{ "type": "URL", "indicator": "https://ww17.active.co", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://ww17.active.co", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3286942091, "indicator": "https://ww17.active.co", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 8, "pulses": [ { "id": "65707f8ee427db014eda79f3", "name": "FAKE MDM's and HASH", "description": "", "modified": "2023-12-06T14:05:02.692000", "created": "2023-12-06T14:05:02.692000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6858, "FileHash-SHA256": 2217, "FileHash-MD5": 488, "FileHash-SHA1": 494, "domain": 266, "hostname": 1729 }, "indicator_count": 12052, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707f66d3fe743b63b06fc5", "name": "This is a botnet consisting of millions of user controlled devices masquerading as mdm enterprise", "description": "", "modified": "2023-12-06T14:04:22.492000", "created": "2023-12-06T14:04:22.492000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6912, "FileHash-SHA256": 2217, "domain": 248, "hostname": 1815, "FileHash-SHA1": 7 }, "indicator_count": 11199, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "629f32000e99da994ecb5f62", "name": "80880.bodis - passive DNS = CNAME bug cookie priv escalation 450 records = n. sh", "description": "ioc's from all passive dns records potentially using CNAME record cookie priv escalation bug to abuse and break analytics with user agent.\nmass of 404 connection errors invoked to hijack/redir traffic to top level immitation sites running on massive nubotnet", "modified": "2022-07-07T00:01:42.558000", "created": "2022-06-07T11:09:52.102000", "tags": [ "n. sh", "CNAME cookie priv escalation", "CVE-2021-22941", "ww1", "neural", "nubotnet" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 370, "hostname": 1775, "URL": 2331, "domain": 453 }, "indicator_count": 4929, "is_author": false, "is_subscribing": null, "subscriber_count": 395, "modified_text": "1425 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "629ea3c60ad34195c60d67f2", "name": "80880.bodis.com", "description": "", "modified": "2022-06-07T01:03:02.429000", "created": "2022-06-07T01:03:02.429000", "tags": [ "domain related", "CNAME cookie priv bug", "cookie abuse", "compromised browser", "parked domains", "proxy traffic", "stealth ad/click fraud", "self signed abused ssl" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 22, "URL": 840, "hostname": 785, "domain": 201 }, "indicator_count": 1848, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1455 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62671011c011c18ebd21feb0", "name": "/microtechnology.hk/wapdast/Ytd63ox3UMAQVlB.exe- Another savage stash of nasties", "description": "Trojaned iFrame", "modified": "2022-05-25T00:04:03.622000", "created": "2022-04-25T21:18:09.686000", "tags": [ "trojan", "apt", "pcap", "pcap processing", "windows nt", "runtime data", "malicious", "hosts", "mozi", "april", "local", "factory", "team", "february" ], "references": [ "https://hybrid-analysis.com/sample/ebfa6d583819827abf9f7b6d8d3f180c70a9cbe509cd4cffba2e3f2024a6dd72/6266aa10065a3630e3720fd8", "Trojaned iFrame" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1296, "FileHash-SHA256": 255, "hostname": 362, "domain": 144, "CVE": 1, "FileHash-MD5": 38, "FileHash-SHA1": 37 }, "indicator_count": 2133, "is_author": false, "is_subscribing": null, "subscriber_count": 395, "modified_text": "1468 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "626710131cf58d7dc5d5e56b", "name": "/microtechnology.hk/wapdast/Ytd63ox3UMAQVlB.exe- Another savage stash of nasties", "description": "Trojaned iFrame", "modified": "2022-05-25T00:04:03.622000", "created": "2022-04-25T21:18:11.876000", "tags": [ "trojan", "apt", "pcap", "pcap processing", "windows nt", "runtime data", "malicious", "hosts", "mozi", "april", "local", "factory", "team", "february" ], "references": [ "https://hybrid-analysis.com/sample/ebfa6d583819827abf9f7b6d8d3f180c70a9cbe509cd4cffba2e3f2024a6dd72/6266aa10065a3630e3720fd8", "Trojaned iFrame" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1296, "FileHash-SHA256": 255, "hostname": 362, "domain": 144, "CVE": 1, "FileHash-MD5": 38, "FileHash-SHA1": 37 }, "indicator_count": 2133, "is_author": false, "is_subscribing": null, "subscriber_count": 396, "modified_text": "1468 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621cb7979a0e098a59765794", "name": "FAKE MDM's and HASH", "description": "FAKE MDM HOSTS AND HASH FILES TO COMPLIMENT IT.", "modified": "2022-03-30T00:00:10.458000", "created": "2022-02-28T11:52:55.393000", "tags": [ "filehashsha256", "ipv4", "filehashsha1", "indicator", "description", "antiviru", "up blocker", "xoz1" ], "references": [ "621a207acd980846334d7fb4.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "craignbmed", "id": "181999", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_181999/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 488, "FileHash-SHA1": 494, "FileHash-SHA256": 2217, "URL": 6858, "domain": 266, "hostname": 1729 }, "indicator_count": 12052, "is_author": false, "is_subscribing": null, "subscriber_count": 46, "modified_text": "1524 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621a207acd980846334d7fb4", "name": "This is a botnet consisting of millions of user controlled devices masquerading as mdm enterprise", "description": "sitting on home network private ip' all managed under the remotewd and w2go domains. They all look clean and shiny on the top layers but are all working together underneath to spread and cause merry hell. Compromised social media creds logging in to multiple other browssers at the same time exploiting others while you go about your business online. This is at least twice the size again of this pulse list", "modified": "2022-03-28T00:01:22.803000", "created": "2022-02-26T12:43:38.731000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1398", "name": "Modify OS Kernel or Boot Partition", "display_name": "T1398 - Modify OS Kernel or Boot Partition" }, { "id": "T1399", "name": "Modify Trusted Execution Environment", "display_name": "T1399 - Modify Trusted Execution Environment" }, { "id": "T1400", "name": "Modify System Partition", "display_name": "T1400 - Modify System Partition" }, { "id": "T1401", "name": "Device Administrator Permissions", "display_name": "T1401 - Device Administrator Permissions" }, { "id": "T1402", "name": "Broadcast Receivers", "display_name": "T1402 - Broadcast Receivers" }, { "id": "T1408", "name": "Disguise Root/Jailbreak Indicators", "display_name": "T1408 - Disguise Root/Jailbreak Indicators" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1204.003", "name": "Malicious Image", "display_name": "T1204.003 - Malicious Image" }, { "id": "T1205", "name": "Traffic Signaling", "display_name": "T1205 - Traffic Signaling" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1503", "name": "Credentials from Web Browsers", "display_name": "T1503 - Credentials from Web Browsers" }, { "id": "T1505.002", "name": "Transport Agent", "display_name": "T1505.002 - Transport Agent" }, { "id": "T1601.002", "name": "Downgrade System Image", "display_name": "T1601.002 - Downgrade System Image" }, { "id": "T1001.002", "name": "Steganography", "display_name": "T1001.002 - Steganography" }, { "id": "T1602.002", "name": "Network Device Configuration Dump", "display_name": "T1602.002 - Network Device Configuration Dump" }, { "id": "T1506", "name": "Web Session Cookie", "display_name": "T1506 - Web Session Cookie" }, { "id": "T1517", "name": "Access Notifications", "display_name": "T1517 - Access Notifications" }, { "id": "T1523", "name": "Evade Analysis Environment", "display_name": "T1523 - Evade Analysis Environment" }, { "id": "T1534", "name": "Internal Spearphishing", "display_name": "T1534 - Internal Spearphishing" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1815, "URL": 6912, "domain": 248, "FileHash-SHA256": 2217, "FileHash-SHA1": 7 }, "indicator_count": 11199, "is_author": false, "is_subscribing": null, "subscriber_count": 402, "modified_text": "1526 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://hybrid-analysis.com/sample/ebfa6d583819827abf9f7b6d8d3f180c70a9cbe509cd4cffba2e3f2024a6dd72/6266aa10065a3630e3720fd8", "621a207acd980846334d7fb4.csv", "Trojaned iFrame" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 20694 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/active.co", "whois": "http://whois.domaintools.com/active.co", "domain": "active.co", "hostname": "ww17.active.co" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 8, "pulses": [ { "id": "65707f8ee427db014eda79f3", "name": "FAKE MDM's and HASH", "description": "", "modified": "2023-12-06T14:05:02.692000", "created": "2023-12-06T14:05:02.692000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6858, "FileHash-SHA256": 2217, "FileHash-MD5": 488, "FileHash-SHA1": 494, "domain": 266, "hostname": 1729 }, "indicator_count": 12052, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707f66d3fe743b63b06fc5", "name": "This is a botnet consisting of millions of user controlled devices masquerading as mdm enterprise", "description": "", "modified": "2023-12-06T14:04:22.492000", "created": "2023-12-06T14:04:22.492000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6912, "FileHash-SHA256": 2217, "domain": 248, "hostname": 1815, "FileHash-SHA1": 7 }, "indicator_count": 11199, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "629f32000e99da994ecb5f62", "name": "80880.bodis - passive DNS = CNAME bug cookie priv escalation 450 records = n. sh", "description": "ioc's from all passive dns records potentially using CNAME record cookie priv escalation bug to abuse and break analytics with user agent.\nmass of 404 connection errors invoked to hijack/redir traffic to top level immitation sites running on massive nubotnet", "modified": "2022-07-07T00:01:42.558000", "created": "2022-06-07T11:09:52.102000", "tags": [ "n. sh", "CNAME cookie priv escalation", "CVE-2021-22941", "ww1", "neural", "nubotnet" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 370, "hostname": 1775, "URL": 2331, "domain": 453 }, "indicator_count": 4929, "is_author": false, "is_subscribing": null, "subscriber_count": 395, "modified_text": "1425 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "629ea3c60ad34195c60d67f2", "name": "80880.bodis.com", "description": "", "modified": "2022-06-07T01:03:02.429000", "created": "2022-06-07T01:03:02.429000", "tags": [ "domain related", "CNAME cookie priv bug", "cookie abuse", "compromised browser", "parked domains", "proxy traffic", "stealth ad/click fraud", "self signed abused ssl" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 22, "URL": 840, "hostname": 785, "domain": 201 }, "indicator_count": 1848, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1455 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62671011c011c18ebd21feb0", "name": "/microtechnology.hk/wapdast/Ytd63ox3UMAQVlB.exe- Another savage stash of nasties", "description": "Trojaned iFrame", "modified": "2022-05-25T00:04:03.622000", "created": "2022-04-25T21:18:09.686000", "tags": [ "trojan", "apt", "pcap", "pcap processing", "windows nt", "runtime data", "malicious", "hosts", "mozi", "april", "local", "factory", "team", "february" ], "references": [ "https://hybrid-analysis.com/sample/ebfa6d583819827abf9f7b6d8d3f180c70a9cbe509cd4cffba2e3f2024a6dd72/6266aa10065a3630e3720fd8", "Trojaned iFrame" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1296, "FileHash-SHA256": 255, "hostname": 362, "domain": 144, "CVE": 1, "FileHash-MD5": 38, "FileHash-SHA1": 37 }, "indicator_count": 2133, "is_author": false, "is_subscribing": null, "subscriber_count": 395, "modified_text": "1468 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "626710131cf58d7dc5d5e56b", "name": "/microtechnology.hk/wapdast/Ytd63ox3UMAQVlB.exe- Another savage stash of nasties", "description": "Trojaned iFrame", "modified": "2022-05-25T00:04:03.622000", "created": "2022-04-25T21:18:11.876000", "tags": [ "trojan", "apt", "pcap", "pcap processing", "windows nt", "runtime data", "malicious", "hosts", "mozi", "april", "local", "factory", "team", "february" ], "references": [ "https://hybrid-analysis.com/sample/ebfa6d583819827abf9f7b6d8d3f180c70a9cbe509cd4cffba2e3f2024a6dd72/6266aa10065a3630e3720fd8", "Trojaned iFrame" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1296, "FileHash-SHA256": 255, "hostname": 362, "domain": 144, "CVE": 1, "FileHash-MD5": 38, "FileHash-SHA1": 37 }, "indicator_count": 2133, "is_author": false, "is_subscribing": null, "subscriber_count": 396, "modified_text": "1468 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621cb7979a0e098a59765794", "name": "FAKE MDM's and HASH", "description": "FAKE MDM HOSTS AND HASH FILES TO COMPLIMENT IT.", "modified": "2022-03-30T00:00:10.458000", "created": "2022-02-28T11:52:55.393000", "tags": [ "filehashsha256", "ipv4", "filehashsha1", "indicator", "description", "antiviru", "up blocker", "xoz1" ], "references": [ "621a207acd980846334d7fb4.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "craignbmed", "id": "181999", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_181999/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 488, "FileHash-SHA1": 494, "FileHash-SHA256": 2217, "URL": 6858, "domain": 266, "hostname": 1729 }, "indicator_count": 12052, "is_author": false, "is_subscribing": null, "subscriber_count": 46, "modified_text": "1524 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621a207acd980846334d7fb4", "name": "This is a botnet consisting of millions of user controlled devices masquerading as mdm enterprise", "description": "sitting on home network private ip' all managed under the remotewd and w2go domains. They all look clean and shiny on the top layers but are all working together underneath to spread and cause merry hell. Compromised social media creds logging in to multiple other browssers at the same time exploiting others while you go about your business online. This is at least twice the size again of this pulse list", "modified": "2022-03-28T00:01:22.803000", "created": "2022-02-26T12:43:38.731000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1398", "name": "Modify OS Kernel or Boot Partition", "display_name": "T1398 - Modify OS Kernel or Boot Partition" }, { "id": "T1399", "name": "Modify Trusted Execution Environment", "display_name": "T1399 - Modify Trusted Execution Environment" }, { "id": "T1400", "name": "Modify System Partition", "display_name": "T1400 - Modify System Partition" }, { "id": "T1401", "name": "Device Administrator Permissions", "display_name": "T1401 - Device Administrator Permissions" }, { "id": "T1402", "name": "Broadcast Receivers", "display_name": "T1402 - Broadcast Receivers" }, { "id": "T1408", "name": "Disguise Root/Jailbreak Indicators", "display_name": "T1408 - Disguise Root/Jailbreak Indicators" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1204.003", "name": "Malicious Image", "display_name": "T1204.003 - Malicious Image" }, { "id": "T1205", "name": "Traffic Signaling", "display_name": "T1205 - Traffic Signaling" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1503", "name": "Credentials from Web Browsers", "display_name": "T1503 - Credentials from Web Browsers" }, { "id": "T1505.002", "name": "Transport Agent", "display_name": "T1505.002 - Transport Agent" }, { "id": "T1601.002", "name": "Downgrade System Image", "display_name": "T1601.002 - Downgrade System Image" }, { "id": "T1001.002", "name": "Steganography", "display_name": "T1001.002 - Steganography" }, { "id": "T1602.002", "name": "Network Device Configuration Dump", "display_name": "T1602.002 - Network Device Configuration Dump" }, { "id": "T1506", "name": "Web Session Cookie", "display_name": "T1506 - Web Session Cookie" }, { "id": "T1517", "name": "Access Notifications", "display_name": "T1517 - Access Notifications" }, { "id": "T1523", "name": "Evade Analysis Environment", "display_name": "T1523 - Evade Analysis Environment" }, { "id": "T1534", "name": "Internal Spearphishing", "display_name": "T1534 - Internal Spearphishing" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1815, "URL": 6912, "domain": 248, "FileHash-SHA256": 2217, "FileHash-SHA1": 7 }, "indicator_count": 11199, "is_author": false, "is_subscribing": null, "subscriber_count": 402, "modified_text": "1526 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://ww17.active.co", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://ww17.active.co", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780344445.7463462 }