", "trojan", "virtool", "backdoor", "antivirus", "united", "et trojan", "possible", "sinkhole cookie", "et", "checkin win32/expressdownloader", "kw1ethical", "kw2ip", "kw3cloud", "kw4augmented", "filehashsha1", "filehashmd5", "termsurlhttp", "privacyurlhttp", "download", "ipv6", "versionid1", "pulse use", "pdf report", "pcap", "stix", "contact", "contacted", "adversaries", "adload", "dns", "activity", "acint", "aaaa", "analysis", "all scoreblue", "agent algorithm", "alexa top", "agent", "analyzer", "alexa", "alerts", "threat", "c!mtb", "win32.birele.gsg", "add malware", "ck t1027", "files", "xrat xtrat", "yara", "ransomware", "virus", "phishing", "paste analyzer", "threat anonymizer", "level as4230", "as32421", "gigenet", "as32181", "ntt", "as2914", "as20940", "as133618", "asyncrat", "ascii text", "claro", "babe", "pornhub", "av detections", "avast avg", "avatier ccir", "crack", "copy", "contact phone", "conduit", "command decode", "cnc", "command", "code command", "cobalt strike", "dos", "cnwe1 validity", "click", "cleaner", "ck techniques", "ck matrix", "backdoor", "ck id", "cisco umbrella", "choke", "bq jul", "body", "blacklist http", "module behav", "bcrypt", "bank", "zeus derivative", "yara rule", "yara detections", "crowdstrike", "xtrat", "xrat", "x509v3 key", "write", "worm", "windows nt", "win64", "win32", "network w", "network", "virus", "virtool virus", "validity", "v3 serial", "cus", "ogoogle", "cus olet", "cyber threat", "upxoepplace url", "upx alerts", "unsafe", "unknown", "united", "union", "twitter", "ttl value", "tsunami", "trust", "trojanspy", "trojan", "trident", "data redacted", "hash", "deepscan", "detection list", "malware", "potential ip", "exploit", "facebook", "false", "possible postal code", "files location", "port", "porno", "pink", "phishing site", "phishing", "files matching", "files related", "filetour", "firehol", "first", "flag united", "full name", "fusioncor", "genkryptik", "get na", "girlfriend", "hackers", "heur", "high", "high priority", "hostile", "html", "http spammer", "hybrid identifier", "ids detections", "iframe", "resource phish", "injection", "pattern match", "pe", "patcher", "passive dns", "null number", "nuance china", "nsis245zlib", "notice nsis", "no data", "nircmd", "namecheap inc", "name tactics", "name servers", "indicator", "informative", "installcore", "installpack", "invalid url", "iocs ip", "iocs ip", "ip summary", "ipv4", "javascript", "key algorithm", "key identifier", "key info", "crowdstrike", "known tor", "local", "luna host", "malicious", "malicious host", "malicious site", "malware", "malware site", "memscan", "meta", "million", "misc attack", "mitre att", "module load", "msdos", "mtb" ], "references": [ "crowdstrike.com \u00bb 7notrump.com contains pornhub.com and pastebin.com", "192.184.12.62 - Verdict: Suspicious Location: Los Angeles, United States of America ASN AS32421 Level 3 Parent Llc", "7notrump.com@privacy.above.com | Why are YOU hiding? Aren't you proud of your hateful and damaging works?", "Backdoor:Linux/Tsunami.C!MTB: FileHash-SHA256 94f82ebb09bc3ac922789af2ce272ecbf9fe303e5220c7ab3a31d6db1bea8ec4", "Backdoor:Linux/Tsunami.C!MTB: FileHash-MD5 c721d0c9d0daba37cc3e0d06331f7493", "Backdoor:Linux/Tsunami.C!MTB: FileHash-SHA1 8fceac50c534ddf1fc8d1c84b9f7fa06e41d891c", "Antivirus Detections: Win.Trojan.Tsunami-5 , Backdoor:Linux/Tsunami.C!MTB", "IDS Detections: Query to a .tk domain - Likely Hostile Yara Detections: is__elf , LinuxTsunami Alerts: suricata_alert", "VirTool:Win32/CeeInject.SN!bit: FileHash-MD5 d90dc74c1377355f3a58e3883fa8e38f", "VirTool:Win32/CeeInject.SN!bit: FileHash-SHA1 a6df4e57a54c4f9ecc5ed0d0759c57d8702f270f", "VirTool:Win32/CeeInject.SN!bit: FileHash-SHA256 9ae6df6d6c273c3037b083d3b3a78ed8329802f3ca065ceef644f5b1f7311269", "Antivirus Detections: Win32:TrojanX-gen\\ [Trj] , Win.Trojan.BlackMoon-7136668-0 , VirTool:Win32/CeeInject.SN!bit", "Hacktools_CN_WinEggDrop , CN_Portscan , Ping_Command_in_EXE More | Alerts: dead_host network_icmp persistence_autorun recon_beacon injection_resumethread creates_exe creates_service", "IDS Detections: ET TROJAN Win32/PurpleFox Related Domain in DNS Lookup Yara Detections: mimikatz , Mimikatz_Strings ,", "IDS Detections: Adware/Gertokr.C Variant Checkin MSIL/Linkury Toolbar Activity PUP.Win32.BoBrowser User-Agent (VersionDwl)", "IDS Detections: Rogue.Win32/FakeRean Checkin Win32/ExpressDownloader Variant CnC Beacon 1", "https://www.pornhub.com/video/search?search=tsara+brashears", "https://hybrid-analysis.com/sample/db695a96adb70d5f6246273f4e6c218b2c44f02b3726c3dee4d56b6428bb0ddf", "Ransom.Win32.Birele.gsg: FileHash-MD5 06c2c738f40c310fb9eb2b6c35afe18d", "Ransom.Win32.Birele.gsg: FileHash-SHA1 51995c8b1002cf27d22a2026a825f1f4fedca280 955549cbca6acdbd617aebade070259efaf6cec6", "Ransom.Win32.Birele.gsg: FileHash-SHA256 00e1b6c35691a64a327eb642c80321e7c54956de106a254688062cdda3d265a9", "T1027 - Obfuscated Files or Information T1031 - Modify Existing Service T1040 - Network Sniffing T1045 - Software Packing T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1059.007 - JavaScript T1060 - Registry Run Keys / Startup Folder T1071 - Application Layer Protocol T1071.001 - Web Protocols T1071.004 - DNS T1105 - Ingress Tool Transfer T1114 - Email Collection T1129 - Shared Modules T1132 - Data Encoding T1132.001 - Standard Encoding T1140 - Deobfuscate/Decode Files or Information T", "Antivirus Detections: Win32:Buterat-WQ\\ [Trj] , Win.Malware.Ulise-7170100-0 , Trojan:Win32/Neconyd.A", "IDS Detections: Ransom.Win32.Birele.gsg Checkin Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz", "ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst", "Alerts: network_icmp creates_user_folder_exe disables_proxy modifies_proxy_wpad creates_exe", "Alerts: antivm_network_adapters packer_polymorphic network_cnc_http network_http" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia", "Brazil" ], "malware_families": [ { "id": "ET", "display_name": "ET", "target": null }, { "id": "Checkin Win32/ExpressDownloader", "display_name": "Checkin Win32/ExpressDownloader", "target": null }, { "id": "Backdoor:Linux/Tsunami.C!MTB Ransom.Win32.Birele.gsg Trojan:Win32/Neconyd.A VirTool:Win32/CeeInject.SN!bit", "display_name": "Backdoor:Linux/Tsunami.C!MTB Ransom.Win32.Birele.gsg Trojan:Win32/Neconyd.A VirTool:Win32/CeeInject.SN!bit", "target": null }, { "id": "Win.Worm.Mydoom-5", "display_name": "Win.Worm.Mydoom-5", "target": null }, { "id": "Ransom.Win32.Birele.gsg", "display_name": "Ransom.Win32.Birele.gsg", "target": null }, { "id": "VirTool:Win32/CeeInject.SN!bit", "display_name": "VirTool:Win32/CeeInject.SN!bit", "target": "/malware/VirTool:Win32/CeeInject.SN!bit" }, { "id": "Trojan:Win32/Neconyd.A", "display_name": "Trojan:Win32/Neconyd.A", "target": "/malware/Trojan:Win32/Neconyd.A" }, { "id": "Backdoor:Linux/Tsunami.C!MTB", "display_name": "Backdoor:Linux/Tsunami.C!MTB", "target": "/malware/Backdoor:Linux/Tsunami.C!MTB" }, { "id": "C!MTB", "display_name": "C!MTB", "target": null }, { "id": "Win32.Birele.gsg", "display_name": "Win32.Birele.gsg", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1472", "name": "Generate Fraudulent Advertising Revenue", "display_name": "T1472 - Generate Fraudulent Advertising Revenue" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1530", "name": "Data from Cloud Storage Object", "display_name": "T1530 - Data from Cloud Storage Object" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1132.001", "name": "Standard Encoding", "display_name": "T1132.001 - Standard Encoding" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" } ], "industries": [ "Media", "Technology", "Government" ], "TLP": "white", "cloned_from": "66ac1de146fa19aeb4bb119a", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2164, "FileHash-MD5": 2939, "FileHash-SHA1": 2271, "FileHash-SHA256": 3553, "domain": 1075, "email": 13, "hostname": 1064, "CVE": 8 }, "indicator_count": 13087, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "565 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65c96df8fe0657d56a206a49", "name": "Nokoyawa Ransomware - https://house.mo.gov/", "description": "Cyber attack including Pegasus found in https://house.mo.gov/\nThis Observed links: dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/Appears to attacking with heightened privilege escalation.\nLinks originated from https://safebae.org attack, various Westlaw links and links attacking a private citizen. HallRender is malware hosting domain featuring an aggressive 'Brian Sabey' representing self as attorney protecting white collar individuals accused of SA is attacker. Boldly contacts victims via mail, email, phone, text, invites, personal invitations to office. \n\nFront facing https://safebae.org, a 'tribute' domain may mention alleged SA victim Daisy Coleman. Research confirms no mention of 'Daisy' safebae is filled with cyber bullying toolkit; ransomware.csv, tracking, westlaw, tagging tools, pornhub, rallypoint, adult malvertizing content targeting a Colorado SA victim. \nIt's all very real but so unbelievable. Malware spreading, cyberthreat", "modified": "2024-03-13T00:02:54.335000", "created": "2024-02-12T01:01:44.323000", "tags": [ "runtime process", "localappdata", "size", "sha256", "sha1", "temp", "prefetch8", "prefetch1", "unicode text", "type data", "hybrid", "general", "click", "strings", "contact", "mitre", "writes a pe file header to disc", "show process", "date", "document file", "v2 document", "ascii text", "malicious", "local", "path", "found", "ssl certificate", "whois record", "threat roundup", "contacted", "october", "resolutions", "apple ios", "referrer", "communicating", "execution", "june", "august", "emotet", "qakbot", "agent tesla", "azorult", "core", "maze", "metro", "dark", "team", "critical", "copy", "awful", "ursnif", "hacktool", "info", "qbot", "april", "njrat", "nokoyawa", "djvu", "flubot", "ransomware", "bandit stealer", "hallrender", "spyware", "safebae", "tsara brashears", "westlaw", "river.rocks", "brian sabey", "targeting", "dnspionage", "united", "unknown", "search", "aaaa", "showing", "domain", "creation date", "record value", "dnssec", "body", "passive dns", "encrypt", "as14061", "germany unknown", "as397240", "gmt server", "443 ma2592000", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "main", "installing", "as16276", "france unknown", "name servers", "as8075", "servers", "next", "as63949 linode", "as206834 team", "canada unknown", "status", "as61969 team", "msie", "chrome", "ransom", "gone", "title", "head body", "malware" ], "references": [ "\u2193\u2192Found in: https://house.mo.gov/\u2193", "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/", "demo.auth.civicalg.com.sni.cloudflaressl.com", "happyrabbit.kr [Apple iOS threat]", "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz", "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022", "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639", "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join", "http://nudeteenporn.site" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nokoyawa Ransomware", "display_name": "Nokoyawa Ransomware", "target": null }, { "id": "Bandit Stealer", "display_name": "Bandit Stealer", "target": null }, { "id": "FluBot", "display_name": "FluBot", "target": null }, { "id": "Agent Tesla", "display_name": "Agent Tesla", "target": null }, { "id": "QBot", "display_name": "QBot", "target": null }, { "id": "QakBot", "display_name": "QakBot", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Ursnif", "display_name": "Ursnif", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Djvu", "display_name": "Djvu", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Maze", "display_name": "Maze", "target": null }, { "id": "Dark", "display_name": "Dark", "target": null }, { "id": "NjRAT", "display_name": "NjRAT", "target": null }, { "id": "HallRender", "display_name": "HallRender", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null } ], "attack_ids": [ { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1065", "name": "Uncommonly Used Port", "display_name": "T1065 - Uncommonly Used Port" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 48, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 194, "FileHash-SHA1": 191, "FileHash-SHA256": 2376, "domain": 1414, "URL": 4388, "hostname": 1699, "CVE": 4, "email": 5 }, "indicator_count": 10271, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "767 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393", "http://nudeteenporn.site", "IDS Detections: Query to a .tk domain - Likely Hostile Yara Detections: is__elf , LinuxTsunami Alerts: suricata_alert", "Alerts: antivm_network_adapters packer_polymorphic network_cnc_http network_http", "ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst", "Ransom.Win32.Birele.gsg: FileHash-SHA1 51995c8b1002cf27d22a2026a825f1f4fedca280 955549cbca6acdbd617aebade070259efaf6cec6", "IDS Detections: ET TROJAN Win32/PurpleFox Related Domain in DNS Lookup Yara Detections: mimikatz , Mimikatz_Strings ,", "T1027 - Obfuscated Files or Information T1031 - Modify Existing Service T1040 - Network Sniffing T1045 - Software Packing T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1059.007 - JavaScript T1060 - Registry Run Keys / Startup Folder T1071 - Application Layer Protocol T1071.001 - Web Protocols T1071.004 - DNS T1105 - Ingress Tool Transfer T1114 - Email Collection T1129 - Shared Modules T1132 - Data Encoding T1132.001 - Standard Encoding T1140 - Deobfuscate/Decode Files or Information T", "VirTool:Win32/CeeInject.SN!bit: FileHash-MD5 d90dc74c1377355f3a58e3883fa8e38f", "IDS Detections: Adware/Gertokr.C Variant Checkin MSIL/Linkury Toolbar Activity PUP.Win32.BoBrowser User-Agent (VersionDwl)", "IDS Detections: Rogue.Win32/FakeRean Checkin Win32/ExpressDownloader Variant CnC Beacon 1", "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/", "Alerts: network_icmp creates_user_folder_exe disables_proxy modifies_proxy_wpad creates_exe", "demo.auth.civicalg.com.sni.cloudflaressl.com", "VirTool:Win32/CeeInject.SN!bit: FileHash-SHA256 9ae6df6d6c273c3037b083d3b3a78ed8329802f3ca065ceef644f5b1f7311269", "7notrump.com@privacy.above.com | Why are YOU hiding? Aren't you proud of your hateful and damaging works?", "Antivirus Detections: Win32:Buterat-WQ\\ [Trj] , Win.Malware.Ulise-7170100-0 , Trojan:Win32/Neconyd.A", "\u2193\u2192Found in: https://house.mo.gov/\u2193", "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639", "Antivirus Detections: Win32:TrojanX-gen\\ [Trj] , Win.Trojan.BlackMoon-7136668-0 , VirTool:Win32/CeeInject.SN!bit", "IDS Detections: Ransom.Win32.Birele.gsg Checkin Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz", "192.184.12.62 - Verdict: Suspicious Location: Los Angeles, United States of America ASN AS32421 Level 3 Parent Llc", "crowdstrike.com \u00bb 7notrump.com contains pornhub.com and pastebin.com", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "Hacktools_CN_WinEggDrop , CN_Portscan , Ping_Command_in_EXE More | Alerts: dead_host network_icmp persistence_autorun recon_beacon injection_resumethread creates_exe creates_service", "https://hybrid-analysis.com/sample/db695a96adb70d5f6246273f4e6c218b2c44f02b3726c3dee4d56b6428bb0ddf", "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join", "Backdoor:Linux/Tsunami.C!MTB: FileHash-MD5 c721d0c9d0daba37cc3e0d06331f7493", "https://www.pornhub.com/video/search?search=tsara+brashears", "Antivirus Detections: Win.Trojan.Tsunami-5 , Backdoor:Linux/Tsunami.C!MTB", "Ransom.Win32.Birele.gsg: FileHash-SHA256 00e1b6c35691a64a327eb642c80321e7c54956de106a254688062cdda3d265a9", "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022", "happyrabbit.kr [Apple iOS threat]", "Backdoor:Linux/Tsunami.C!MTB: FileHash-SHA256 94f82ebb09bc3ac922789af2ce272ecbf9fe303e5220c7ab3a31d6db1bea8ec4", "VirTool:Win32/CeeInject.SN!bit: FileHash-SHA1 a6df4e57a54c4f9ecc5ed0d0759c57d8702f270f", "Backdoor:Linux/Tsunami.C!MTB: FileHash-SHA1 8fceac50c534ddf1fc8d1c84b9f7fa06e41d891c", "Ransom.Win32.Birele.gsg: FileHash-MD5 06c2c738f40c310fb9eb2b6c35afe18d", "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Hacktool", "Qakbot", "Win.worm.mydoom-5", "C!mtb", "Emotet", "Djvu", "Maze", "Checkin win32/expressdownloader", "Ransom.win32.birele.gsg", "Trojan:win32/neconyd.a", "Virtool:win32/ceeinject.sn!bit", "Backdoor:linux/tsunami.c!mtb", "Tulach", "Ursnif", "Backdoor:linux/tsunami.c!mtb ransom.win32.birele.gsg trojan:win32/neconyd.a virtool:win32/ceeinject.sn!bit", "Hallrender", "Njrat", "Dark", "Agent tesla", "Flubot", "Bandit stealer", "Azorult", "Qbot", "Et", "Nokoyawa ransomware", "Win32.birele.gsg" ], "industries": [ "Government", "Technology", "Media" ], "unique_indicators": 26971 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/textrush.com", "whois": "http://whois.domaintools.com/textrush.com", "domain": "textrush.com", "hostname": "ww16.textrush.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "686ab98ff0cb9baa4e2b2000", "name": "https://house.mo.gov/ Palantir Technologies HARMFUL (copied OctoseekPulse) Attacks SA victims?", "description": "", "modified": "2025-08-05T21:02:46.419000", "created": "2025-07-06T17:59:43.440000", "tags": [ "runtime process", "localappdata", "size", "sha256", "sha1", "temp", "prefetch8", "prefetch1", "unicode text", "type data", "hybrid", "general", "click", "strings", "contact", "mitre", "writes a pe file header to disc", "show process", "date", "document file", "v2 document", "ascii text", "malicious", "local", "path", "found", "ssl certificate", "whois record", "threat roundup", "contacted", "october", "resolutions", "apple ios", "referrer", "communicating", "execution", "june", "august", "emotet", "qakbot", "agent tesla", "azorult", "core", "maze", "metro", "dark", "team", "critical", "copy", "awful", "ursnif", "hacktool", "info", "qbot", "april", "njrat", "nokoyawa", "djvu", "flubot", "ransomware", "bandit stealer", "hallrender", "spyware", "safebae", "tsara brashears", "westlaw", "river.rocks", "brian sabey", "targeting", "dnspionage", "united", "unknown", "search", "aaaa", "showing", "domain", "creation date", "record value", "dnssec", "body", "passive dns", "encrypt", "as14061", "germany unknown", "as397240", "gmt server", "443 ma2592000", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "main", "installing", "as16276", "france unknown", "name servers", "as8075", "servers", "next", "as63949 linode", "as206834 team", "canada unknown", "status", "as61969 team", "msie", "chrome", "ransom", "gone", "title", "head body", "malware" ], "references": [ "\u2193\u2192Found in: https://house.mo.gov/\u2193", "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/", "demo.auth.civicalg.com.sni.cloudflaressl.com", "happyrabbit.kr [Apple iOS threat]", "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz", "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022", "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639", "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join", "http://nudeteenporn.site" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nokoyawa Ransomware", "display_name": "Nokoyawa Ransomware", "target": null }, { "id": "Bandit Stealer", "display_name": "Bandit Stealer", "target": null }, { "id": "FluBot", "display_name": "FluBot", "target": null }, { "id": "Agent Tesla", "display_name": "Agent Tesla", "target": null }, { "id": "QBot", "display_name": "QBot", "target": null }, { "id": "QakBot", "display_name": "QakBot", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Ursnif", "display_name": "Ursnif", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Djvu", "display_name": "Djvu", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Maze", "display_name": "Maze", "target": null }, { "id": "Dark", "display_name": "Dark", "target": null }, { "id": "NjRAT", "display_name": "NjRAT", "target": null }, { "id": "HallRender", "display_name": "HallRender", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null } ], "attack_ids": [ { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1065", "name": "Uncommonly Used Port", "display_name": "T1065 - Uncommonly Used Port" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" } ], "industries": [], "TLP": "green", "cloned_from": "65c96df8fe0657d56a206a49", "export_count": 42, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 251, "FileHash-SHA1": 211, "FileHash-SHA256": 3226, "domain": 1867, "URL": 10030, "hostname": 2919, "CVE": 7, "email": 6 }, "indicator_count": 18517, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "257 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66ac1de146fa19aeb4bb119a", "name": "Ransom.Win32.Birele.gsg: affecting a global cyber security entity", "description": "Ransomware, hacking, Linux attacks. 7notrump.com has been in circulation for more than 1 year. Malicious, pre-existing and not the result of hackers attempting to suddenly attack recently made vulnerable entities. Backdoor:Linux/Tsunami.C!MTB\nBackdoor:Linux/Tsunami.C!MTB , Ransom.Win32.Birele.gsg , Trojan:Win32/Neconyd.A , VirTool:Win32/CeeInject.SN!bit , \nC!MTB ,\nCheckin Win32/ExpressDownloader , \nET ,\nRansom.Win32.Birele.gsg , \nTrojan:Win32/Neconyd.A\nVirTool:Win32/CeeInject.SN!bit , Win.Worm.Mydoom-5 ,\nWin32.Birele.gsg", "modified": "2024-10-01T16:04:13.437000", "created": "2024-08-01T23:44:33.058000", "tags": [ "no expiration", "domain", "expiration", "hostname", "filehashsha256", "url http", "ipv4", "url https", "iocs", "email abuse", "next", "all scoreblue", "create new", "pulse provide", "public tlp", "green", "adversary tags", "x509v3", "trojan", "virtool", "backdoor", "antivirus", "united", "et trojan", "possible", "sinkhole cookie", "et", "checkin win32/expressdownloader", "kw1ethical", "kw2ip", "kw3cloud", "kw4augmented", "filehashsha1", "filehashmd5", "termsurlhttp", "privacyurlhttp", "download", "ipv6", "versionid1", "pulse use", "pdf report", "pcap", "stix", "contact", "contacted", "adversaries", "adload", "dns", "activity", "acint", "aaaa", "analysis", "all scoreblue", "agent algorithm", "alexa top", "agent", "analyzer", "alexa", "alerts", "threat", "c!mtb", "win32.birele.gsg", "add malware", "ck t1027", "files", "xrat xtrat", "yara", "ransomware", "virus", "phishing", "paste analyzer", "threat anonymizer", "level as4230", "as32421", "gigenet", "as32181", "ntt", "as2914", "as20940", "as133618", "asyncrat", "ascii text", "claro", "babe", "pornhub", "av detections", "avast avg", "avatier ccir", "crack", "copy", "contact phone", "conduit", "command decode", "cnc", "command", "code command", "cobalt strike", "dos", "cnwe1 validity", "click", "cleaner", "ck techniques", "ck matrix", "backdoor", "ck id", "cisco umbrella", "choke", "bq jul", "body", "blacklist http", "module behav", "bcrypt", "bank", "zeus derivative", "yara rule", "yara detections", "crowdstrike", "xtrat", "xrat", "x509v3 key", "write", "worm", "windows nt", "win64", "win32", "network w", "network", "virus", "virtool virus", "validity", "v3 serial", "cus", "ogoogle", "cus olet", "cyber threat", "upxoepplace url", "upx alerts", "unsafe", "unknown", "united", "union", "twitter", "ttl value", "tsunami", "trust", "trojanspy", "trojan", "trident", "data redacted", "hash", "deepscan", "detection list", "malware", "potential ip", "exploit", "facebook", "false", "possible postal code", "files location", "port", "porno", "pink", "phishing site", "phishing", "files matching", "files related", "filetour", "firehol", "first", "flag united", "full name", "fusioncor", "genkryptik", "get na", "girlfriend", "hackers", "heur", "high", "high priority", "hostile", "html", "http spammer", "hybrid identifier", "ids detections", "iframe", "resource phish", "injection", "pattern match", "pe", "patcher", "passive dns", "null number", "nuance china", "nsis245zlib", "notice nsis", "no data", "nircmd", "namecheap inc", "name tactics", "name servers", "indicator", "informative", "installcore", "installpack", "invalid url", "iocs ip", "iocs ip", "ip summary", "ipv4", "javascript", "key algorithm", "key identifier", "key info", "crowdstrike", "known tor", "local", "luna host", "malicious", "malicious host", "malicious site", "malware", "malware site", "memscan", "meta", "million", "misc attack", "mitre att", "module load", "msdos", "mtb" ], "references": [ "crowdstrike.com \u00bb 7notrump.com contains pornhub.com and pastebin.com", "192.184.12.62 - Verdict: Suspicious Location: Los Angeles, United States of America ASN AS32421 Level 3 Parent Llc", "7notrump.com@privacy.above.com | Why are YOU hiding? Aren't you proud of your hateful and damaging works?", "Backdoor:Linux/Tsunami.C!MTB: FileHash-SHA256 94f82ebb09bc3ac922789af2ce272ecbf9fe303e5220c7ab3a31d6db1bea8ec4", "Backdoor:Linux/Tsunami.C!MTB: FileHash-MD5 c721d0c9d0daba37cc3e0d06331f7493", "Backdoor:Linux/Tsunami.C!MTB: FileHash-SHA1 8fceac50c534ddf1fc8d1c84b9f7fa06e41d891c", "Antivirus Detections: Win.Trojan.Tsunami-5 , Backdoor:Linux/Tsunami.C!MTB", "IDS Detections: Query to a .tk domain - Likely Hostile Yara Detections: is__elf , LinuxTsunami Alerts: suricata_alert", "VirTool:Win32/CeeInject.SN!bit: FileHash-MD5 d90dc74c1377355f3a58e3883fa8e38f", "VirTool:Win32/CeeInject.SN!bit: FileHash-SHA1 a6df4e57a54c4f9ecc5ed0d0759c57d8702f270f", "VirTool:Win32/CeeInject.SN!bit: FileHash-SHA256 9ae6df6d6c273c3037b083d3b3a78ed8329802f3ca065ceef644f5b1f7311269", "Antivirus Detections: Win32:TrojanX-gen\\ [Trj] , Win.Trojan.BlackMoon-7136668-0 , VirTool:Win32/CeeInject.SN!bit", "Hacktools_CN_WinEggDrop , CN_Portscan , Ping_Command_in_EXE More | Alerts: dead_host network_icmp persistence_autorun recon_beacon injection_resumethread creates_exe creates_service", "IDS Detections: ET TROJAN Win32/PurpleFox Related Domain in DNS Lookup Yara Detections: mimikatz , Mimikatz_Strings ,", "IDS Detections: Adware/Gertokr.C Variant Checkin MSIL/Linkury Toolbar Activity PUP.Win32.BoBrowser User-Agent (VersionDwl)", "IDS Detections: Rogue.Win32/FakeRean Checkin Win32/ExpressDownloader Variant CnC Beacon 1", "https://www.pornhub.com/video/search?search=tsara+brashears", "https://hybrid-analysis.com/sample/db695a96adb70d5f6246273f4e6c218b2c44f02b3726c3dee4d56b6428bb0ddf", "Ransom.Win32.Birele.gsg: FileHash-MD5 06c2c738f40c310fb9eb2b6c35afe18d", "Ransom.Win32.Birele.gsg: FileHash-SHA1 51995c8b1002cf27d22a2026a825f1f4fedca280 955549cbca6acdbd617aebade070259efaf6cec6", "Ransom.Win32.Birele.gsg: FileHash-SHA256 00e1b6c35691a64a327eb642c80321e7c54956de106a254688062cdda3d265a9", "T1027 - Obfuscated Files or Information T1031 - Modify Existing Service T1040 - Network Sniffing T1045 - Software Packing T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1059.007 - JavaScript T1060 - Registry Run Keys / Startup Folder T1071 - Application Layer Protocol T1071.001 - Web Protocols T1071.004 - DNS T1105 - Ingress Tool Transfer T1114 - Email Collection T1129 - Shared Modules T1132 - Data Encoding T1132.001 - Standard Encoding T1140 - Deobfuscate/Decode Files or Information T", "Antivirus Detections: Win32:Buterat-WQ\\ [Trj] , Win.Malware.Ulise-7170100-0 , Trojan:Win32/Neconyd.A", "IDS Detections: Ransom.Win32.Birele.gsg Checkin Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz", "ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst", "Alerts: network_icmp creates_user_folder_exe disables_proxy modifies_proxy_wpad creates_exe", "Alerts: antivm_network_adapters packer_polymorphic network_cnc_http network_http" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia", "Brazil" ], "malware_families": [ { "id": "ET", "display_name": "ET", "target": null }, { "id": "Checkin Win32/ExpressDownloader", "display_name": "Checkin Win32/ExpressDownloader", "target": null }, { "id": "Backdoor:Linux/Tsunami.C!MTB Ransom.Win32.Birele.gsg Trojan:Win32/Neconyd.A VirTool:Win32/CeeInject.SN!bit", "display_name": "Backdoor:Linux/Tsunami.C!MTB Ransom.Win32.Birele.gsg Trojan:Win32/Neconyd.A VirTool:Win32/CeeInject.SN!bit", "target": null }, { "id": "Win.Worm.Mydoom-5", "display_name": "Win.Worm.Mydoom-5", "target": null }, { "id": "Ransom.Win32.Birele.gsg", "display_name": "Ransom.Win32.Birele.gsg", "target": null }, { "id": "VirTool:Win32/CeeInject.SN!bit", "display_name": "VirTool:Win32/CeeInject.SN!bit", "target": "/malware/VirTool:Win32/CeeInject.SN!bit" }, { "id": "Trojan:Win32/Neconyd.A", "display_name": "Trojan:Win32/Neconyd.A", "target": "/malware/Trojan:Win32/Neconyd.A" }, { "id": "Backdoor:Linux/Tsunami.C!MTB", "display_name": "Backdoor:Linux/Tsunami.C!MTB", "target": "/malware/Backdoor:Linux/Tsunami.C!MTB" }, { "id": "C!MTB", "display_name": "C!MTB", "target": null }, { "id": "Win32.Birele.gsg", "display_name": "Win32.Birele.gsg", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1472", "name": "Generate Fraudulent Advertising Revenue", "display_name": "T1472 - Generate Fraudulent Advertising Revenue" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1530", "name": "Data from Cloud Storage Object", "display_name": "T1530 - Data from Cloud Storage Object" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1132.001", "name": "Standard Encoding", "display_name": "T1132.001 - Standard Encoding" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" } ], "industries": [ "Media", "Technology", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 69, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2164, "FileHash-MD5": 2939, "FileHash-SHA1": 2271, "FileHash-SHA256": 3553, "domain": 1075, "email": 13, "hostname": 1064, "CVE": 8 }, "indicator_count": 13087, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "565 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d49947eaaf6c57bec78719", "name": "Ransom.Win32.Birele.gsg: affecting a global cyber security entity", "description": "", "modified": "2024-10-01T16:04:13.437000", "created": "2024-09-01T16:41:43.676000", "tags": [ "no expiration", "domain", "expiration", "hostname", "filehashsha256", "url http", "ipv4", "url https", "iocs", "email abuse", "next", "all scoreblue", "create new", "pulse provide", "public tlp", "green", "adversary tags", "x509v3", "trojan", "virtool", "backdoor", "antivirus", "united", "et trojan", "possible", "sinkhole cookie", "et", "checkin win32/expressdownloader", "kw1ethical", "kw2ip", "kw3cloud", "kw4augmented", "filehashsha1", "filehashmd5", "termsurlhttp", "privacyurlhttp", "download", "ipv6", "versionid1", "pulse use", "pdf report", "pcap", "stix", "contact", "contacted", "adversaries", "adload", "dns", "activity", "acint", "aaaa", "analysis", "all scoreblue", "agent algorithm", "alexa top", "agent", "analyzer", "alexa", "alerts", "threat", "c!mtb", "win32.birele.gsg", "add malware", "ck t1027", "files", "xrat xtrat", "yara", "ransomware", "virus", "phishing", "paste analyzer", "threat anonymizer", "level as4230", "as32421", "gigenet", "as32181", "ntt", "as2914", "as20940", "as133618", "asyncrat", "ascii text", "claro", "babe", "pornhub", "av detections", "avast avg", "avatier ccir", "crack", "copy", "contact phone", "conduit", "command decode", "cnc", "command", "code command", "cobalt strike", "dos", "cnwe1 validity", "click", "cleaner", "ck techniques", "ck matrix", "backdoor", "ck id", "cisco umbrella", "choke", "bq jul", "body", "blacklist http", "module behav", "bcrypt", "bank", "zeus derivative", "yara rule", "yara detections", "crowdstrike", "xtrat", "xrat", "x509v3 key", "write", "worm", "windows nt", "win64", "win32", "network w", "network", "virus", "virtool virus", "validity", "v3 serial", "cus", "ogoogle", "cus olet", "cyber threat", "upxoepplace url", "upx alerts", "unsafe", "unknown", "united", "union", "twitter", "ttl value", "tsunami", "trust", "trojanspy", "trojan", "trident", "data redacted", "hash", "deepscan", "detection list", "malware", "potential ip", "exploit", "facebook", "false", "possible postal code", "files location", "port", "porno", "pink", "phishing site", "phishing", "files matching", "files related", "filetour", "firehol", "first", "flag united", "full name", "fusioncor", "genkryptik", "get na", "girlfriend", "hackers", "heur", "high", "high priority", "hostile", "html", "http spammer", "hybrid identifier", "ids detections", "iframe", "resource phish", "injection", "pattern match", "pe", "patcher", "passive dns", "null number", "nuance china", "nsis245zlib", "notice nsis", "no data", "nircmd", "namecheap inc", "name tactics", "name servers", "indicator", "informative", "installcore", "installpack", "invalid url", "iocs ip", "iocs ip", "ip summary", "ipv4", "javascript", "key algorithm", "key identifier", "key info", "crowdstrike", "known tor", "local", "luna host", "malicious", "malicious host", "malicious site", "malware", "malware site", "memscan", "meta", "million", "misc attack", "mitre att", "module load", "msdos", "mtb" ], "references": [ "crowdstrike.com \u00bb 7notrump.com contains pornhub.com and pastebin.com", "192.184.12.62 - Verdict: Suspicious Location: Los Angeles, United States of America ASN AS32421 Level 3 Parent Llc", "7notrump.com@privacy.above.com | Why are YOU hiding? Aren't you proud of your hateful and damaging works?", "Backdoor:Linux/Tsunami.C!MTB: FileHash-SHA256 94f82ebb09bc3ac922789af2ce272ecbf9fe303e5220c7ab3a31d6db1bea8ec4", "Backdoor:Linux/Tsunami.C!MTB: FileHash-MD5 c721d0c9d0daba37cc3e0d06331f7493", "Backdoor:Linux/Tsunami.C!MTB: FileHash-SHA1 8fceac50c534ddf1fc8d1c84b9f7fa06e41d891c", "Antivirus Detections: Win.Trojan.Tsunami-5 , Backdoor:Linux/Tsunami.C!MTB", "IDS Detections: Query to a .tk domain - Likely Hostile Yara Detections: is__elf , LinuxTsunami Alerts: suricata_alert", "VirTool:Win32/CeeInject.SN!bit: FileHash-MD5 d90dc74c1377355f3a58e3883fa8e38f", "VirTool:Win32/CeeInject.SN!bit: FileHash-SHA1 a6df4e57a54c4f9ecc5ed0d0759c57d8702f270f", "VirTool:Win32/CeeInject.SN!bit: FileHash-SHA256 9ae6df6d6c273c3037b083d3b3a78ed8329802f3ca065ceef644f5b1f7311269", "Antivirus Detections: Win32:TrojanX-gen\\ [Trj] , Win.Trojan.BlackMoon-7136668-0 , VirTool:Win32/CeeInject.SN!bit", "Hacktools_CN_WinEggDrop , CN_Portscan , Ping_Command_in_EXE More | Alerts: dead_host network_icmp persistence_autorun recon_beacon injection_resumethread creates_exe creates_service", "IDS Detections: ET TROJAN Win32/PurpleFox Related Domain in DNS Lookup Yara Detections: mimikatz , Mimikatz_Strings ,", "IDS Detections: Adware/Gertokr.C Variant Checkin MSIL/Linkury Toolbar Activity PUP.Win32.BoBrowser User-Agent (VersionDwl)", "IDS Detections: Rogue.Win32/FakeRean Checkin Win32/ExpressDownloader Variant CnC Beacon 1", "https://www.pornhub.com/video/search?search=tsara+brashears", "https://hybrid-analysis.com/sample/db695a96adb70d5f6246273f4e6c218b2c44f02b3726c3dee4d56b6428bb0ddf", "Ransom.Win32.Birele.gsg: FileHash-MD5 06c2c738f40c310fb9eb2b6c35afe18d", "Ransom.Win32.Birele.gsg: FileHash-SHA1 51995c8b1002cf27d22a2026a825f1f4fedca280 955549cbca6acdbd617aebade070259efaf6cec6", "Ransom.Win32.Birele.gsg: FileHash-SHA256 00e1b6c35691a64a327eb642c80321e7c54956de106a254688062cdda3d265a9", "T1027 - Obfuscated Files or Information T1031 - Modify Existing Service T1040 - Network Sniffing T1045 - Software Packing T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1059.007 - JavaScript T1060 - Registry Run Keys / Startup Folder T1071 - Application Layer Protocol T1071.001 - Web Protocols T1071.004 - DNS T1105 - Ingress Tool Transfer T1114 - Email Collection T1129 - Shared Modules T1132 - Data Encoding T1132.001 - Standard Encoding T1140 - Deobfuscate/Decode Files or Information T", "Antivirus Detections: Win32:Buterat-WQ\\ [Trj] , Win.Malware.Ulise-7170100-0 , Trojan:Win32/Neconyd.A", "IDS Detections: Ransom.Win32.Birele.gsg Checkin Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz", "ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst", "Alerts: network_icmp creates_user_folder_exe disables_proxy modifies_proxy_wpad creates_exe", "Alerts: antivm_network_adapters packer_polymorphic network_cnc_http network_http" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia", "Brazil" ], "malware_families": [ { "id": "ET", "display_name": "ET", "target": null }, { "id": "Checkin Win32/ExpressDownloader", "display_name": "Checkin Win32/ExpressDownloader", "target": null }, { "id": "Backdoor:Linux/Tsunami.C!MTB Ransom.Win32.Birele.gsg Trojan:Win32/Neconyd.A VirTool:Win32/CeeInject.SN!bit", "display_name": "Backdoor:Linux/Tsunami.C!MTB Ransom.Win32.Birele.gsg Trojan:Win32/Neconyd.A VirTool:Win32/CeeInject.SN!bit", "target": null }, { "id": "Win.Worm.Mydoom-5", "display_name": "Win.Worm.Mydoom-5", "target": null }, { "id": "Ransom.Win32.Birele.gsg", "display_name": "Ransom.Win32.Birele.gsg", "target": null }, { "id": "VirTool:Win32/CeeInject.SN!bit", "display_name": "VirTool:Win32/CeeInject.SN!bit", "target": "/malware/VirTool:Win32/CeeInject.SN!bit" }, { "id": "Trojan:Win32/Neconyd.A", "display_name": "Trojan:Win32/Neconyd.A", "target": "/malware/Trojan:Win32/Neconyd.A" }, { "id": "Backdoor:Linux/Tsunami.C!MTB", "display_name": "Backdoor:Linux/Tsunami.C!MTB", "target": "/malware/Backdoor:Linux/Tsunami.C!MTB" }, { "id": "C!MTB", "display_name": "C!MTB", "target": null }, { "id": "Win32.Birele.gsg", "display_name": "Win32.Birele.gsg", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1472", "name": "Generate Fraudulent Advertising Revenue", "display_name": "T1472 - Generate Fraudulent Advertising Revenue" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1530", "name": "Data from Cloud Storage Object", "display_name": "T1530 - Data from Cloud Storage Object" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1132.001", "name": "Standard Encoding", "display_name": "T1132.001 - Standard Encoding" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" } ], "industries": [ "Media", "Technology", "Government" ], "TLP": "white", "cloned_from": "66ac1de146fa19aeb4bb119a", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2164, "FileHash-MD5": 2939, "FileHash-SHA1": 2271, "FileHash-SHA256": 3553, "domain": 1075, "email": 13, "hostname": 1064, "CVE": 8 }, "indicator_count": 13087, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "565 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65c96df8fe0657d56a206a49", "name": "Nokoyawa Ransomware - https://house.mo.gov/", "description": "Cyber attack including Pegasus found in https://house.mo.gov/\nThis Observed links: dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/Appears to attacking with heightened privilege escalation.\nLinks originated from https://safebae.org attack, various Westlaw links and links attacking a private citizen. HallRender is malware hosting domain featuring an aggressive 'Brian Sabey' representing self as attorney protecting white collar individuals accused of SA is attacker. Boldly contacts victims via mail, email, phone, text, invites, personal invitations to office. \n\nFront facing https://safebae.org, a 'tribute' domain may mention alleged SA victim Daisy Coleman. Research confirms no mention of 'Daisy' safebae is filled with cyber bullying toolkit; ransomware.csv, tracking, westlaw, tagging tools, pornhub, rallypoint, adult malvertizing content targeting a Colorado SA victim. \nIt's all very real but so unbelievable. Malware spreading, cyberthreat", "modified": "2024-03-13T00:02:54.335000", "created": "2024-02-12T01:01:44.323000", "tags": [ "runtime process", "localappdata", "size", "sha256", "sha1", "temp", "prefetch8", "prefetch1", "unicode text", "type data", "hybrid", "general", "click", "strings", "contact", "mitre", "writes a pe file header to disc", "show process", "date", "document file", "v2 document", "ascii text", "malicious", "local", "path", "found", "ssl certificate", "whois record", "threat roundup", "contacted", "october", "resolutions", "apple ios", "referrer", "communicating", "execution", "june", "august", "emotet", "qakbot", "agent tesla", "azorult", "core", "maze", "metro", "dark", "team", "critical", "copy", "awful", "ursnif", "hacktool", "info", "qbot", "april", "njrat", "nokoyawa", "djvu", "flubot", "ransomware", "bandit stealer", "hallrender", "spyware", "safebae", "tsara brashears", "westlaw", "river.rocks", "brian sabey", "targeting", "dnspionage", "united", "unknown", "search", "aaaa", "showing", "domain", "creation date", "record value", "dnssec", "body", "passive dns", "encrypt", "as14061", "germany unknown", "as397240", "gmt server", "443 ma2592000", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "main", "installing", "as16276", "france unknown", "name servers", "as8075", "servers", "next", "as63949 linode", "as206834 team", "canada unknown", "status", "as61969 team", "msie", "chrome", "ransom", "gone", "title", "head body", "malware" ], "references": [ "\u2193\u2192Found in: https://house.mo.gov/\u2193", "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/", "demo.auth.civicalg.com.sni.cloudflaressl.com", "happyrabbit.kr [Apple iOS threat]", "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz", "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022", "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639", "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join", "http://nudeteenporn.site" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Nokoyawa Ransomware", "display_name": "Nokoyawa Ransomware", "target": null }, { "id": "Bandit Stealer", "display_name": "Bandit Stealer", "target": null }, { "id": "FluBot", "display_name": "FluBot", "target": null }, { "id": "Agent Tesla", "display_name": "Agent Tesla", "target": null }, { "id": "QBot", "display_name": "QBot", "target": null }, { "id": "QakBot", "display_name": "QakBot", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Ursnif", "display_name": "Ursnif", "target": null }, { "id": "AZORult", "display_name": "AZORult", "target": null }, { "id": "Djvu", "display_name": "Djvu", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "Maze", "display_name": "Maze", "target": null }, { "id": "Dark", "display_name": "Dark", "target": null }, { "id": "NjRAT", "display_name": "NjRAT", "target": null }, { "id": "HallRender", "display_name": "HallRender", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null } ], "attack_ids": [ { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1065", "name": "Uncommonly Used Port", "display_name": "T1065 - Uncommonly Used Port" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 48, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 194, "FileHash-SHA1": 191, "FileHash-SHA256": 2376, "domain": 1414, "URL": 4388, "hostname": 1699, "CVE": 4, "email": 5 }, "indicator_count": 10271, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "767 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://ww16.textrush.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://ww16.textrush.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776637453.3294 }